Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

satcom.sysnet.ucsd.edu

Post reply on HN
Print view View original

61–70 of 145 posts

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#61

Post by vasco »

yujzgzc wrote: post #37
vasco wrote: post #33

Earlier quoted context omitted.

It was only successful because Google said you'd rank higher if you did it.

It was only successful because of Let's Encrypt removing any excuse for not having HTTPS on your website, HSTS becoming a thing, and Chrome moving from gentle inducements (that cute green padlock) to nasty looking warnings if you didn't use encryption.

No, that was after, and it made it easy, but before google many people said there was no point "because their site wasnt sensitive". Those people didn't care about let's encrypt or how easy it was, they just didn't find a reason to do it. Google gave them a monetary reason to do it.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#62

Post by etiennebausson »

JumpCrisscross wrote: post #52
mjevans wrote: post #20

Earlier quoted context omitted.

Why does Space need to decrypt a vast majority of the traffic? Flow can be just as brick not-smart as fiber optic cables under the sea. Now, management, control, etc? Yeah those you need to decode in orbit.

> Flow can be just as brick not-smart as fiber optic cables under the sea Wouldn't this still leak metadata for routing?

It would not be perfect, but it wouldn't be purposefully shooting oneself in the foot.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#63

Post by stavros »

dylan604 wrote: post #15

As with anything in life, when it's what you know and do on the regular, that simple thing can look like magic to others. I met an old timer in the satellite business that came out to help install our receiver for a new TV channel the company I was at was getting off the ground. He found out what bird we were using and what its slot was. Based on that, he knew how many satellites over from the satellite he knew and u…

Eh I kind of feel like you can't say that. If something is magical before you learn how it's done, it should be magical after. The magical part isn't "it's actually impossible", but "it's so far from what I could come up on my own", which still holds after you know the secret.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#64

Post by fransje26 »

astrange wrote: post #22
protocolture wrote: post #7

Had a vendor offer a customer of mine a huge discount if they purchased radios without the encryption license in the year of our lord 2024. Not even WPA or WEP. Just clear across the sky. And this is terrestrial. My bet is that in space there would be a noticable increase in heat/energy if they did encryption by default. But its still incredible to see them pretend like space is impossible to get to, ultimate obscuri…

Encryption is basically free as far as I know, but it is more complex and it must be hard to get software updates up there.

Here is their excuse:

> Panasonic told us that enabling encryption could incur a 20–30% capacity loss. In addition, when using IPsec, ESP and IP headers can introduce 20–30 bytes of overhead, which is nontrivial for small-packet applications like VoIP and video calls

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#65

Post by NoiseBert69 »

zelos wrote: post #53
vayup wrote: post #34

Some of the stuff that was extracted from the unencrypted traffic in the link: - T-Mobile backhaul: Users' SMS, voice call contents and internet traffic content in plain text. - AT&T Mexico cellular backhaul: Raw user internet traffic - TelMex VOIP on satellite backhaul: Plaintext voice calls - U.S. military: SIP traffic exposing ship names - Mexico government and military: Unencrypted intra-government traffic - Walm…

> Real-time military object telemetry with precise geolocation, identifiers, and live telemetry Oops

Pulls out the bamboo whip

Another round of OpSec training

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#66

Post by feraloink »

protocolture wrote: post #7

Had a vendor offer a customer of mine a huge discount if they purchased radios without the encryption license in the year of our lord 2024. Not even WPA or WEP. Just clear across the sky. And this is terrestrial. My bet is that in space there would be a noticable increase in heat/energy if they did encryption by default. But its still incredible to see them pretend like space is impossible to get to, ultimate obscuri…

The landing page has a Q&A. This is the relevant part of the response to the question, "Why aren't all GEO satellite links encrypted?"

>Encryption imposes additional overhead to an already limited bandwidth, decryption hardware may exceed the power budget of remote, off-grid receivers, and satellite terminal vendors can charge additional license fees for enabling link-layer encryption. In addition, encryption makes it harder to troubleshoot network issues and can degrade the reliability of emergency services.

So, the only suggestion that there would be greater heat/energy if they did encryption by default is the part about decryption (receiver) hardware having limited power budgets in some cases. There's more than what I copy-and-pasted above, but the overall message is that lots of organizations haven't wanted to pay the direct costs of enabling encryption... although they should.

EDIT: Link to Q&A https://satcom.sysnet.ucsd.edu/#qanda

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#67

Post by nkrisc »

ozim wrote: post #46
chii wrote: post #12

Earlier quoted context omitted.

> nobody gets fired when there's a breach this must mean the consequences of such a breach has either not produced any visible damage, or the entity being damaged is uncaring (or have no power to care).

If you fire people for stuff they didn’t maliciously introduced you will end up with no people to work with. Imagine jailing doctors for every patient that died you would be out of doctors quite soon.

If the doctor is criminally negligent they could be jailed.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#68

Post by feraloink »

xucheng wrote: post #51
drsopp wrote: post #48

I wonder why the DOI link on the bottom left of the first page does not work: https://doi.org/10.1145/3719027.3765198

It’s quite common for a DOI to be assigned to a paper after it’s accepted during camera ready. However, the DOI won’t work until the conference or journal version is published on the official website (ACM in this case). The version you’re viewing now is simply a preprint directly from the authors.

Exactly! It says this as one of the 3 reasons for DOIs not found on the error page:

>The DOI has not been activated yet.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#69

Post by Arrath »

fennec-posix wrote: post #2

Section 6.3.2 is an eye-opener... good lord... Gets even worse at 6.4.2-3

Am I offtrack in wondering if by reverse engineering the mentioned in-the-clear ATM communications you could (in theory) inject some malicious packets and in effect just dispense cash to yourself with a laptop and a dish? How very cyberpunk.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#70

Post by feraloink »

vayup wrote: post #34

Some of the stuff that was extracted from the unencrypted traffic in the link: - T-Mobile backhaul: Users' SMS, voice call contents and internet traffic content in plain text. - AT&T Mexico cellular backhaul: Raw user internet traffic - TelMex VOIP on satellite backhaul: Plaintext voice calls - U.S. military: SIP traffic exposing ship names - Mexico government and military: Unencrypted intra-government traffic - Walm…

In https://satcom.sysnet.ucsd.edu/ Has The Issue Been Fixed section:

>we re-scanned with their permission and were able to verify a remedy had been deployed: T-Mobile, WalMart, and KPU.

The fact that critical infrastructure (e.g. utility companies using satellite links for remote-operated SCADA) was exposed is really scary too.

Post reply on HN