Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How hackers abused satellites to stay under the radar (2015)

arstechnica.com

Post reply on HN
Print view View original

11–20 of 69 posts

Re: How hackers abused satellites to stay under the radar (2015)

#11

Post by MichaelGG »

sillysaurus3 wrote: post #9
thefreeman wrote: post #6

So this has to be some sort of state sponsored hacking right? I can't think of a non government group who would have the knowledge, money, or motivation to research this just to mask their origin when there are far simpler ways of receiving transactions (ie. bitcoin)

Not necessarily. I briefly pretended to be a criminal, mostly for fun. (Most readers will go "Uh huh" at this, but it was just a game.) Say you're developing the next Silk Road. Say you have perfect opsec, and you never reveal any personal info. What are your risks? The #1 risk is discovery of your physical location. Before every action, you must ask yourself: Will the next keystroke get me caught? It takes immense d…

Or you could have just bought the cards with Bitcoin. Same for phone verification. By buying the card in person you leak a ton of location information.

Re: How hackers abused satellites to stay under the radar (2015)

#13

Post by cm2187 »

I don't get it. It is impossible to identify who receives the packets but TCP/IP requires an acknowledgement that the packets have been received before sending more packets. Surely the C&C could be tracked from this acknowledgement? Or were they using UDP?

Re: How hackers abused satellites to stay under the radar (2015)

#14

Post by plq »

politician wrote: post #5

Are these satellites in geosynchronous orbit? If not, and you've got a copy of the malware, you ought to be able to narrow the location of the C&C server using its orbit and a correlation analysis of when the malware receives comms from the C&C. Depending on the orbit, I'll bet you could bracket it to a few degrees. Since the attackers can't stop answering C&C calls or their network collapses, merely publishing that…

$DAYJOB is about deploying satellite equipment.

> Are these satellites in geosynchronous orbit?

Yes. Satellites in other orbits require tracking antennas. A typical one has a four-figure cost at the very least. And if you need uninterrupted connection, you need to have at least two of them, one for tracking the one that sets, and another for tracking the one that rises.

> I'm willing to bet that satellite downlink performance degrades in bad weather

Ku band, as deployed, is highly resilient to bad weather. The SNR will drop, sure, but it will be well above the threshold where it will be unintelligible to the receiver. These things are designed with worst weather conditions in mind. If ever you lost satellite tv during bad weather, that's due to your antenna shaking because of the wind, not rainfade.

DVB-S2 in particular supports adaptive coding modulation (ACM). The standard supports between 4psk and 32psk which can be changed by the ground station when fade is detected in their reference terminals scattered around the footprint region.

You can't really do that for TV links where the bandwidth allocation is more-or-less constant, but you can definitely change modulation for data links which are actually designed to handle such fluctuations in available bandwidth.

Re: How hackers abused satellites to stay under the radar (2015)

#15

Post by zkms »

This beautiful exfiltration technique of actively sending packets to an IP address that will be routed on a link you can passively eavesdrop on -- in this case, a satellite link -- is one that appears in the leaked Snowden documents: (warning, classified document) https://snowdenarchive.cjfe.org/greenstone/collect/snowden1/...

Re: How hackers abused satellites to stay under the radar (2015)

#16

Post by schiffern »

plq wrote: post #14
politician wrote: post #5

Are these satellites in geosynchronous orbit? If not, and you've got a copy of the malware, you ought to be able to narrow the location of the C&C server using its orbit and a correlation analysis of when the malware receives comms from the C&C. Depending on the orbit, I'll bet you could bracket it to a few degrees. Since the attackers can't stop answering C&C calls or their network collapses, merely publishing that…

$DAYJOB is about deploying satellite equipment. > Are these satellites in geosynchronous orbit? Yes. Satellites in other orbits require tracking antennas. A typical one has a four-figure cost at the very least. And if you need uninterrupted connection, you need to have at least two of them, one for tracking the one that sets, and another for tracking the one that rises. > I'm willing to bet that satellite downlink pe…

>If ever you lost satellite tv during bad weather, that's due to your antenna shaking because of the wind, not rainfade.

Huh, my observations have been different. I lose TV even before the rain and wind starts (trees make any wind quite visible), just because the dense dark rain clouds are blocking the signal path. The rain typically starts a couple minutes later.

For digital TV there's an incentive to maximize bandwidth. So they're going to trade off signal:noise to get 99.99% (1-10 minutes/mo), but not 99.99999%. Especially since as you say, the wind will result in some signal interruptions anyway!

Re: How hackers abused satellites to stay under the radar (2015)

#17

Post by Moru »

schiffern wrote: post #16
plq wrote: post #14

Earlier quoted context omitted.

$DAYJOB is about deploying satellite equipment. > Are these satellites in geosynchronous orbit? Yes. Satellites in other orbits require tracking antennas. A typical one has a four-figure cost at the very least. And if you need uninterrupted connection, you need to have at least two of them, one for tracking the one that sets, and another for tracking the one that rises. > I'm willing to bet that satellite downlink pe…

>If ever you lost satellite tv during bad weather, that's due to your antenna shaking because of the wind, not rainfade. Huh, my observations have been different. I lose TV even before the rain and wind starts (trees make any wind quite visible), just because the dense dark rain clouds are blocking the signal path. The rain typically starts a couple minutes later. For digital TV there's an incentive to maximize bandw…

You might not have the most optimal angle on your satellite antenna so it's very sensitive.

Re: How hackers abused satellites to stay under the radar (2015)

#18

Post by plq »

schiffern wrote: post #16
plq wrote: post #14

Earlier quoted context omitted.

$DAYJOB is about deploying satellite equipment. > Are these satellites in geosynchronous orbit? Yes. Satellites in other orbits require tracking antennas. A typical one has a four-figure cost at the very least. And if you need uninterrupted connection, you need to have at least two of them, one for tracking the one that sets, and another for tracking the one that rises. > I'm willing to bet that satellite downlink pe…

>If ever you lost satellite tv during bad weather, that's due to your antenna shaking because of the wind, not rainfade. Huh, my observations have been different. I lose TV even before the rain and wind starts (trees make any wind quite visible), just because the dense dark rain clouds are blocking the signal path. The rain typically starts a couple minutes later. For digital TV there's an incentive to maximize bandw…

> So they're going to trade off signal:noise to get 99.99%, but not 99.99999%.

Depends on where you are in the footprint as well, but of course, totally forgot about the suits.

I should have said it's entirely possible to make Ku withstand the worst weather conditions known to mankind, which is not the case for Ka.

Trivia: Ku stands for K-under, and Ka stands for K-above, where K-band is IIRC something between 18-27 GHz. Electromagnetic transmissions in this spectrum are absorbed by water vapour, so it's a very bad idea to use this spectrum for satellite. Again IIRC, above 70Ghz, the atmosphere stops being radio-transparent.

Ka is way more efficient, but you need a ground station, a satellite and modems that are built from ground up to cope with rainfade. The tricks that work with Ku won't work with Ka.

Re: How hackers abused satellites to stay under the radar (2015)

#19

Post by [deleted] »

Moru wrote: post #17
schiffern wrote: post #16

Earlier quoted context omitted.

>If ever you lost satellite tv during bad weather, that's due to your antenna shaking because of the wind, not rainfade. Huh, my observations have been different. I lose TV even before the rain and wind starts (trees make any wind quite visible), just because the dense dark rain clouds are blocking the signal path. The rain typically starts a couple minutes later. For digital TV there's an incentive to maximize bandw…

You might not have the most optimal angle on your satellite antenna so it's very sensitive.

[deleted]

Re: How hackers abused satellites to stay under the radar (2015)

#20

Post by sillysaurus3 »

MichaelGG wrote: post #11
sillysaurus3 wrote: post #9

Earlier quoted context omitted.

Not necessarily. I briefly pretended to be a criminal, mostly for fun. (Most readers will go "Uh huh" at this, but it was just a game.) Say you're developing the next Silk Road. Say you have perfect opsec, and you never reveal any personal info. What are your risks? The #1 risk is discovery of your physical location. Before every action, you must ask yourself: Will the next keystroke get me caught? It takes immense d…

Or you could have just bought the cards with Bitcoin. Same for phone verification. By buying the card in person you leak a ton of location information.

Agreed, though it was three years ago when BTC was less useful. Does phone verification as a service really work now? Also I wonder how many gift cards you can purchase reliably and quickly.

FWIW, it was the same idea as this article, just a 20 mile radius instead of 600. General location was going to be leaked anyway since it's impossible to use the internet without doing so. Even if you rely on Tails with perfect opsec, traffic correlation can narrow down which region you're in. It's possible to figure out your timezone based on the times of your online interactions. If this SecureDrop offshoot was to succeed, it was going to require lots of communication with the press and with users. Much of the value of the service is knowing you're not alone, and that there are people who are incorruptible and can do something with the information. (My plan was to carefully vet the info for legitimacy, carefully anonymize it, then try to contact some special agent via email once I had anything actionable.)

Post reply on HN