Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf] • Hacker News Board

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#131

Post by fmobus » Tue, Oct 14, 2025, 11:16 PM UTC

RajT88 wrote: post #116

vayup wrote: post #34

Some of the stuff that was extracted from the unencrypted traffic in the link: - T-Mobile backhaul: Users' SMS, voice call contents and internet traffic content in plain text. - AT&T Mexico cellular backhaul: Raw user internet traffic - TelMex VOIP on satellite backhaul: Plaintext voice calls - U.S. military: SIP traffic exposing ship names - Mexico government and military: Unencrypted intra-government traffic - Walm…

I'm waiting for IT departments worldwide to wake up to the threat that your browsers are leaking all of your URI's by default back to the manufacturers. URI's leak company secrets. I'm sure there's some people at Google using Edge which are leaking company data to Microsoft. I'm sure there's some people at Microsoft using Chrome which are leaking data to Google. Edge and Chrome both send back every URI you visit to "…

For that to be in anyway useful for those companies (as a means to spy on their competitors), they'd have to be actively looking into the information to derive intelligence. Not really practical without some serious engineering, which would leave tons of evidence. It's not worth it. That's just not how these companies operate.

> there's some people at Google using Edge

I'd be surprised if it's more than a handful of people with explicit exceptions for work-related tasks. Chrome is the norm.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#132

Post by RajT88 » Wed, Oct 15, 2025, 1:38 AM UTC

fmobus wrote: post #131

RajT88 wrote: post #116

Earlier quoted context omitted.

I'm waiting for IT departments worldwide to wake up to the threat that your browsers are leaking all of your URI's by default back to the manufacturers. URI's leak company secrets. I'm sure there's some people at Google using Edge which are leaking company data to Microsoft. I'm sure there's some people at Microsoft using Chrome which are leaking data to Google. Edge and Chrome both send back every URI you visit to "…

For that to be in anyway useful for those companies (as a means to spy on their competitors), they'd have to be actively looking into the information to derive intelligence. Not really practical without some serious engineering, which would leave tons of evidence. It's not worth it. That's just not how these companies operate. > there's some people at Google using Edge I'd be surprised if it's more than a handful of…

I mean, realistically, yes. But you'd be surprised sometimes pretty technical folks who just use whatever is installed when their work machine for whatever reason runs Windows.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#133

Post by abustamam » Wed, Oct 15, 2025, 1:38 AM UTC

lxgr wrote: post #74

stavros wrote: post #63

Earlier quoted context omitted.

Eh I kind of feel like you can't say that. If something is magical before you learn how it's done, it should be magical after. The magical part isn't "it's actually impossible", but "it's so far from what I could come up on my own", which still holds after you know the secret.

Yes, some excellent magic tricks work even better when you know how they work, especially if they’re the kind that’s based on putting in ridiculous amounts of work or skill/practice. Penn and Teller play a lot with that idea, for example.

I think I respect Penn and Teller as magicians more since they reveal how some of their tricks work, and yeah the sheer amount of skill required is for some of their tricks is impressive.

I also liked watching The Masked Magician share some behind the scenes of tricks, and even knowing how it's done doesn't make the trick any less impressive.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#134

Post by RajT88 » Wed, Oct 15, 2025, 4:50 AM UTC

fmobus wrote: post #131

RajT88 wrote: post #116

Earlier quoted context omitted.

I'm waiting for IT departments worldwide to wake up to the threat that your browsers are leaking all of your URI's by default back to the manufacturers. URI's leak company secrets. I'm sure there's some people at Google using Edge which are leaking company data to Microsoft. I'm sure there's some people at Microsoft using Chrome which are leaking data to Google. Edge and Chrome both send back every URI you visit to "…

For that to be in anyway useful for those companies (as a means to spy on their competitors), they'd have to be actively looking into the information to derive intelligence. Not really practical without some serious engineering, which would leave tons of evidence. It's not worth it. That's just not how these companies operate. > there's some people at Google using Edge I'd be surprised if it's more than a handful of…

> For that to be in anyway useful for those companies (as a means to spy on their competitors), they'd have to be actively looking into the information to derive intelligence. Not really practical without some serious engineering, which would leave tons of evidence. It's not worth it. That's just not how these companies operate.

Was thinking about this as well. What evidence would it realistically leave? I mean - they are sending the uri's by default so no client side reverse engineering is needed. They say plainly they are doing this.

Yes, it's a lot of traffic.

IP spaces are well known. Easy to filter for corporate traffic. From there, it's a smorgasbord of internal URI's to dig through - anything with no domain name, or host.(companyname).com traffic. Also easy.

Maybe this ends up in a big data lake queryable by certain groups, but not anyone likely to spill the beans. NDA covers you there. This is not New York Times level corporate subterfuge. It's almost certainly not legal - and this is the important thing - the regulators haven't had the gumption to prosecute anti-competitive behavior in earnest since the 70's or earlier. What Microsoft went through in the 90's in retrospect was antitrust litigation with kid gloves on.

This armchair analyst sees no downside to such practices. Risk, but so little it doesn't matter.

Sure, insiders could spill the beans and violate their NDA's, but who the fuck is going to do more than levy a slap on the wrist for something too difficult to explain to Congress in a way that gets them to care?

Now, I think if you actually put your hands on the browsing history of congressmen harvested in this way, and put it into the public domain, you're going to get a bunch of regulators to all of a sudden care about antitrust enforcement again.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#135

Post by fmobus » Wed, Oct 15, 2025, 10:28 AM UTC

RajT88 wrote: post #134

fmobus wrote: post #131

Earlier quoted context omitted.

For that to be in anyway useful for those companies (as a means to spy on their competitors), they'd have to be actively looking into the information to derive intelligence. Not really practical without some serious engineering, which would leave tons of evidence. It's not worth it. That's just not how these companies operate. > there's some people at Google using Edge I'd be surprised if it's more than a handful of…

> For that to be in anyway useful for those companies (as a means to spy on their competitors), they'd have to be actively looking into the information to derive intelligence. Not really practical without some serious engineering, which would leave tons of evidence. It's not worth it. That's just not how these companies operate. Was thinking about this as well. What evidence would it realistically leave? I mean - the…

You're putting too much faith in NDAs. All it takes is one disgruntled employee with a sense of ethics.

Also, evidence doesn't have to be externally visible. In a lawsuit discovery will dig through design docs, server logs, emails, chats, everything.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#136

Post by alterom » Wed, Oct 15, 2025, 2:07 PM UTC

OnACoffeeBreak wrote: post #80

From the Introduction: "Each satellite may carry traffic for dozens of independent networks through an array of on-board transponders, each covering a diameter of thousands of kilometers (at most a third of Earth’s surface)". Can someone help me understand the use of "diameter" in this sentence. I am guessing it refers to the satellite's signal coverage of the Earth's surface. If that's the case, wouldn't something l…

Yeah, diameter is ambiguous (is it the diameter of the disk in space, or in the geometry/topology of the Earth's surface?).

Either way, they point is, it's a lot of coverage.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#137

Post by estimator7292 » Wed, Oct 15, 2025, 3:23 PM UTC

fmobus wrote: post #131

RajT88 wrote: post #116

Earlier quoted context omitted.

I'm waiting for IT departments worldwide to wake up to the threat that your browsers are leaking all of your URI's by default back to the manufacturers. URI's leak company secrets. I'm sure there's some people at Google using Edge which are leaking company data to Microsoft. I'm sure there's some people at Microsoft using Chrome which are leaking data to Google. Edge and Chrome both send back every URI you visit to "…

For that to be in anyway useful for those companies (as a means to spy on their competitors), they'd have to be actively looking into the information to derive intelligence. Not really practical without some serious engineering, which would leave tons of evidence. It's not worth it. That's just not how these companies operate. > there's some people at Google using Edge I'd be surprised if it's more than a handful of…

That's what we have AI for. This type of thing is no longer a manual or manually-automated process.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#138

Post by SAI_Peregrinus » Wed, Oct 15, 2025, 6:36 PM UTC

lxgr wrote: post #74

stavros wrote: post #63

Earlier quoted context omitted.

Eh I kind of feel like you can't say that. If something is magical before you learn how it's done, it should be magical after. The magical part isn't "it's actually impossible", but "it's so far from what I could come up on my own", which still holds after you know the secret.

Yes, some excellent magic tricks work even better when you know how they work, especially if they’re the kind that’s based on putting in ridiculous amounts of work or skill/practice. Penn and Teller play a lot with that idea, for example.

Dani DaOrtiz is one of the best at that. He sells instructions for all his tricks, but he's so good at performing them that they still feel like magic even if you know what he's doing. His appearance on Fool Us¹ is a series of excellent examples of that. He palms a card onto the box, and Teller's reaction when he misses it happening is astonishment because it's such a simple move to spot but done so well Teller missed it despite looking for such moves. That continues as the act goes on, until both Penn & Teller are left experiencing only the joy of the performance & awe at Dani's skill. None of the techniques are ones they don't know about, but Dani does them so well they didn't even try to figure out everything he did, since they knew they'd have to guess what he'd actually done! Penn later described Dani as "the best card magician who has ever lived"².

The best magic tricks tend to be the ones where knowing the secret doesn't ruin the trick, but instead changes it to a show about the skill of the performer. Nobody complains about "spoilers" at a virtuoso's concert, the joy of the performance & the skill of the performer are not ruined by knowing the music beforehand. I think the same can apply to magic, to books, to movies, etc. You can re-read a really good book, or re-watch a really good movie, and the experience won't be ruined by knowing the ending. It'll be different, but not worse. With magic the awe shifts from "how is that possible?" to "how did that person manage to put in the effort to do that so well‽".

¹https://www.youtube.com/watch?v=5_KcQt0z-eE

²https://www.youtube.com/watch?v=NdxT3BL_Iik

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#139

Post by tgsovlerkhgsel » Wed, Oct 15, 2025, 7:30 PM UTC

Thorrez wrote: post #93

tgsovlerkhgsel wrote: post #30

Earlier quoted context omitted.

> My bet is that in space there would be a noticable increase in heat/energy if they did encryption by default. Why would it? The data originates from earth, and should be encrypted during the uplink leg too, so the crypto should all happen in the ground segment (or even well before it reached anything that could be considered part of the satellite setup, honestly).

The only thing I can think of is maybe the satellite company runs compression on the data. Encryption would prevent that.

They could compress then encrypt before transmitting it over a radio link.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#140

Post by ASalazarMX » Wed, Oct 15, 2025, 7:44 PM UTC

abustamam wrote: post #133

lxgr wrote: post #74

Earlier quoted context omitted.

Yes, some excellent magic tricks work even better when you know how they work, especially if they’re the kind that’s based on putting in ridiculous amounts of work or skill/practice. Penn and Teller play a lot with that idea, for example.

I think I respect Penn and Teller as magicians more since they reveal how some of their tricks work, and yeah the sheer amount of skill required is for some of their tricks is impressive. I also liked watching The Masked Magician share some behind the scenes of tricks, and even knowing how it's done doesn't make the trick any less impressive.

They warn you that they're going to misdirect you, and you know it, and still fall for it. Somehow they keep the magic alive.