How hackers abused satellites to stay under the radar (2015)

why pharmacutical companies I wonder?

I've done a significant amount of research on these threat actors. Despite the high tech exfiltration method and nation state support, researchers were still able to easily find their infrastructure. Satellite communications were encrypted via self-signed ssl certificates. Using internet scanning, we could track their IP addresses and associated domains using the SHA-1 of their certificate (map certificate to hosting IP). Happy to answer questions, but you can also read more here. https://blog.passivetotal.org/snakes-in-the-satellites-on-go...

I believe you are correct in your understanding. Mine was a little different. I thought this was a classic asymmetrical routing scenario on the Internet with a cool eavesdropper twist.

I'm assuming that because the sat system broadcasts unencrypted, you can sniff all the packets for all hosts on that network just like you can on a wifi network with the proper promiscuous mode receiver. An unencrypted shared broadcast medium.

So packet flow is routed inbound from victim as such

(victim SYN to decoy IP) to (internet) to (sat broadcast to geographic area decoy and attacker C&C)

But packet flow outbound from C&C to victim is handled differently via landline

(spoofed decoy IP) to (landline/internet) to (victim)

So packets come in via sat link but go out via spoofed source on a landline.

> I've spent many years reading police reports and paying attention to how people are caught.

The jails are full with people who thought they were really smart. Reading police reports does not prepare you for the reality, it only gives you a theoretical knowledge of what life on the other side of the line is like. Ironically, it might be the worst possible source of input because it only shows you what did not work, it does not show you what did work because you'll never hear about those things.

> It's easy to be a keyboard warrior.

Precisely.

> But you're dismissive of anything you feel treads on your domain.

No, I'm dismissive of advice that could get people in a lot of trouble. It's funny how people will prefix even the mildest legal advice with huge disclaimers but it's perfectly ok to dish out tradecraft advice of which you admit you only have a theoretical understanding and which could easily get someone in trouble, jailed or even killed.

You might as well tell people to watch CSI for inspiration if they decide to go after the mob by their lonesome.

And no, people are not here for advice on how to start a war with organize crime on a budget, I can see how it is nice to fantasize about being some kind of vigilante super-hero but those are typically movies, not real life. In real life unless you have a powerful organization of your own behind you when you start messing with the dark side you will wind up dead. Talking tough is not going to get you points and clothes bought in a thrift store do not offer magical protection.

But every time you power up your cellphone you tell a lot of people that can be bribed where you are (burnerphones hide your identity only as long as you use them in places that are not associated with you), every time you walk out the door you leave a nice DNA trail, every time you use an app on your phone (and plenty of them just running in the background) will tell tons of people (and networks where you can buy this info for cents or even for free) where you are to within an even smaller radius and so on.

Being anonymous and staying anonymous over a long period of time are really not the same things. The risk of discovery goes up with every interaction and with the power of computers behind the party doing the search the fight is asymmetrical.

Let me give you one concrete example of how short the distance can be between being at large and the dreaded knock on the door.

Camarades.com had a bit of a problem with people stalking others and one lady in particular was taking her chances. For 10 seconds she once pointed her camera at something else than her body, a mirror in the room, which reflected part of the scene outside. That was all it took for some crazy Italian to figure out where she lived and to show up on her doorstep three days of continuous driving later. I'm sure she never saw that one coming and for you in the tech world this may seem like an 'obvious' mistake to make. But just like that you too will be making obvious mistakes, just different ones.

I appreciate the post, and you're an excellent writer. But I did address every one of your points. Cellphones have to be used with the same care as the original operation. Those 10 seconds you mention are something you can't do. If you're someone who is foolish enough to make those mistakes, you shouldn't be involved in any of this.

One thing that's helped me is to plan operations that can fail gracefully. For example, if anyone had spotted me during the op, I would've scrubbed it. No harm done. But since it was successful, I probably would have known about any mistakes that would've led to my exposure.

Note that word "probable." Once again, there's no such thing as a foolproof plan. You can only try.

None of my comments were "advice," either. They're an example that you can make progress, even if you're a lone wolf. Your first paragraph goes both ways: We don't hear about the successes.

The list of failures is long. If you don't have a meticulous personality, then these choices aren't for you. Meticulousness is more important than intelligence, though you do need a minimum level of competence to do anything.

But to insinuate that nobody anywhere can do anything is -- well, we'll let history be the judge of that.