Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SATCOM terminals under attack in Europe: a plausible analysis

reversemode.com

Post reply on HN
Print view View original

71–79 of 79 posts

Re: SATCOM terminals under attack in Europe: a plausible analysis

#71

Post by CrazyStat »

teknopaul wrote: post #70
CrazyStat wrote: post #2

Elon Musk mentioned this attack in one of his tweets a few days ago: https://twitter.com/elonmusk/status/1499585449450344451

Replying to @elonmusk Is there anything to stop it on starlink? Musk replies "game on". The russians have recently demonstrated their ability to physically take out satelites, and willingness to use it. If Putin did that, creating a lot of debris, US would loose the space advantage and we would push human advancement in to space back by perhaps 1000 years while we wait for the skys to clear. US MUST stop provoking Ru…

Appeasing murderous dictators is also a good way to set back human advancement, on the ground and in space. Giving in just because your opponent might do something stupid is equally bad diplomacy.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#72

Post by motohagiography »

mschuster91 wrote: post #57
motohagiography wrote: post #49

Earlier quoted context omitted.

> (and the impossibility to obtain said equipment for the average Joe). when I worked on similar problems some years ago, we found out that certain radios were used across sectors with basically the same ucLinux kernels and toolchains, bootloaders, and SoCs. I agree with the "internal VLAN" assessment to a point, as these networks tend to backhaul their admin channel / control plane messaging back to their vendor. Th…

> With this (speculative) radio packet of death, you could fly a spyplane over the region at super sonic speeds That could work in Ukraine, but a spy plane above Germany would have made national news.

Fair assessment. I assumed spyplane because it also affected Italy and Greece, so there was a long arc of a flight path. It's possible it could have been the orbit of a russian electronic warfare satellite as well, as if you have a transmitter on it, encoding radio packets of death against poorly maintained linux kernel forks (hugely assuming that's what the terminals ran) is as trivial as loading a metasploit payload. I'm well into speculative fiction, but casting magic spells that stop machinery en masse isn't magic at all - and well within the capabilities of armchair admirals of electronic warfare who read and post on HN.

It would be interesting to see if there was any timestamp data about the order in which the terminals failed, as that would yield the flight path evidence, or indicate the presence of local transmitters in those regions, or if it were async, an internet based attack.

Reality is, the gear that runs critical infrastructure is still a joke, and I've said before that western exposure to cyber vulnerability will cause the US/NATO to hesitate in responding to Russian and Chinese aggression because they have to take on that domestic political risk of infrastructure failure, and in conflict, often hesitation is sufficient. Weakness invites predators, and here we are.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#73

Post by stephen_g »

NotAWorkNick wrote: post #6
AdamJacobMuller wrote: post #3

Seems entirely plausible to me that someone pushed a firmware update which corrupted the firmware (even maybe at the fpga/bootcode level) and effectively bricked the devices. Not horribly complicated to do and once you've done it it would require physical access to recover each device individually. Is there a plausible explanation for who would do this, besides Russia? Is Viasat/Eutelsat a particularly good target fo…

Dumb Question here but my thoughts were - why not push the corrupted update to the sats? AKA hack the sat firmware? I'm fairly certain that they aren't wide open doors but still - I would guess that it would be a lot easier doing it that way. Perhaps it was both, or someting else entirely. It will make for an interesting read one day.

The satellite command and control is probably the one bit of the network that's actually hardened (possibly even air-gapped), completely proprietary, etc. - that bit is designed by the companies that make $200 million satellites, not the people who make fairly cheap modems and have different priorities.

The current generation of satellites themselves generally do nothing to the data stream - for each of the dozens of spot beams they're transmitting, they generally just take an RF signal from the ground station (multiplexed in various ways up to the satellite) and convert the frequency. Same with the receive path just in reverse.

The actual modulation/demodulation all happens at the ground station. This is because they expect modem technology will improve, but the satellite has to be able to work for 25-30 years. (Though in the industry they are talking about putting more and more 'software defined' functionality on the satellites, but again this will mostly have to go via their secure systems at the ground station, not from the terminals)

So there's basically no way to interact with any 'satellite firmware' unless you're in a very specific location (near their ground station) with extremely specialised gear.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#74

Post by stephen_g »

Can confirm that this kind of software is terrible. I've worked in SATCOM for years, we've deployed modems to military that have hardcoded passwords for web UI and SSH that you can google on the internet... Obviously some effort goes into firewalling all that off very carefully, and then often separate VPN over the top (hardware crypto, etc.), but the modems themselves are appalling. The SSH host keys also change when you do a firmware upgrade which makes me think that might be hardcoded and just changed in each version, not generated for each device... I haven't checked though.

Unfortunately that was the modem that the satellite operator required us to use, there was no other option!

Re: SATCOM terminals under attack in Europe: a plausible analysis

#75

Post by Nextgrid »

teknopaul wrote: post #69
londons_explore wrote: post #28

Earlier quoted context omitted.

> Is there a plausible explanation for who would do this, besides Russia? Any engineer could accidentally do it... I can totally imagine the release engineer accidentally pushing the dev version, only to realise later that the dev version doesn't have quite the right config to connect for example. Blaming it on a cyber attack is a lot less bad than saying "whoops, we bricked everyone's modems".

Release engineer would own up to it. There would be a trail, with no attempt to hide it.

There's still the incentive to cover it up externally and blame it on a cyberattack as opposed to poor internal processes that allowed such a bug to make it to production.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#76

Post by chimpansteve »

sbierwagen wrote: post #58

Simultaneously, Russian ground forces have had a hell of a time using their encrypted radios, resulting in the logistical and tactical omnishambles observed by many, and fallback transmitting in the clear using civilian ham radios or cell phones. Some have attributed this to difficulty in distributing encryption keys to forward units or just general incompetence, but one fun theory I saw on twitter is that Russia use…

This is an eye opening thread, to say the least https://twitter.com/christogrozev/status/1500959074653024259

Re: SATCOM terminals under attack in Europe: a plausible analysis

#77

Post by MomoXenosaga »

AdamJacobMuller wrote: post #56
toxik wrote: post #9

Earlier quoted context omitted.

Sure, but can you prove it to the public in enough certainty to declare war? No. Suppose it was Russian flag, they could very easily just claim they were framed - and they very likely could’ve been.

I was with you until you said prove it "to the public" After the WMDs and 17 intelligence agencies agree fiascos, among countless others, I'm beginning to lean on the side of the media being able to sell snow to an eskimo. I know this is US-centric and lots of europe/other parts of the world were much more skeptical of the WMD claims at the time. Before people politically flame me, I mention the "17 intelligence agen…

Nobody likes Russians. This would quite frankly be the easiest sell in history. Evil bad guys? Check. Innocent civilians? Check. Fighting far away from your own vulnerable infrastructure? Check.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#78

Post by FDSGSG »

oceanplexian wrote: post #62
Nextgrid wrote: post #5

I've investigated network equipment before, my findings were that you shouldn't trust any of it and use a standard Linux box whenever possible. The worst was consumer-grade modems/routers with low-hanging fruits such as backdoors, "forgotten" telnet servers left enabled, shell command injection in the web UI, etc but even enterprise stuff had its problems (thankfully, at least on enterprise stuff you can disable the…

From personal experience (I guess now that the statue of limitations has passed..) I was part of a large community of people in the not so distant past hacking into cable ISPs. Small ones were easy to bypass security mechanisms and spoof other customers devices or simply trick their servers into issuing valid configs, but obviously there was the one big one that I’m sure everyone has heard of. Anyway, before the comm…

Well yeah, kids on IRC (or xbox live) have been hacking big ISPs like comcast and verizon to dox each other since forever.

Re: SATCOM terminals under attack in Europe: a plausible analysis

#79

Post by BartekVSAT »

If someone have access to bricked modem and can ship it for analysis we can try to collect evidence what happen and how modem was bricked - who knows, may be log partition wasn't overwritten or other artefacts are left (significant events like update are permanently logged). As side effect, recovery instruction can be created.

Best contact point is via https://www.satsig.net/cgi-bin/yabb/YaBB.pl?num=1646161484

Post reply on HN