How would one hack a battleship in space warfare?

Question

Note: I might have put way too much information here; I've bolded the most important things.

Okay so here's the situation (this is the context in story; I'll bold the actual question): the Solar Federation has sent Solfleet 7, which has twenty-five ships, to take out the Titanean Order. The events of this scene take place in orbit around Saturn, near the orbit of Iapetus.

After the fleet spreads around the system, the three Sirius-class ships (the biggest, baddest things in the solar system; their main weapon is a massive 2GW Particle Beam mounted inside the ship, which is somewhat cylinder-shaped), two fuel ships, and one medical ship, which are still grouped together, are approached by a puny ship, the Saboteur from the Order.

The captain of the Saboteur antagonizes the Admiral of Solfleet 7 into ordering one of the Sirius ships, the Leopard, to fire on the Saboteur. The Leopard, though, has an explosion on the bridge that seems to have been caused by the particle beam.

Here's my current explanation of how this happened: The Leopard was hacked by the Saboteur and its targeting instructions were changed.

My current process for how that happened involves nanomachines latching onto the medical ship (which is older with less robust security) and exploiting the way that Federation ships can be remotely detonated (by the Admiral to combat mutiny in extreme situations) to alter the beam's code. I need a better way for the Saboteur to hack the Leopard. Your resources:

• The Titanean Order has hired the engineer who was in charge of designing the Sirius-class battleships. This means they will have access to detailed technical details of how the Leopard's systems worked.

• They've been spending tons on developing this technology, so spare no cost.

• You have a maximum of three people to monitor and guide the hacking process. The Saboteur has a five-person crew, and two of them are the Captain (who will be talking to the Admiral over radio) and the Pilot (who will be flying the ship). I'd love to have an extra person available if that's possible; so bonus points if you can do it with two people.

• The Saboteur will be thirty meters long (probably 15 wide/tall? That's a bit variable. It should look like a normal shuttle.) and use chemical propulsion. Assume that you get, say 2,500 m^3 to put equipment and crew working space in. If you need a giant heavy thing (other than, say, a huge computer for cracking cryptography) it probably won't work. The lighter, the better.

• You may, if necessary, change the storyline within reasonable limits to accommodate your idea.

The best answer will:

• Provide a full explanation of how the hack is carried out. You may use my own concept, altered to make it more believable. This all takes place about 150 years from now, so use appropriate technology (bonus points if they use some retro technology no one in that time period remembered).

• Provide a plan that will thoroughly spook the bewildered Admiral (this is made easier by the fact that her best friend is killed in the explosion; you can factor in some emotional trauma) enough to surrender the fleet. (i.e. This should be something she believes they can do again, to other ships.) To help, note that the Leopard's particle beam was successfully tested before departure and locked down until about an hour before arrival, eliminating the possibility of sabotage (which would likely not be repeatable).

• Explain the resources needed to complete the plan.

Good luck! Ask me if you have questions or need clarification.

Answer 1

I think it is possible that 150 years from now, the interfaces for every device are not necessarily located on the respective device. Huge guns are complex things that swivel on a base and require targeting at supersonic speeds, whereas people like to live in safe cages full of oxygen and comfy pillows, not to mention a lot of screens to display information, and ways to interact with the world. I think mechanical backups are always going to be useful, and you need hallways to the physical guns for maintenance and such, but a clever spaceship is one that distributes its crewmembers over one or several high-information rooms from where they control everything.

Such control rooms can be wired to the devices they control, but a wireless connection is not unrealistic: it would allow for control even part of the ship is gone, even if it has been broken into pieces. That's another advantage of storing humans in control rooms: you only need to keep those pressurised.

So, assuming all that, we now have a wireless connection from operator to gun. Bingo! A wireless connection is something a hacker can overpower; by sending their own signal at the same frequency, the way they can currently broadcast their own versions of public WiFi networks and collect bank information from any user accidentally using the fake network.

This connection - which probably goes over radiowaves or some sci-fi ether medium - is going to have all kinds of encryption to prevent any random jumbo from doing this. That's where technical knowledge of the Leopard comes in handy. You need to know the kind of connection and the frequency, which an engineer could probably provide. But to break - or rather mimic - the encryption, you need knowledge of this particular ship. That knowledge may change from day to day. It would be worth its weight in gold, but possibly something feasible to retrieve in this war situation.

If you have all that information, then this hack can go about without alerting the occupants of the Leopard. You can take a small device to emit the radio waves, and get it latched upon the ship's hull. If the interior functions like a Faraday Cage, you may need this device to drill its way inside too. Once it is in range, it can send the gun instructions to change target, and also send the user interface instructions to still display the original target. How about the logs too? The more you know of the systems, the more you can cover up. Nobody could ever know what hit the Leopard.

But you may not know the encryption keys; and there you can brute force your way in. The supercomputer can be handy for trying all the different encodings: keep sending new combinations to your remotely-controlled radio emitter, and it will keep trying to control the guns until it succeeds. But, any failed attempt to brute-force into the network will probably trigger a number of alarms.

Unless you do that purposely.

Admiral Leopard: "Move us into Saturnian orbit, helmsman. I have received word that a small Titanean Order craft has been spotted snooping about near our precious Helium-3 mines."

Helmsman: "Aye, ma'am! Fleet moving in!"

Captain Saboteur: "Howdy, Admiral! We are just paying visitation to Iapetus, nothing to worry about."

Admiral: "Titanean traitor... You will surrender your vessel and -"

BEEP BEEP BEEP BEEP

Admiral: "What's that?"

CS Officer: "Admiral, hacking attempt underway! On all of our ships!"

Admiral: "How long until they crack us?"

CS Officer: "Approximately fifteen million years."

Admiral: "No reason to let that Order scum go free! Try to find that radio emitter, and aim the 2GW!"

Gunman: "Aye ma'am!"

Captain: "Please Admiral! Do not fire, your mother is aboard! In my bedroom."

Admiral: "Fire!"

BOOM!

five minutes of confusion later

CS Officer: "Ma'am, the ship was the Saboteur. Half of that vessel is supercomputer! It found the right combination in fifteen seconds!"

Admiral: "Next time, destroy that ship on sight! Now leave me, I must call my mother!"

That trick may only work once.

Answer 2

Entry

Your traitor tells you that the way in is a flaw in the "Mode A" transponder. To save costs, the ancient transponder system implemented Mode A (indentifying code), Mode C (flight information) and Mode S (data) all in software. The Mode C and Mode S underwent anti-hacking measures such as penetration testing and hardening. The Mode A, because it was thought to be static data, did not.

In fact, your traitor has a copy of an e-mail from one of the software developers who had identified a security flaw in the Mode A system. The code had a bug where if the transponder code changes (it shouldn't) the new letters and numbers are tacked on to the end of the existing code. At a certain point, the developer proved, a changing code would overflow a string buffer and could begin writing arbitrary instructions into the system.

The designed assures you that the ship executive staff had thought the bug dubious, and it never received the time or energy to fix.

The access point is write-only, you can not read back what you send, but with repetition and self-correcting codes you can download your own software. In essence, you control one of the bridge computers.

Expanding Your Reach

The hard disks and memory are encrypted at rest. However, the CPU needs unencrypted instructions to run. So, your buffer overflow attack on the Mode A transponder takes you right past these pretty strong methods of protection.

The computer system is hardened. Data in motion (requests between computer systems) is also encrypted. Without a certificate, you would be trapped in the navigation computer.

However, because you are on a trusted computer, you have the certificates.

Because the ship is highly automated, including environmental and tactical, you are good.

Normally, the bridge has the additional protection of being physically isolated (no wired or wireless connections) from the rest of the ship. However, your traitor also tells you about a shortcut the builder took to get meet the intercom requirements -- they made an undocumented wired connection between the bridge and off-bridge systems, that designers thought (because of it's single use and lack of documentation) no one would discover.

Your traitor, who helped make that shortcut decision guides you to the hole.

Freaking Out the Admiral

You already are aware, through other informants, of the weakness of the Admiral. You can send requests to the environmental control system to turn on lights in the Friend's quarters during what would have been his off-duty hours.

You can send commands to the Battle Management System to occasionally put up a Friendly contact with the friend's nickname.

If the Admiral is blaming the experimental weapon, you can step up the terror by flashing the cabin lights in Morse Code saying "UNSAFE", or put that up in clear text on the Battle Management System.

Answer 3

Backdoor.

Is there any electronic gizmo you could find in a store today, that you don't believe has some secret, special back door? Something the company that made it could use just in case you turn out to be the next Osama bin Laden, or you get somebody mad at you who could regulate them out of business or quietly order their patent case to be ruled against them?

Before they went to meet the Leopard, the engineer told them who made the particle beam resonator. They had a quiet chat with a contact on the Dark Web who has a friend in the defense contractor that made the particle beam. After a tense battle with the Order's budget office to authorize a loan of three nanodogecoins and citizenship for their contact's extended family, a deal was struck.

There is a feedback sensor that regulates the intensity of the beam by reading gamma ray intensity. As it so happens, it monitors at a frequency of precisely 1.5 ZHz (that's zetta, mind). So a coherent gamma pulse can talk to it easily, and if three pulses of precisely two femtoseconds length separated a femtosecond are received by that sensor, it is designed to give a false low reading. The particle beam will then automatically upregulate its intensity until it explodes.

Once the first ship detonates this way, the people on all the others realize that they cannot fire, so now it's time to see what undocumented features are present in their propulsion systems.