Live data from Hacker News

Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

satcom.sysnet.ucsd.edu

21–30 of 145 posts

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#21

Had a vendor offer a customer of mine a huge discount if they purchased radios without the encryption license in the year of our lord 2024. Not even WPA or WEP. Just clear across the sky. And this is terrestrial. My bet is that in space there would be a noticable increase in heat/energy if they did encryption by default. But its still incredible to see them pretend like space is impossible to get to, ultimate obscuri…

The encryption of the payload doesn't need to take place on the satellites

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#22

Had a vendor offer a customer of mine a huge discount if they purchased radios without the encryption license in the year of our lord 2024. Not even WPA or WEP. Just clear across the sky. And this is terrestrial. My bet is that in space there would be a noticable increase in heat/energy if they did encryption by default. But its still incredible to see them pretend like space is impossible to get to, ultimate obscuri…

Encryption is basically free as far as I know, but it is more complex and it must be hard to get software updates up there.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#23
post #14
post #12

Earlier quoted context omitted.

> nobody gets fired when there's a breach this must mean the consequences of such a breach has either not produced any visible damage, or the entity being damaged is uncaring (or have no power to care).

End user license agreements are a huge part of the problem. Ideally users could sue if our data is leaked - and the threat of being sued would put pressure on companies to take security more seriously. Ie, it would become a business concern. Instead we're constantly asked to sign one-sided contracts ("EULAs") which forbid us from suing. If a company's incompetence results in my data being leaked on the internet, ther…

There is in at least California, the EU, and China. A lot of clauses in EULAs aren't actually legal.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#24
I was working in space industry and ECSS security guidelines are missleading grant seeking startups to try to reinvent TLS on orbit. There are to mamy bureaucracy. ECSS guidelines for software teams were created by people who never written a Hello World in their life, just look at specs of ECSS Packet Utilisation Service, it's a joke, that's why I prefer to work for VC funded companies than grant funded.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#25

Section 6.3.2 is an eye-opener... good lord... Gets even worse at 6.4.2-3

It's absolutely jaw-dropping. Either no-one at these companies was capable of understanding the problem, or no-one cared enough to do something about it.

Likely both.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#26

Had a vendor offer a customer of mine a huge discount if they purchased radios without the encryption license in the year of our lord 2024. Not even WPA or WEP. Just clear across the sky. And this is terrestrial. My bet is that in space there would be a noticable increase in heat/energy if they did encryption by default. But its still incredible to see them pretend like space is impossible to get to, ultimate obscuri…

The encryption of the payload doesn't need to take place on the satellites

Thats very true.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#28
post #12

Earlier quoted context omitted.

Likely no consequences to the decision-makers for data exfiltration or other shenanigans happening, so there's nothing motivating a behavior change. The reason security is so bad everywhere is that nobody gets fired when there's a breach. It's just blamed on the hackers and everyone just goes on with life singing "We take security very seriously--this happened because of someone else!"

> nobody gets fired when there's a breach this must mean the consequences of such a breach has either not produced any visible damage, or the entity being damaged is uncaring (or have no power to care).

>this must mean the consequences of such a breach has either not produced any visible damage

Yeah lets say you were carrying unencrypted frames for Bills Burger Hut.

The largest extent of the damage might be sniffing some smtp credentials or something. Bill sends some spam messages, never figures out how it was done but their IP reputation is always in the toilet.

Lets then say instead of Bills Burger Hut, you are carrying traffic for critical mineral and food industries. The attacker isnt a scammer, but a hostile nation state. Customer never realises, but theres a large, long term financial cost because (TOTALLY NOT CHINA) is sharing this data with competitors of yours overseas, or preparing to drop your pants in a huge way for foreign policy reasons.

No one gets fired until after the worst case long term damage, and even then probably not.

In fact, the likely outcome is that the burden gets moved to the customer for L2 encryption and the cowboy never changes.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#29

Had a vendor offer a customer of mine a huge discount if they purchased radios without the encryption license in the year of our lord 2024. Not even WPA or WEP. Just clear across the sky. And this is terrestrial. My bet is that in space there would be a noticable increase in heat/energy if they did encryption by default. But its still incredible to see them pretend like space is impossible to get to, ultimate obscuri…

Encryption is basically free as far as I know, but it is more complex and it must be hard to get software updates up there.

It is almost free on modern CPUs that have hardware acceleration, yea

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#30

Had a vendor offer a customer of mine a huge discount if they purchased radios without the encryption license in the year of our lord 2024. Not even WPA or WEP. Just clear across the sky. And this is terrestrial. My bet is that in space there would be a noticable increase in heat/energy if they did encryption by default. But its still incredible to see them pretend like space is impossible to get to, ultimate obscuri…

> My bet is that in space there would be a noticable increase in heat/energy if they did encryption by default.

Why would it? The data originates from earth, and should be encrypted during the uplink leg too, so the crypto should all happen in the ground segment (or even well before it reached anything that could be considered part of the satellite setup, honestly).

Post reply on HN