How hackers abused satellites to stay under the radar (2015)
arstechnica.com
How hackers abused satellites to stay under the radar (2015)
1–10 of 69 posts
Re: How hackers abused satellites to stay under the radar (2015)
#2So then how was this discovered?
Re: How hackers abused satellites to stay under the radar (2015)
#3So then how was this discovered?
I assume by looking at the command and control ips and looking for what is common. (IE that they were from satellite ISPs)
You can read the original post here: https://securelist.com/72081/satellite-turla-apt-command-and...
Re: How hackers abused satellites to stay under the radar (2015)
#4Ok, that is pretty interesting. I wonder if this will lead to an encrypted signal or deeper analysis of the uplink firewall logs.
I would guess you would defeat this once you know the C&C is operating by doing traffic correlation on 'bad' connections (connections which should not exist given the failed TCP handshake). Presuming you have core router access at the ISPs then you would tell your sniffer to capture all traffic after a C&C sequence detect and then work it backward to correlate related traffic. It would require participation on the part of the ISPs.
Re: How hackers abused satellites to stay under the radar (2015)
#5Are these satellites in geosynchronous orbit? If not, and you've got a copy of the malware, you ought to be able to narrow the location of the C&C server using its orbit and a correlation analysis of when the malware receives comms from the C&C. Depending on the orbit, I'll bet you could bracket it to a few degrees. Since the attackers can't stop answering C&C calls or their network collapses, merely publishing that you're doing such a search might be enough to disrupt their operations.
Then again, maybe this blog post was just such an announcement.
EDIT: I'm willing to bet that satellite downlink performance degrades in bad weather, so even if the sats are in geo-sync, you can just wait for inclement weather to mask a region of the cone.
Re: How hackers abused satellites to stay under the radar (2015)
#6So this has to be some sort of state sponsored hacking right? I can't think of a non government group who would have the knowledge, money, or motivation to research this just to mask their origin when there are far simpler ways of receiving transactions (ie. bitcoin)
Re: How hackers abused satellites to stay under the radar (2015)
#7Are these satellites in geosynchronous orbit? If not, and you've got a copy of the malware, you ought to be able to narrow the location of the C&C server using its orbit and a correlation analysis of when the malware receives comms from the C&C. Depending on the orbit, I'll bet you could bracket it to a few degrees. Since the attackers can't stop answering C&C calls or their network collapses, merely publishing that…
Their best bet is to have multiple mobile C&C centers doing a random traverse around the cone and using some sort of scheme to decide who answers which calls - a consistent hashing scheme would work.
Of course, those paths would probably follow major roads, reducing the solution space to find a mobile adversary -- they aren't going to be roaming over open fields / not all points are equally probable.
It's an interesting cat-and-mouse problem, to be sure, but the blue team has far more computing power.
Re: How hackers abused satellites to stay under the radar (2015)
#8So this has to be some sort of state sponsored hacking right? I can't think of a non government group who would have the knowledge, money, or motivation to research this just to mask their origin when there are far simpler ways of receiving transactions (ie. bitcoin)
It's supposedly part of the Turla malware system, which was already suspected of being a state sponsored system.
However, I think there are many ways to mask origin. I wonder if this particular approach is intended so it becomes difficult to even shut down the botnet's C&C.
[speculation]Using a fixed domain or ip-address for C&C let's authorities seize it and even a sequence you can predict might be predicted by someone else. This can broadcast its presence to an arbitrarily chosen IP address of the class of those going out to the satellite receivers and the C&C can filter all the traffic for this "I am here" message and can then conventionally communicate to the box - making blocking or spoof the C&C harder. [/speculation]
Re: How hackers abused satellites to stay under the radar (2015)
#9So this has to be some sort of state sponsored hacking right? I can't think of a non government group who would have the knowledge, money, or motivation to research this just to mask their origin when there are far simpler ways of receiving transactions (ie. bitcoin)
Not necessarily.
I briefly pretended to be a criminal, mostly for fun. (Most readers will go "Uh huh" at this, but it was just a game.)
Say you're developing the next Silk Road. Say you have perfect opsec, and you never reveal any personal info. What are your risks?
The #1 risk is discovery of your physical location. Before every action, you must ask yourself: Will the next keystroke get me caught?
It takes immense discipline. I think rtm could probably do it if he put his mind to it. Maybe tlb. Few others seem to have the personality for this.
Solving the location hiding problem is the first step toward doing anything untoward. It's not as simple as "just use Tails." Try to build a service and you'll discover all the reasons.
Money is the other half. I guess I may as well tell the story. You need money in certain situations, and bitcoin isn't always good enough. You need untraceable cash that you can spend online. You also need burner phones that can't be tied to your physical location in order to sign up for all the normal services. If you use Tor, you'll quickly discover that ~every service prompts you for a phone number during account creation.
I solved this in a simple way: I waited until the middle of winter, then went to goodwill and bought a bunch of clothes, old shoes, and a facemask. I stuffed all of this in a trashbag, then paid a taxi in cash to drop me a couple miles from a certain store that had both prepaid visa cards and burner phones.
For the first half of the walk, I looked like a normal person walking along at night, carrying a trashbag. I ducked into a neighborhood whose streetlights were out, and went in between two houses. It was nearly pitch black as I put on the clothes from the trashbag. I left the bag plus my old shoes hidden there, then continued for the rest of the walk to the store. I bought $400 worth of $50 gift cards and two prepaid phones, then did the whole operation in reverse.
Why? Because when your opponent is a nation-state, you have a risk of being found via any other method. You can't drive anywhere because of license plate trackers. You can't show your face at the store thanks to facial recognition. You can't wear the same outfit without being picked up on CCTV's near your home base in the same outfit that you were wearing at the store.
The same care has to be taken when activating and using the burner phones. Every usage has to be treated as an operation, not an errand, or you're caught. You have to assume one mistake => caught.
It was very satisfying having $400 in untraceable cash to set up an untraceable service, complete with an online persona with gmail, twitter, github, and every other normal service.
The reason for this level of paranoia was that in addition to being a game, one of my main ambitions has been to fight against drug cartels. I wanted to use technology to do this.
My hypothesis was that right now, the main reason cartels are so powerful is that nobody is in a position to talk. Say you're a peon in a cartel: someone who unloads the drug buses that run from Mexico to Chicago, for example. You have very valuable knowledge: what times the buses will arrive, where they're unloading, who's involved. But even if you wanted to snitch, you'd suffer a fate worse than death if you're caught. What are you going to do? Keep submitting this info as anonymous tips to the FBI's website? There's no organized resource for peons to report activities like this. That's why I wanted to build one. It's like SecureDrop for fighting cartels rather than governments.
As you can tell from me posting this casually, nothing ever came of the experiment. But if it had, I would've slept quite soundly knowing my location was untraceable even with government-level resources aimed at tracking us down.
All of this is to say that the "location problem" is very relevant to pretty much any serious activity, government or not.