Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How hackers abused satellites to stay under the radar (2015)

arstechnica.com

Post reply on HN
Print view View original

21–30 of 69 posts

Re: How hackers abused satellites to stay under the radar (2015)

#21

Post by foota »

cm2187 wrote: post #13

I don't get it. It is impossible to identify who receives the packets but TCP/IP requires an acknowledgement that the packets have been received before sending more packets. Surely the C&C could be tracked from this acknowledgement? Or were they using UDP?

It sounds like the c&c server can detect any signal sent to the decoy host. So a TCP handshake might look like:

Victim to decoy: syn

CNC to victim posing as decoy, after reading sequence number from message 1: syn ack

Victim to decoy: ack

Re: How hackers abused satellites to stay under the radar (2015)

#22

Post by qb45 »

cm2187 wrote: post #13

I don't get it. It is impossible to identify who receives the packets but TCP/IP requires an acknowledgement that the packets have been received before sending more packets. Surely the C&C could be tracked from this acknowledgement? Or were they using UDP?

I too wondered about it, unless the communication is 100% unidirectional they must have some means of disguising the source of outgoing packets, probably involving at least source IP spoofing.

Re: How hackers abused satellites to stay under the radar (2015)

#23

Post by jacquesm »

sillysaurus3 wrote: post #9
thefreeman wrote: post #6

So this has to be some sort of state sponsored hacking right? I can't think of a non government group who would have the knowledge, money, or motivation to research this just to mask their origin when there are far simpler ways of receiving transactions (ie. bitcoin)

Not necessarily. I briefly pretended to be a criminal, mostly for fun. (Most readers will go "Uh huh" at this, but it was just a game.) Say you're developing the next Silk Road. Say you have perfect opsec, and you never reveal any personal info. What are your risks? The #1 risk is discovery of your physical location. Before every action, you must ask yourself: Will the next keystroke get me caught? It takes immense d…

- did you have a cellphone in your pocket?

- where did you get the cash?

- by talking about it you negated all the advantages you built up

- if you walk into a store wearing a facemask you run the risk of being arrested or even shot because they assume you are robbing the store

- you may have left fingerprints in the store

- the cabdriver has seen your face and knows your home address, you should have walked to the spot where you changed your clothes

- the clothes bought at the goodwill, did you pay cash for those too?

- what happened to the clothes afterwards?

- how did you summon the cab to your change location?

- you're lucky that neither of the houses you changed next to had a dog

Re: How hackers abused satellites to stay under the radar (2015)

#24

Post by ficklepickle »

Moru wrote: post #17
schiffern wrote: post #16

Earlier quoted context omitted.

>If ever you lost satellite tv during bad weather, that's due to your antenna shaking because of the wind, not rainfade. Huh, my observations have been different. I lose TV even before the rain and wind starts (trees make any wind quite visible), just because the dense dark rain clouds are blocking the signal path. The rain typically starts a couple minutes later. For digital TV there's an incentive to maximize bandw…

You might not have the most optimal angle on your satellite antenna so it's very sensitive.

Yes, very likely. I used to install and service satellite TV systems. You probably have low signal strength to begin with. If not, perhaps there is a tree that only blocks the signal when it's windy.

I once had a customer that lost signal in the rain. After much investigation, I found a splice in the cable...in the gutters, which filled with water when it rained.

Re: How hackers abused satellites to stay under the radar (2015)

#25

Post by eddd »

zkms wrote: post #15

This beautiful exfiltration technique of actively sending packets to an IP address that will be routed on a link you can passively eavesdrop on -- in this case, a satellite link -- is one that appears in the leaked Snowden documents: (warning, classified document) https://snowdenarchive.cjfe.org/greenstone/collect/snowden1/...

I love the last slide:

- do "the right thing" (whatever you the analysts think that is)

- Let me guess - you want everything, don't you?

Re: How hackers abused satellites to stay under the radar (2015)

#26

Post by emj »

cm2187 wrote: post #13

I don't get it. It is impossible to identify who receives the packets but TCP/IP requires an acknowledgement that the packets have been received before sending more packets. Surely the C&C could be tracked from this acknowledgement? Or were they using UDP?

For this to work you need: 1. satellite client decoy system that drops packages (not deny) 2. satellite client listening system 3. an other network connection that allowed source spoofing.

If you are contacted on the decoy system you just send the syn+ack packet with the other network with a spoofed address. You will be able to receive all the responses on the satellite connection and send all the responses on the source spoofing network connection.

Re: How hackers abused satellites to stay under the radar (2015)

#27

Post by diegoprzl »

The last time I had read about this technique was in 2010. [1] Those slides are a very good explanation. Back then I thought about it as a way to either sniff confidential data from the downlink or as a way to have an anonymous internet connection provided your ISP doesn't filter spoofed ips. Very interesting to see it used in the wild and for a C&C.

[1] http://www.blackhat.com/presentations/bh-dc-10/Nve_Leonardo/...

Re: How hackers abused satellites to stay under the radar (2015)

#28

Post by diegoprzl »

thefreeman wrote: post #6

So this has to be some sort of state sponsored hacking right? I can't think of a non government group who would have the knowledge, money, or motivation to research this just to mask their origin when there are far simpler ways of receiving transactions (ie. bitcoin)

Take a look at these slides [1] They're for 2010. Hardware needed? Around 70$. Knowledge? With those instructions, anyone. For the uplink you need to be able to spoof your IP which would require to find an adequate ISP [2]

[1] http://www.blackhat.com/presentations/bh-dc-10/Nve_Leonardo/...

[2]https://spoofer.caida.org/summary.php

Post reply on HN