This attack sounds very similar to how the Super Game Boy boot ROM was dumped. https://gbdev.gg8.se/wiki/articles/Gameboy_Bootstrap_ROM
Some things never change.
The hacking of Starlink terminals has begun
21–30 of 267 posts
Re: The hacking of Starlink terminals has begun
#22I see a lot of articles that quote the cost for hacking a product or service. I feel like these type of titles undermine the effort that took place. Surely the lab Wouters used had tools and processes that aren't cheap, nor would you consider his expertise inexpensive. I'm not impressed by a PCB board being cheap. Does anyone else feel this way about similar headlines?
I think the point is that anyone with $25 can hack Starlink once the script or instructions are published online. Information costs almost nothing to publish/ share so it's the cost of the hardware that matters.
"You wouldn't download a satellite uplink would you?"
Uh, yep thats exactly what I want to do :-)
Re: The hacking of Starlink terminals has begun
#23The article compares the Russian jamming of Viasat with the compromise of a Starlink UT. No, no, no... This is really wrong!
> As is typically the case with any technology, the increase in use and deployment of Starlink and other satellite constellations also means that threat actors have a greater interest in finding their security holes to attack them.
> Indeed, Russia saw an advantage in taking out a satellite providing internet communications across Europe by attacking its technology on the ground as Russian troops entered Ukraine on Feb. 24.
Viasat orbits at 22,000 miles, Starlink is in LEO. Precisely for this reason Starlink is naturally more resistant to jamming, and is used in Ukraine because of this.
Locally compromising a UT is a hack of an endpoint connection device, which has nothing to do with ELINT and electronic warfare activities (which is an entirely different kind of attacks for satellite networks).
Re: The hacking of Starlink terminals has begun
#24This reads to me like the (more complicated but ultimately) equivalent of "a user reverse engineers the website's javascript!". As in, this allows the user to mod their client but it doesn't change anything for anyone else, and wasn't meant as a real secure element. I'd assume that getting root access to the user terminal gives them no additional privileges to access the actual Starlink data & control planes.
It might allow them to do things like connect to the Starlink network outside of their geofence. Or hacking a stationary antenna to work on a moving vehicle.
Re: The hacking of Starlink terminals has begun
#25This is quite impressive and congratulation are well deserved.
Now the fun part can start. This work opens a door to the user segment, i can't wait to see what's behind and hope for starlink that their C2 and user segments are well isolated. Let the fuzzing begin.
Re: The hacking of Starlink terminals has begun
#26It shouldn't count as a vulnerability that you can get root of a device that you have physical possession of. If there's any real vulnerability here, it's that having root of your terminal gives you any extra privileges to the rest of the network.
Re: The hacking of Starlink terminals has begun
#27Is there any mitigation against these kinds of power/timing attacks? I think the Switch was originally hacked this way.
No, not without changing microprocessors.
Essentially these chips are locked by setting certain flags in memory. Various flags control various peripherals, including a flag to disable read/write access to the firmware. Obviously once you disable access, it’s permanent because you don’t have access to reenable it.
This side channel attack takes advantage of a flaw in the actual silicon, where branches can be skipped if the power is altered momentarily. So if you skip that first check, the attacker has low level firmware control.
(This was also how the firmware was dumped on the Apple AirTags)
The only mitigation is to use a chip that doesn’t suffer from this flaw or change the software to prevent “root” access even if an adversary has access to the entire firmware (ie do things server side)
Re: The hacking of Starlink terminals has begun
#28The response from Starlink[0] was pretty amazing. I love this quote: "we want to congratulate Lennert Wouters on his security research into the Starlink user terminal – his findings are likely why you're reading this, and help us create the best product possible." A lot better than companies that would try to prosecute him.. [0]: https://api.starlink.com/public-files/StarlinkWelcomesSecuri...
Full of good sense. They do try to control the terminal to do a secure boot:
> We want our devices to only run software that we wrote. This isn't like a personal computer where the user can install apps or save files – the only software we want to run on our devices is software that we've explicitly built, tested, and signed off on.
> The same concepts that go into secure boot on our satellites are also useful on the Starlink user terminals. Even though we know that an attacker with persistent and invasive physical access will eventually be able to defeat secure boot on their own device, the protections of secure boot are still valuable for protecting against remote attacks over the Internet (or over wifi). There is a big difference between being able to take your own device off your roof and attack it, vs. someone else being able to compromise your device without you noticing.
But recognize that it's not foolproof:
> We expect attackers with invasive physical access to be able to take malicious actions on behalf of a single Starlink kit using its identity, so we rely on the design principle of "least privilege" to constrain the effects in the broader system. We treat Starlink user terminals as inherently untrusted and only expose the minimal necessary information and capabilities to each specific client.
The article talks about the researcher "exploring the Starlink network" as if there's a screen on the satellites that will suddenly display "Access Granted" with a blinking cursor now that he's achieved root on his own dish. Getting access to the dish is an important step if the former is to be achieved, but it's by far the easier of the two steps.
Re: The hacking of Starlink terminals has begun
#29Is there any mitigation against these kinds of power/timing attacks? I think the Switch was originally hacked this way.
I don’t think you can eliminate them, just make them harder to exploit. Require multiple glitches to succeed etc.
Agreed, usually if they have hardware access it’s gonna be cracked eventually. Hard to imagine a system that was truly unhackable with infinite unrestricted physical access.
Re: The hacking of Starlink terminals has begun
#30This reads to me like the (more complicated but ultimately) equivalent of "a user reverse engineers the website's javascript!". As in, this allows the user to mod their client but it doesn't change anything for anyone else, and wasn't meant as a real secure element. I'd assume that getting root access to the user terminal gives them no additional privileges to access the actual Starlink data & control planes.
It might allow them to do things like connect to the Starlink network outside of their geofence. Or hacking a stationary antenna to work on a moving vehicle.
> connect to the Starlink network outside of their geofence
I was wondering about that but can't they determine the location "server side" by triangulation? Or maybe they could in theory but they don't in practice?