Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SATCOM terminals under attack in Europe: a plausible analysis

reversemode.com

Post reply on HN
Print view View original

41–50 of 79 posts

Re: SATCOM terminals under attack in Europe: a plausible analysis

#41

Post by Scoundreller »

Well, if my paytv CPE experience means anything here…

One brand of electronic countermeasure would cause a firmware write that wouldn’t allow the receiver to boot because you’re a lazy hacker that didn’t lock the flash chip at the hardware WE pin level.

There were a couple of strategies to resolve:

1) remove chip and re-program (not fun on TSOPs)

2) JTAG reprogram (easy and cheap when computers had parallel ports: just some wires and a DB25 connector and the port can bit bang everything)

3) the device does a Power on self test. If it detects a corrupted flash file, it will grab a fresh and clean one from the satellite stream and overwrite your nasty one. You can trigger this by shorting/grounding the right address lines on the flash chip at the right time in the self-test. It won’t pass checksum validation and will think a corrupted update occurred and rewrite it.

That was all for the parallel flash chip (a 28 or 29f series I think).

If it was a serial flash chip like a 24 series, that would be even easier to deal with.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#42

Post by radicaldreamer »

toxik wrote: post #9
adrr wrote: post #7

Earlier quoted context omitted.

Taking a country's infrastructure through a cyberattack is considered an act of war. Same as if you bombed the power generation infrastructure.

Sure, but can you prove it to the public in enough certainty to declare war? No. Suppose it was Russian flag, they could very easily just claim they were framed - and they very likely could’ve been.

Nobody wants to get nuked over a cyberattack.

Even if attribution was possible and confirmed, nobody wants to start a nuclear war over a cyberattack.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#43

Post by KennyBlanken »

mistrial9 wrote: post #37
Nextgrid wrote: post #5

I've investigated network equipment before, my findings were that you shouldn't trust any of it and use a standard Linux box whenever possible. The worst was consumer-grade modems/routers with low-hanging fruits such as backdoors, "forgotten" telnet servers left enabled, shell command injection in the web UI, etc but even enterprise stuff had its problems (thankfully, at least on enterprise stuff you can disable the…

> "Cyberattack on satellite network" sounds so serious yes agree -- third hand witness to actual ground station management of Small SATs here.. even internal engineers are locked out; multiple keys required to perform actions; closely monitored change-of-behavior networks, etc etc beware of REALLY LARGE CLAIMS at this time -- peace out

A satellite data system used by the Ukrainian military was knocked out at the same time as the invasion, the outage started in Ukraine before spreading outward, and the damage is permanent - which would not happen in a botched firmware upgrade, where units would load a backup firmware image or get an image OTA, or be fixable via site visit.

Not exactly a 'really large claim' that this was an attack.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#44

Post by dylan604 »

toxik wrote: post #24
krisoft wrote: post #14

Earlier quoted context omitted.

> Sure, but can you prove it to the public in enough certainty to declare war? This is not a court of law, proof is not what is missing to declare a war against Russia. They have a credible nuclear deterent, that is why war is not declared against them by other countries. It is in fact a very sweet idea to think that a war declaration depends on meeting or not meeting some evidentiary standard.

You misunderstood, or simply ignored the word “public”. In free press societies, you need the will of the people to go to war. You need a 9/11 moment. A casus belli.

Like all of the evidence presented for WMDs in Iraq?

Re: SATCOM terminals under attack in Europe: a plausible analysis

#45

Post by dylan604 »

londons_explore wrote: post #28
AdamJacobMuller wrote: post #3

Seems entirely plausible to me that someone pushed a firmware update which corrupted the firmware (even maybe at the fpga/bootcode level) and effectively bricked the devices. Not horribly complicated to do and once you've done it it would require physical access to recover each device individually. Is there a plausible explanation for who would do this, besides Russia? Is Viasat/Eutelsat a particularly good target fo…

> Is there a plausible explanation for who would do this, besides Russia? Any engineer could accidentally do it... I can totally imagine the release engineer accidentally pushing the dev version, only to realise later that the dev version doesn't have quite the right config to connect for example. Blaming it on a cyber attack is a lot less bad than saying "whoops, we bricked everyone's modems".

Except for when tensions are this high where that blame could be a lot less casual than other times.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#46

Post by Terry_Roll »

adrr wrote: post #7
lxgr wrote: post #4

Earlier quoted context omitted.

KA-SAT seems to be used for SCADA control of 11 Gigawatt worth of wind turbines in Germany, among other things [1]. Not sure at all if this was the intended/primary target, but Europe is certainly scrambling for every Watt at the moment... Also note that KA-SAT/Viasat and Eutelsat seem to be different platforms. I've seen reports of services based on the former being affected (e.g. SkyDSL [2]), but not the latter (Ko…

Taking a country's infrastructure through a cyberattack is considered an act of war. Same as if you bombed the power generation infrastructure.

Depends on who wrote the rules and who wins. Its not like NATO/5eyes hasnt been going on about cyber warfare threats for at least 15-20years now, at least I've been aware of it for 17years.

I learnt during the Falkland conflict when the General Belgrano was sunk, some countries like the UK will ignore rules when it threatens them. https://en.wikipedia.org/wiki/ARA_General_Belgrano#Later_pol...

Churchill is another UK leader who chose to ignore rules or international agreements and I'm well aware criminals dont care about rules either.

This is just the Fog of War that is not a War.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#47

Post by midasuni »

dylan604 wrote: post #44
toxik wrote: post #24

Earlier quoted context omitted.

You misunderstood, or simply ignored the word “public”. In free press societies, you need the will of the people to go to war. You need a 9/11 moment. A casus belli.

Like all of the evidence presented for WMDs in Iraq?

Yes. Although it wasn’t really needed. Many in the US thought Hussein was responsible for 9/11.

If a democratic country wants to go to war it needs a reason that’s beloved by a large number of people.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#48

Post by avianlyric »

KennyBlanken wrote: post #43
mistrial9 wrote: post #37

Earlier quoted context omitted.

> "Cyberattack on satellite network" sounds so serious yes agree -- third hand witness to actual ground station management of Small SATs here.. even internal engineers are locked out; multiple keys required to perform actions; closely monitored change-of-behavior networks, etc etc beware of REALLY LARGE CLAIMS at this time -- peace out

A satellite data system used by the Ukrainian military was knocked out at the same time as the invasion, the outage started in Ukraine before spreading outward, and the damage is permanent - which would not happen in a botched firmware upgrade, where units would load a backup firmware image or get an image OTA, or be fixable via site visit. Not exactly a 'really large claim' that this was an attack.

I think GP is saying that an attack that impacted the satellites flying around in space is a large claim, on account of their systems have better security. I imagine the idea of a many millions of $ satellite burning up because someone left a telnet server open is enough to make executives take sat security a little more seriously than say terminal security.

Don’t think anyone is really refuting the idea that satellite terminals being remotely bricked en-mass, just as two countries nearby go to war, is an attack.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#49

Post by motohagiography »

Nextgrid wrote: post #5

I've investigated network equipment before, my findings were that you shouldn't trust any of it and use a standard Linux box whenever possible. The worst was consumer-grade modems/routers with low-hanging fruits such as backdoors, "forgotten" telnet servers left enabled, shell command injection in the web UI, etc but even enterprise stuff had its problems (thankfully, at least on enterprise stuff you can disable the…

> (and the impossibility to obtain said equipment for the average Joe).

when I worked on similar problems some years ago, we found out that certain radios were used across sectors with basically the same ucLinux kernels and toolchains, bootloaders, and SoCs. I agree with the "internal VLAN" assessment to a point, as these networks tend to backhaul their admin channel / control plane messaging back to their vendor.

The hardcoded credentials issue was the easiest win, where the firmware signing was actually not bad, but injecting packets over the point to point radio connections depended on whether both encryption was enabled, and some primitives implementation issues that I have no doubt any serious cyber operations group would have also found.

With this (speculative) radio packet of death, you could fly a spyplane over the region at super sonic speeds and cause the terminals to go dark - which would explain the relatively simultaneous / sequential failures and the physical path of the outages, which would be detectable in the monitoring data.

Strategically, it's the perfect signal and warning to any country looking to interfere, and it doesn't cost very much. Maybe it's nothing, but with Russia it's never nothing.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#50

Post by Nextgrid »

KennyBlanken wrote: post #43
mistrial9 wrote: post #37

Earlier quoted context omitted.

> "Cyberattack on satellite network" sounds so serious yes agree -- third hand witness to actual ground station management of Small SATs here.. even internal engineers are locked out; multiple keys required to perform actions; closely monitored change-of-behavior networks, etc etc beware of REALLY LARGE CLAIMS at this time -- peace out

A satellite data system used by the Ukrainian military was knocked out at the same time as the invasion, the outage started in Ukraine before spreading outward, and the damage is permanent - which would not happen in a botched firmware upgrade, where units would load a backup firmware image or get an image OTA, or be fixable via site visit. Not exactly a 'really large claim' that this was an attack.

I'm very skeptical of the "damage is permanent" claim. I wouldn't be surprised if it's used to hype up the event even more just like the hype around the fact that this is satellite terminals being hacked even though I believe the attack is very boring and would equally apply to any terrestrial-based ISP whose management network is compromised.

I would bet good money that what they claim "permanent damage" is just misconfiguration that prevents the terminal from connecting to the network but can be recovered via an on-site visit, and hyping up the entire event also works in the company's favour as an ass-covering technique as I suspect the actual vulnerability is very simple & boring (which would be very bad if it were go to public that they have such bad security).

Post reply on HN