I don't understand how this works. The article doesn't go into much depth.
They listen on data coming from a satellite for certain IPs, then connect to those IPs directly? How does that allow two-way communication?
How hackers abused satellites to stay under the radar (2015)
41–50 of 69 posts
Re: How hackers abused satellites to stay under the radar (2015)
#42I don't understand how this works. The article doesn't go into much depth. They listen on data coming from a satellite for certain IPs, then connect to those IPs directly? How does that allow two-way communication?
If I understand this correctly:
1. Infected system sends packets to a decoy
2. The decoy ignores the fake packets (dropped by firewall)
3. The real command center which is located in the same region as the decoy accepts the packets [1]
4. Real command center can still send commands to infected system via landline, but receive data by satellite.
[1] Satellite downlink data is sent to a relatively large area.
Re: How hackers abused satellites to stay under the radar (2015)
#43Is this how /pol/ found Shia's flag?
Re: How hackers abused satellites to stay under the radar (2015)
#44Earlier quoted context omitted.
- did you have a cellphone in your pocket? - where did you get the cash? - by talking about it you negated all the advantages you built up - if you walk into a store wearing a facemask you run the risk of being arrested or even shot because they assume you are robbing the store - you may have left fingerprints in the store - the cabdriver has seen your face and knows your home address, you should have walked to the s…
I'm not even GP but I think I can answer a lot of these. Are you maybe trying a little too hard to play devil's advocate? - did you have a cellphone in your pocket? After going through all of this, do you honestly think he forgot that detail? - where did you get the cash? That's a good question. Hopefully he withdrew a different amount of cash on a completely separate date, otherwise bank account and transactions sur…
> I'm not even GP but I think I can answer a lot of these
If you can, then he's failed even more. So no, I don't think that you can answer any of them.
The point I'm trying to make is that the best made plans of men and mice fail due to overlooking some small detail. I could easily make that list 10 times as long. One or more slip ups could allow someone to tie 1-and-1 together to make 3 and it is game over. The funniest part of this whole discussion is that it starts with utterly underestimating the enemy, which is a serious mistake right from getting out of the gate.
If you are going to do something as audacious as going up against a drug cartel you have to keep in mind that these are the kind of groups who would hesitate at absolutely nothing if they feel that you are their enemy. Informants and undercover police and other infiltrators (for instance from rival gangs) are routinely murdered, and their families too if that's how the wind blows.
Before you start on a job like that you begin with laying the groundwork over the course of several years, any step along the way that can give away the game will endanger you and those around you. This is not something you cook up one find winter evening and put in motion without some extremely careful planning and creating multiple levels of cut-outs for any kind of activity that might point at your real identity.
The only thing buying a couple of burner phones with cash is going to do is raise suspicion, it is not going to do much in terms of protecting you.
If the OP would put his plan to go after some drug related criminal organization in motion the most likely outcome of the adventure would be 3 lines on page 12 of a newspaper mentioning a disfigured body found floating in a river or a missing person report.
Life is not a video game, you do not get 3 lives and the same player does not get to try again in case of failure.
If you didn't come from a life of crime or from a life of being in law enforcement then your best strategy is to avoid at all costs to get mixed up in this sort of thing.
Even the Unabomber eventually got caught and he was a lot better at tradecraft than sillysaurus here.
Re: How hackers abused satellites to stay under the radar (2015)
#45I don't understand how this works. The article doesn't go into much depth. They listen on data coming from a satellite for certain IPs, then connect to those IPs directly? How does that allow two-way communication?
If I understand this correctly: 1. Infected system sends packets to a decoy 2. The decoy ignores the fake packets (dropped by firewall) 3. The real command center which is located in the same region as the decoy accepts the packets [1] 4. Real command center can still send commands to infected system via landline, but receive data by satellite. [1] Satellite downlink data is sent to a relatively large area.
[deleted]
Re: How hackers abused satellites to stay under the radar (2015)
#46I don't understand how this works. The article doesn't go into much depth. They listen on data coming from a satellite for certain IPs, then connect to those IPs directly? How does that allow two-way communication?
If I understand this correctly: 1. Infected system sends packets to a decoy 2. The decoy ignores the fake packets (dropped by firewall) 3. The real command center which is located in the same region as the decoy accepts the packets [1] 4. Real command center can still send commands to infected system via landline, but receive data by satellite. [1] Satellite downlink data is sent to a relatively large area.
Infected system sends packets to a decoy what? Satellite? And then the satellite forwards it.
Re: How hackers abused satellites to stay under the radar (2015)
#47Earlier quoted context omitted.
If I understand this correctly: 1. Infected system sends packets to a decoy 2. The decoy ignores the fake packets (dropped by firewall) 3. The real command center which is located in the same region as the decoy accepts the packets [1] 4. Real command center can still send commands to infected system via landline, but receive data by satellite. [1] Satellite downlink data is sent to a relatively large area.
Infected system sends packets to a decoy what? Satellite? And then the satellite forwards it.
Lets say John lives near (200 miles away) the C&C server and that John's IP is 192.168.7.2. John is the decoy, so the malware sends requests to John's IP. John doesn't get the requests, due to his firewall blocking them, leaving these lingering open tcp connections. So the C&C server is free to finish the TCP handshake spoofing their IP to be 192.168.7.2
As far as anyone can tell they are John, but when you go to John's house to shut down the C&C server you end up at a dead end.
Re: How hackers abused satellites to stay under the radar (2015)
#48Earlier quoted context omitted.
Not necessarily. I briefly pretended to be a criminal, mostly for fun. (Most readers will go "Uh huh" at this, but it was just a game.) Say you're developing the next Silk Road. Say you have perfect opsec, and you never reveal any personal info. What are your risks? The #1 risk is discovery of your physical location. Before every action, you must ask yourself: Will the next keystroke get me caught? It takes immense d…
- did you have a cellphone in your pocket? - where did you get the cash? - by talking about it you negated all the advantages you built up - if you walk into a store wearing a facemask you run the risk of being arrested or even shot because they assume you are robbing the store - you may have left fingerprints in the store - the cabdriver has seen your face and knows your home address, you should have walked to the s…
One person entered a dark alley, and then a few minutes later one person with the same build wearing different clothes left...
Re: How hackers abused satellites to stay under the radar (2015)
#49I don't get it. It is impossible to identify who receives the packets but TCP/IP requires an acknowledgement that the packets have been received before sending more packets. Surely the C&C could be tracked from this acknowledgement? Or were they using UDP?
UDP for everything would be workable and would remove the need for any sort of spoofing on the uplink.
That would work for exfiltration, but not for the whole "command and control" part of C&C.
Re: How hackers abused satellites to stay under the radar (2015)
#50What satellite internet provider isn't doing egress filtering on their customers land-line connections?
Asking for a friend...