Unencrypted Satellite Data Exposes Sensitive Information

A recent study conducted by computer scientists from the University of California, San Diego (UCSD) and the University of Maryland (UMD) revealed alarming vulnerabilities in the security of geostationary (GEO) satellite communications. Using approximately $600 worth of consumer-grade equipment, the researchers intercepted unencrypted satellite data belonging to the Mexican government, military, and various corporations. Their findings, published in a paper titled “Don’t Look Up: There Are Sensitive Internal Links in the Clear on GEO Satellites,” indicate that about 50% of GEO satellite links carry cleartext IP traffic, exposing sensitive information to potential interception.

Researchers find much Mexican satellite data is unencrypted and easily hackedUnencrypted Satellite IP Traffic is a Widespread Problem

The researchers conducted a comprehensive survey of 39 GEO satellites across 25 longitudes, uncovering a wide range of unencrypted traffic. This included sensitive communications from the Mexican government, military, and law enforcement agencies, as well as data from major corporations like the Federal Electricity Commission (CFE), Walmart México, and financial institutions such as Banorte and Santander. Notable findings included:

Researchers find much Mexican satellite data is unencrypted and easily hacked

• Military and Government Data: Unencrypted links were found connecting remote command centers and surveillance outposts, revealing military asset tracking records and law enforcement personnel data.

Researchers find much Mexican satellite data is unencrypted and easily hacked

• Corporate Data: Walmart México’s internal inventory management system was broadcasting unencrypted logins and corporate emails. Similarly, Santander and Banorte had extensive unencrypted traffic linked to their internal infrastructures.

Researchers find much Mexican satellite data is unencrypted and easily hacked

• Telecommunications Data: The researchers intercepted unencrypted cellular backhaul traffic from AT&T México, including plaintext user Internet traffic and phone numbers.

Researchers find much Mexican satellite data is unencrypted and easily hacked

Following their findings, the researchers disclosed the vulnerabilities to relevant Mexican authorities and companies, including CERT-MX, the National Cybersecurity Incident Response Center, on April 4, 2025. They emphasized that their intent was to inform affected parties about the security flaws before publishing their results. The researchers noted a significant mismatch between the expected security of satellite communications and the reality of unencrypted data transmission.

Researchers find much Mexican satellite data is unencrypted and easily hacked

The study has raised serious concerns regarding the security practices of satellite communications. Critics argue that the lack of encryption exposes critical infrastructure to risks from corporate espionage, criminal activities, and hostile state actors. The researchers pointed out that while encryption is standard for satellite television, it is surprisingly absent in private networks using GEO satellites for backhaul IP traffic.

Unencrypted Satellite IP Traffic is a Widespread ProblemSky-High Hack: How $600 Unlocked Global Secrets Streaming from Space

The findings underscore a critical need for improved security measures in satellite communications. The researchers highlighted that the economics of satellite operations often discourage encryption due to costs and potential impacts on performance. They called for a reevaluation of security protocols to protect sensitive data transmitted via satellite, emphasizing that the current state of unencrypted traffic poses a significant threat to privacy and national security.

Unencrypted Satellite IP Traffic is a Widespread Problem

• “Given that any individual with a clear view of the sky and US$600 can set up their own GEO interception station from Earth, one would expect that GEO satellite links carrying sensitive commercial and government network traffic would use standardized link and/or network layer encryption.” — Wenyi Morty Zhang, UCSD Researcher

Sky-High Hack: How $600 Unlocked Global Secrets Streaming from Space

• “there is a clear mismatch between how satellite customers expect data to be secured and how it is secured in practice.” — UCSD and UMD Researchers

Researchers find much Mexican satellite data is unencrypted and easily hacked

The study serves as a wake-up call for stakeholders in satellite communications, urging immediate action to address these vulnerabilities and protect sensitive information from interception.

Unencrypted Satellite IP Traffic is a Widespread Problem