Live data from Hacker News

Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

satcom.sysnet.ucsd.edu

11–20 of 145 posts

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#11

Is it correct to Assuming the amount of Mexican companies in this paper is because of their receiver being in the major city southwestmost corner of the country ?

Yeah that's correct. The study was conducted in San Diego which falls under the satellite beam footprint required for services in Mexico.

If you were in say, Alice Springs in Australia (wink wink) for example, you'd be able to see traffic for Indonesia, Philippines, most of South East Asia, and perhaps parts of China, South Korea and Japan if the beams are right.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#12

Had a vendor offer a customer of mine a huge discount if they purchased radios without the encryption license in the year of our lord 2024. Not even WPA or WEP. Just clear across the sky. And this is terrestrial. My bet is that in space there would be a noticable increase in heat/energy if they did encryption by default. But its still incredible to see them pretend like space is impossible to get to, ultimate obscuri…

Likely no consequences to the decision-makers for data exfiltration or other shenanigans happening, so there's nothing motivating a behavior change. The reason security is so bad everywhere is that nobody gets fired when there's a breach. It's just blamed on the hackers and everyone just goes on with life singing "We take security very seriously--this happened because of someone else!"

> nobody gets fired when there's a breach

this must mean the consequences of such a breach has either not produced any visible damage, or the entity being damaged is uncaring (or have no power to care).

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#13
post #12

Earlier quoted context omitted.

Likely no consequences to the decision-makers for data exfiltration or other shenanigans happening, so there's nothing motivating a behavior change. The reason security is so bad everywhere is that nobody gets fired when there's a breach. It's just blamed on the hackers and everyone just goes on with life singing "We take security very seriously--this happened because of someone else!"

> nobody gets fired when there's a breach this must mean the consequences of such a breach has either not produced any visible damage, or the entity being damaged is uncaring (or have no power to care).

Or, the entity being damaged is not the decision maker and has no power to hold the decision maker responsible.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#14
post #12

Earlier quoted context omitted.

Likely no consequences to the decision-makers for data exfiltration or other shenanigans happening, so there's nothing motivating a behavior change. The reason security is so bad everywhere is that nobody gets fired when there's a breach. It's just blamed on the hackers and everyone just goes on with life singing "We take security very seriously--this happened because of someone else!"

> nobody gets fired when there's a breach this must mean the consequences of such a breach has either not produced any visible damage, or the entity being damaged is uncaring (or have no power to care).

End user license agreements are a huge part of the problem. Ideally users could sue if our data is leaked - and the threat of being sued would put pressure on companies to take security more seriously. Ie, it would become a business concern.

Instead we're constantly asked to sign one-sided contracts ("EULAs") which forbid us from suing. If a company's incompetence results in my data being leaked on the internet, there's no consequences. And not a thing any of us can do about it.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#15
As with anything in life, when it's what you know and do on the regular, that simple thing can look like magic to others. I met an old timer in the satellite business that came out to help install our receiver for a new TV channel the company I was at was getting off the ground. He found out what bird we were using and what its slot was. Based on that, he knew how many satellites over from the satellite he knew and used as his base. It was a long time running TV channel that he could find very quickly. Once that bird was located, he just manually (literally pushed the dish with his hand) counting the number of satellites that came in/out of view until he landed on "our" bird. Once there, connected our receiver and baddaboom baddabing, there it was. Once the satellite was pointed at the proper angle to the south, it took less than five minutes from him connecting his receiver to verify his base signal to packing up and heading off the roof.

His base satellite signal was unencrypted and a main reason he used it for this purpose. Our channel was scrambled, and only verifiable after our receiver with the decoder was connected. It was impressive seeing someone that good at their job make it look so easy, but after he explained the layman's version of orbital slots it became less magical. This is why magicians are meant to not tell you how the trick is done.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#16
I see no issue with the satellite backhaul itself being unencrypted; anyone using the satellite provider should assume they're hostile and encrypt+authenticate everything they send anyway. I don't trust my ISP's fiber to be snoop-resistant just because they nominally have some shitty ONT encryption.

Obviously the specific examples of end-users failing to encrypt are bad, but that's not really a problem with the satellites.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#17

Is it correct to Assuming the amount of Mexican companies in this paper is because of their receiver being in the major city southwestmost corner of the country ?

Yeah that's correct. The study was conducted in San Diego which falls under the satellite beam footprint required for services in Mexico. If you were in say, Alice Springs in Australia (wink wink) for example, you'd be able to see traffic for Indonesia, Philippines, most of South East Asia, and perhaps parts of China, South Korea and Japan if the beams are right.

> wink wink

location location location is an apt phrase for more than just real estate

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#18
post #12

Earlier quoted context omitted.

Likely no consequences to the decision-makers for data exfiltration or other shenanigans happening, so there's nothing motivating a behavior change. The reason security is so bad everywhere is that nobody gets fired when there's a breach. It's just blamed on the hackers and everyone just goes on with life singing "We take security very seriously--this happened because of someone else!"

> nobody gets fired when there's a breach this must mean the consequences of such a breach has either not produced any visible damage, or the entity being damaged is uncaring (or have no power to care).

Or the damage is diffuse whereas the costs of preventing the breach would be concentrated. Or the connection between the damage and the breach is difficult to prove.

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#19

Is it correct to Assuming the amount of Mexican companies in this paper is because of their receiver being in the major city southwestmost corner of the country ?

Yeah that's correct. The study was conducted in San Diego which falls under the satellite beam footprint required for services in Mexico. If you were in say, Alice Springs in Australia (wink wink) for example, you'd be able to see traffic for Indonesia, Philippines, most of South East Asia, and perhaps parts of China, South Korea and Japan if the beams are right.

I'm not so good at hints. Are you gesturing at the NSA facility at Pine Gap?

Re: Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]

#20

Had a vendor offer a customer of mine a huge discount if they purchased radios without the encryption license in the year of our lord 2024. Not even WPA or WEP. Just clear across the sky. And this is terrestrial. My bet is that in space there would be a noticable increase in heat/energy if they did encryption by default. But its still incredible to see them pretend like space is impossible to get to, ultimate obscuri…

Why does Space need to decrypt a vast majority of the traffic? Flow can be just as brick not-smart as fiber optic cables under the sea.

Now, management, control, etc? Yeah those you need to decode in orbit.

Post reply on HN