71–80 of 267 posts
I never understand why the dollar amount is always included in these headlines. Like affording the $25 worth of hardware is really the most difficult obstacle to overcome here.
Earlier quoted context omitted.
Viasat attack was by hacking ground terminals, not jamming satellites.
The Russian approach is hybrid: in addition to the use of jamming (they use Divnomorye, Leer, Moskva, Krasukha, ...), traditional hacking is used to extend the damage range beyond what can be obtained through pure electronic warfare. In the case of Viasat they had access to a badly configured VPN appliance and used it to deploy on the terminals. Which is a classical case of network compromise, not a direct hack of th…
Yes, performing this reverse engineering requires physical access. But it potentially enables one to find further vulnerabilities and systems knowledge necessary to build attacks that brick network terminals or otherwise disrupt the network. Russia's action proves these attacks are viable and useful (even if an authenticated management vector was used).
Your original comment about the constellation height was a non-sequitur: we're talking about threat actors' attacks on end-user terminals. The article makes clear ("on the ground") that this is what it was referring to.
Yes, jamming, etc, are also useful attacks that threat actors use but not what we're talking about.
This WIRED article[1] references a release of tools and information about the research on GitHub[2] however it 404s. Hope that is not being censored. [1] https://www.wired.com/story/starlink-internet-dish-hack/ [2] https://github.com/KULeuven-COSIC/Starlink-FI
It shouldn't count as a vulnerability that you can get root of a device that you have physical possession of. If there's any real vulnerability here, it's that having root of your terminal gives you any extra privileges to the rest of the network.
If a system is designed to not allow that access, and you can compromise that design, it is most definitely a vulnerability.
So, if you make things harder and someone comes along that invests more effort to overcome, can you really call that a vulnerability? It'd be a real vulnerability if with this access to a user terminal they could elevate permissions on the satellites, but that hasn't been shown (yet?).
Earlier quoted context omitted.
Hmm... When I read "hundreds of thousands" I assume more than 100,000. Is that incorrect understanding of English?
Satellites definitely have multiple computers onboard. Their design philosophy evolved from aircraft which tend to use discrete computer for different tasks. Communications, navigation, data logging etc. That's not counting the computers providing whatever the satellite's mission is and they almost always have redundant hardware to make up for failures which are common in space. So there are definitely far more "comp…
With small computers being relatively cheap and lightweight, I suppose a satellite has a highly available internal computing configuration, with large level of redundancy, capable of functioning even after serious hardware degradation.
I never understand why the dollar amount is always included in these headlines. Like affording the $25 worth of hardware is really the most difficult obstacle to overcome here.
Earlier quoted context omitted.
Both the client and the satellite use beam forming. The signal is pointed at you in a relatively narrow beam not broadcast spherically. They have to know where you are to point at you (phased array antennas so electronic not physical pointing)
I'm not too familar with the low-level details of the Starlink network, but in the slides of the talk it's shown that the dish contains a GPS receiver, so isn't it possible that the client tells the satellite its location on first contact?
They could effectively reimplement GPS or an equivalent location tech with their network but why when a high quality positioning solution already exists.
They will be continually syncing time and position data for the orbits of satellites and positions of clients. (static clients obviously don't need this often outside of timekeeping, but you can set up a mobile plan for RVs, boats, etc which obviously move a lot)
I never understand why the dollar amount is always included in these headlines. Like affording the $25 worth of hardware is really the most difficult obstacle to overcome here.
This reads to me like the (more complicated but ultimately) equivalent of "a user reverse engineers the website's javascript!". As in, this allows the user to mod their client but it doesn't change anything for anyone else, and wasn't meant as a real secure element. I'd assume that getting root access to the user terminal gives them no additional privileges to access the actual Starlink data & control planes.