Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SATCOM terminals under attack in Europe: a plausible analysis

reversemode.com

Post reply on HN
Print view View original

21–30 of 79 posts

Re: SATCOM terminals under attack in Europe: a plausible analysis

#21

Post by lxgr »

blackboxlogic wrote: post #8
lxgr wrote: post #4

Earlier quoted context omitted.

KA-SAT seems to be used for SCADA control of 11 Gigawatt worth of wind turbines in Germany, among other things [1]. Not sure at all if this was the intended/primary target, but Europe is certainly scrambling for every Watt at the moment... Also note that KA-SAT/Viasat and Eutelsat seem to be different platforms. I've seen reports of services based on the former being affected (e.g. SkyDSL [2]), but not the latter (Ko…

From your first link: "The [turbines] affected remain in operation and are producing clean renewable energy. ... they will operate in automatic mode and are fundamentally capable of self-contained and independent regulation."

Sure, I'd hope for a heavily decentralized system to have some capability of autonomous operation. But in the medium and long term, it can't be good to not be able to remotely monitor for failures requiring manual intervention or on-site mechanical servicing.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#22

Post by JumpCrisscross »

krisoft wrote: post #14
toxik wrote: post #9

Earlier quoted context omitted.

Sure, but can you prove it to the public in enough certainty to declare war? No. Suppose it was Russian flag, they could very easily just claim they were framed - and they very likely could’ve been.

> Sure, but can you prove it to the public in enough certainty to declare war? This is not a court of law, proof is not what is missing to declare a war against Russia. They have a credible nuclear deterent, that is why war is not declared against them by other countries. It is in fact a very sweet idea to think that a war declaration depends on meeting or not meeting some evidentiary standard.

> have a credible nuclear deterent, that is why war is not declared against them by other countries

Nobody “declares” wars anymore. If Russia were believed to be responsible for this, it would make it politically feasible to attack their critical infrastructure through targeted (plausibly deniable) cyber attacks.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#23

Post by okl »

lxgr wrote: post #20
myself248 wrote: post #16

Earlier quoted context omitted.

It's easy to buy an end-user terminal and tear it apart on your workbench to develop an understanding of how it works. I don't know about you, but I haven't seen any satellites on eBay recently. Also, most satellites are intentionally as dumb as possible, just a "bent pipe" transponder, putting all the complexity on the ground stations which are easier to service if something goes wrong. There might not be much to do…

With the right commands, you could flip the satellite by 180 degrees, move it from Europe to the pacific ocean, or crash it into one of its neighbors. All geostationary satellites need to be capable of at least some station-keeping to correct for drift, move them to other service areas, or move them to a graveyard orbit at their end of life. (Unlike LEO, GEO satellites don't carry enough fuel for de-orbiting, and fri…

> That layer of commands is hopefully very well protected.

Typically some form of HMAC authentication. You can read about it in the CCSDS Blue Book.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#24

Post by toxik »

krisoft wrote: post #14
toxik wrote: post #9

Earlier quoted context omitted.

Sure, but can you prove it to the public in enough certainty to declare war? No. Suppose it was Russian flag, they could very easily just claim they were framed - and they very likely could’ve been.

> Sure, but can you prove it to the public in enough certainty to declare war? This is not a court of law, proof is not what is missing to declare a war against Russia. They have a credible nuclear deterent, that is why war is not declared against them by other countries. It is in fact a very sweet idea to think that a war declaration depends on meeting or not meeting some evidentiary standard.

You misunderstood, or simply ignored the word “public”. In free press societies, you need the will of the people to go to war. You need a 9/11 moment. A casus belli.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#26

Post by CoastalCoder »

nonomaybeyes wrote: post #17
CoastalCoder wrote: post #10

Can someone versed in military doctrine / strategy talk about dealing with the uncertainty of a false-flag attack? Does the best-known approach just boil down to weighing the cost/benefit of (acting | not acting) x P(most likely aggressor | some other cause)? Or has someone figured out a better approach?

The purpose of a false flag is to drive a certain narrative, so it's always accompanied by incessant media coverage. That is not the case here, the attack is likely for genuine tactical purposes.

> That is not the case here

Are you sure that false-flag attacks always involve a media blitz?

Just thinking that if I were planning a false flag, and I know that people would recognize it as such because of the media blitz, then I'd look for a workaround. That seems consistent with what we have here.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#27

Post by agnokapathetic »

AdamJacobMuller wrote: post #3

Seems entirely plausible to me that someone pushed a firmware update which corrupted the firmware (even maybe at the fpga/bootcode level) and effectively bricked the devices. Not horribly complicated to do and once you've done it it would require physical access to recover each device individually. Is there a plausible explanation for who would do this, besides Russia? Is Viasat/Eutelsat a particularly good target fo…

Viasat KA-SAT was used by Ukraine for some Military and Government communications.

The US, perhaps acting on intelligence preceding the Viasat attack, provided Zelenskywith an Iridium 9575A.

https://www.cnn.com/europe/live-news/ukraine-russia-putin-ne...

Re: SATCOM terminals under attack in Europe: a plausible analysis

#28

Post by londons_explore »

AdamJacobMuller wrote: post #3

Seems entirely plausible to me that someone pushed a firmware update which corrupted the firmware (even maybe at the fpga/bootcode level) and effectively bricked the devices. Not horribly complicated to do and once you've done it it would require physical access to recover each device individually. Is there a plausible explanation for who would do this, besides Russia? Is Viasat/Eutelsat a particularly good target fo…

> Is there a plausible explanation for who would do this, besides Russia?

Any engineer could accidentally do it... I can totally imagine the release engineer accidentally pushing the dev version, only to realise later that the dev version doesn't have quite the right config to connect for example.

Blaming it on a cyber attack is a lot less bad than saying "whoops, we bricked everyone's modems".

Re: SATCOM terminals under attack in Europe: a plausible analysis

#29

Post by londons_explore »

lxgr wrote: post #21
blackboxlogic wrote: post #8

Earlier quoted context omitted.

From your first link: "The [turbines] affected remain in operation and are producing clean renewable energy. ... they will operate in automatic mode and are fundamentally capable of self-contained and independent regulation."

Sure, I'd hope for a heavily decentralized system to have some capability of autonomous operation. But in the medium and long term, it can't be good to not be able to remotely monitor for failures requiring manual intervention or on-site mechanical servicing.

Having to visit every turbine to replace a satellite modem doesn't sound like a super large challenge at nation-state scale.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#30

Post by numbsafari »

CoastalCoder wrote: post #26
nonomaybeyes wrote: post #17

Earlier quoted context omitted.

The purpose of a false flag is to drive a certain narrative, so it's always accompanied by incessant media coverage. That is not the case here, the attack is likely for genuine tactical purposes.

> That is not the case here Are you sure that false-flag attacks always involve a media blitz? Just thinking that if I were planning a false flag, and I know that people would recognize it as such because of the media blitz, then I'd look for a workaround. That seems consistent with what we have here.

What’s the point of a false flag if nobody knows about it?

See GP… the point of a false flag is to drive a narrative. Otherwise you are just damaging yourself for no reason.

Post reply on HN