The Spacecraft Hacker's Handbook

General Thoughts

The Spacecraft Hacker's Handbook is ambitious, practical, and deeply rewarding. It takes you from knowing almost nothing about space missions to having intelligent conversations about their architecture and enough methodology to conduct your own security research. I came in with no real understanding of how spacecraft, ground stations, mission control systems, or satellite terminals worked. I finished the book with a working mental model of those systems and a clear sense of where I could keep learning on my own.

That is a significant achievement in a 344-page book. The authors compress what feels like an entire introductory course into an information-dense technical survey without getting stuck in the mathematics of signals or orbital mechanics. The most useful lesson is how many boundaries exist across a space system, and how those boundaries interact. Ground stations, mission control software, flight software, communications protocols, user terminals, and navigation receivers each create opportunities for research. The only thing likely to slow some readers down is also one of the book's biggest strengths: it covers a broad range of concepts in a relatively small page count, which makes the reading technically dense. That compression is part of why it works.

I read the DEF CON edition, which is an uncorrected proof. The broader review should still stand for the production edition, assuming the usual relatively small content changes between a proof and the final book. Specific wording, examples, screenshots, or corrections may differ in the published version.

The book's density is part of its value, but the acronym load is real. Terms are often introduced once and then reused pages later without enough expansion or repetition to make them stick. I would have understood the material faster if acronyms were spelled out more consistently throughout the book, not only on first use. More than once I photographed a dense page and passed it to ChatGPT to explain every abbreviation before I could move on. The protocol chapter goes especially deep and rewards focused reading, but its central lesson is important: the protocol itself can be an attack surface. I would happily have spent more time with the Global Navigation Satellite Systems exploitation material as well, although the legal limits around transmitting in reserved bands are real.

Chapter Breakdown

Part I: Foundations of Space Security

Chapter 1: A Space Security Primer

A strong opening. It introduces the ground, space, and user segments, explains the operational concepts behind spacecraft and mission planning, and covers orbits, satellite use cases, testing constraints, and the relationship to embedded systems and Industrial Control Systems. It gives a reader enough context to understand the rest of the book without burying them in science or mathematics.

Chapter 2: The Threat Landscape

This chapter gives a broad survey of what can go wrong. Anti-satellite weapons, electronic warfare, physical attacks, cyberattacks, supply chain compromise, radiation, space weather, and debris all appear before the discussion moves into the NIST Cybersecurity Framework and OWASP Threat Dragon. The range is the point. A spacecraft is not a single target with a single perimeter. It is a collection of connected systems exposed to very different kinds of failure and attack.

Chapter 3: Security Testing

The foundation section closes well. The chapter moves from reconnaissance through hardware, operating system, network, and application testing, then introduces taint analysis, static analysis, debugging, black-box testing, reverse engineering, and exploit development. It establishes the methodology that the later chapters apply to real systems, without turning into a disconnected testing textbook.

Part II: The Ground Segment

Chapter 4: Ground-Space Communications

This is where the book asks the reader to slow down. It takes apart the CCSDS protocol stack, including Space Packet Protocol, the Packet Utilization Standard, telemetry and telecommand packets, data link protocols, Space Data Link Security, Communications Operation Procedure-1, channel coding, and radio-layer concepts. I appreciated that the authors were willing to show how the pieces fit together. It demands patience, but the high-level lesson is valuable: the protocol itself can be an attack surface. The chapter made a specialized communications stack feel like something a security researcher can methodically study.

Chapter 5: Mission Control Systems

The theory becomes concrete here. The screenshots are useful, and the walkthroughs of Yamcs, OpenC3 COSMOS, and the F Prime Ground Data System show what operators actually work with. Seeing telemetry, command dictionaries, storage buckets, scripts, and event views made the systems easier to understand before the exploitation chapters arrived. The setup material is unusually approachable for a technical book and gives the reader a real feel for the tools.

Chapter 6: Exploiting Ground Segment Protocols

This is where protocol security became real for me. The authors build a Space Link Extension environment, capture traffic with Wireshark, examine the encoded messages, and modify the authentication exchange through a man-in-the-middle attack. The attack is not complicated, which is exactly why it works as a lesson. Custom protocols used in space systems may not receive the same security scrutiny as common IT protocols, even when they carry commands that ultimately reach a spacecraft.

Chapter 7: Hacking Ground Systems

This is where the book starts to feel like a hacking book instead of a course on space systems. The authors walk through stored cross-site scripting in F Prime, a chain from cross-site scripting to remote code execution in OpenC3 COSMOS, and directory traversal and arbitrary file deletion in Yamcs. Seeing the process from vulnerability discovery through proof of concept and exploitation made the earlier material feel earned.

Part III: The Space Segment

Chapter 8: Onboard Software

This chapter establishes a baseline for the software running on the spacecraft itself. The discussion of F Prime and NASA's core Flight System explains components, ports, topologies, deployments, the cFS software bus, operating system abstraction, and mission applications. It also shows how ground tools send commands and receive telemetry. The preparation is deliberate and pays off in the exploitation chapters that follow.

Chapter 9: Spacecraft Hacking

One of the book's most rewarding sections. The authors show the vulnerability research and exploitation process through a command-queue denial of service in F Prime and an out-of-bounds read in cFS's Memory Manager. The work moves from flooding commands and reading source code to debugging, tracing assertions, constructing a malicious telecommand, and triggering a crash. After all the earlier material, watching the pieces come together made me feel like a hacker rather than someone studying a system from the outside.

Part IV: The User Segment

Chapter 10: Attacking SATCOM Terminals

A useful change of pace into hardware hacking. The chapter revisits the KA-SAT attack, then moves from extracting firmware with a CH341A programmer and flash clip to unpacking it with Binwalk, reverse engineering a modem binary with Ghidra, and abusing an unsigned update mechanism in an emulated OpenWrt device. The attack surface feels much larger than the spacecraft itself. An attacker can reach the space service through a ground management system and a fleet of user terminals without touching the satellite.

Chapter 11: Exploiting Global Navigation Satellite Systems

The final chapter covers GNSS, jamming, signal-to-noise ratio, free-space loss, jammer-to-signal calculations, spoofing, meaconing, and software-defined simulation. The practical path from GPS-SDR-SIM to GNSS-SDR gives readers a safe way to study the problem without transmitting in reserved bands. I found the topic especially interesting because electronic warfare is not regularly discussed in accessible security material. I would happily have read a longer treatment, but the chapter still gives readers useful ideas for their own research.

The Appendixes

The appendixes were better than I expected. Appendix A covers the space sector, including agencies, commercial operators, laws, treaties, export controls, and standards. Appendix B explains spacecraft classes, launch vehicles, power, thermal control, data processing, communications, attitude control, payloads, ground stations, and user equipment. They read more like additional chapters than leftover reference material and help fill in the operational knowledge needed to understand the technical sections.

Who Should Read This

Security practitioners who want to enter space security will get the most from this book, as will aerospace engineers and operators trying to understand offensive security. It is especially valuable for anyone trying to bridge the gap between the two fields. Complete beginners can follow it with patience, while readers who already know either space systems or security will have enough technical depth to keep discovering new connections. People fluent in both fields will also find it useful as a long-term reference.

Closing

The lasting impression is how effectively this book opens the door to space security. It makes space systems feel less like distant, inaccessible machines and more like complex technology with protocols, interfaces, software, hardware, and trust boundaries that researchers can study. Every section opened another possible direction, from CCSDS packet parsing and mission control systems to flight software, SATCOM firmware, and GNSS receiver research.

The structure deserves credit too. The authors move from mission context to communications, ground software, flight software, terminals, and receivers in a way that steadily builds confidence. By the end, space security no longer feels like a distant specialty. It feels like a field I can enter, study, and contribute to.

An 8.5/10 feels right for this fantastic, broad, and practical introduction to space security. What keeps it from a perfect score is largely the same thing that makes it worth reading: so many concepts across ground, space, and user segments in 344 pages that the book stays technically dense and may put off readers looking for a lighter introduction. I did not mind that trade-off. It rewards active reading, and I would happily spend more time with both the protocol and GNSS sections on a second pass. More importantly, it achieved exactly what I wanted from it: I went in knowing almost nothing about space systems and left ready to conduct my own research because The Spacecraft Hacker's Handbook showed me where the boundaries are and how much opportunity remains on the other side.

Where to Buy

The Spacecraft Hacker's Handbook is published by No Starch Press and is available in September 2026 as a 344-page print book with early access ebook options.

DEF CON review copy

I read the DEF CON edition advance reader copy, shown here from the front and back. It is an uncorrected proof, so small wording, screenshot, or production details may differ in the final edition.