Satellites are just computers in orbit. They run Linux (or VxWorks). They have IP addresses. And they communicate over Radio Waves that ANYONE on Earth can intercept.
The Downlink Problem
Satellites broadcast data down to a large footprint (a whole continent).
With a $20 TV Tuner (RTL-SDR) and a home-made antenna, you can intercept unencrypted weather images (NOAA) or even corporate paging data.
In 2020, researchers found hackers intercepting sensitive command traffic because the uplink was encrypted but the downlink wasn't.
1. GPS Spoofing
GPS signals are incredibly weak (like a lightbulb 20,000 km away).
It's easy to overpower them.
Spoofing: You broadcast a fake GPS signal that says "You are at coordinates 0,0".
Impact: Ships drift off course. Drones can be hijacked and forced to land (Iran did this to a US Sentinel drone).
2. Hacking Starlink
Starlink uses a User Terminal (Dishy) to talk to the satellite.
Researchers used a "glitching" attack (Voltage Fault Injection) on the Dishy's CPU to bypass the secure boot, retrieve the firmware, and gain root access to the terminal.
3. Old Satellites
There are satellites up there from the 90s.
They have no concept of modern crypto. If you know the frequency and the command structure, you can supposedly control them. (This is illegal and highly difficult, but theoretically possible).
Defenses
1. Authenticated Signals: Modern GPS (M-Code) uses encryption so it cannot be spoofed.
2. Encryption everywhere: Encrypt the link Up and Down.