Slashdot Mirror
Small Satellite Dish Systems 'Ripe For Hacking'
The Walking Dude writes:
"According to the CS Monitor, 'Thousands of small satellite dish-based computer systems [VSATs] that transmit often-sensitive data from far flung locations worldwide – oil rigs, ships at sea, banks, and even power grid substations – are at high risk of being hacked, including many in the United States, a new cyber-security report has found.' Dr. Jason Fritz said, 'Vulnerabilities exist at all nodes and links in satellite structure. These can be exploited through Internet-connected computer networks, as hackers are more commonly envisioned to do, or through electronic warfare methodologies that more directly manipulate the radio waves of uplinks and downlinks.'"
The 'hacking' fud is getting thick lately...
I have a hard time taking anything with the word "cyber" seriously.
I don't take computer security seriously any more. Everything's an arms race where the only way to win is not to be important enough for anyone to want to make an effort against you.
If we had a culture based on cooperation rather than competition, we wouldn't have everyone taught and therefore trying to get one up on everyone else.
It's been hundreds of years since humanity has established new societies based on cooperation (no, Marxism-Leninism is nothing of the sort). Let's stop lazily thinking of ourselves and try again, if we're intelligent enough.
In the 1990's a communication satellite belonging to China was hacked and the hackers (rumored to be a state-sponsored hacker group) changed the tee vee channels on that satellite to carry anti CCP programs.
Almost 20 years have passed and nobody claimed responsibility over that incident, but it is believed that the hacker group was sponsored by some state (nation) because it does take quite a bit more ooomph in term of beaming power in order to hack into a satellite orbiting the Earth.
As for that particular Chinese communication satellite, China tried to "unhack" that bird but failed. So China took the "Plan B" route - they junked that bird, shut everything on that satellite down and now it's floating up there doing nothing.
Muchas Gracias, Señor Edward Snowden !
Although I nearly daily read papers from almost any university in the world, I had never heard of Bond "university". Which Bond is this - James Bond ?
On a more serious note, though: "IntelCrawler" does not ring a bell, either. The only somewhat creditworthy title being cited is csmonitor. For the moment I am writing TFA off as hype-generation and FUD. I would love to be proved wrong, however.
Religous speak to God. Insane are spoken to by God. When all shut up, one can finally hear Shostakovich in peace
Fucking NSA.
All software is shit, all hardware too. We've long abandoned a development model that is focused on correctness. It has been features, features, features for decades. So what do you expect? Of course everything's ripe to be hacked. We had a choice.
And nowadays we know that sat tracking is easy these days thanks to various free and open software/hardware around.
If you can spare some minutes on a lazy Sunday, watch Travis Goodspeeds Talk on 30C3 from a couple of weeks ago.
http://www.youtube.com/watch?v=ktnQ7nBCuqU
!= Hacking, /.
The headline is strangely construed to convey a false sense of security that large satellite dish systems are not ripe for hacking. All systems are no stronger than their weakest (back) door.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
GOODEVENING HBO
FROM CAPTAIN MIDNIGHT
$12.95/MONTH ?
NO WAY !
[SHOWTIME/MOVIE CHANNEL BEWARE!]
Anyone notice that he "hidden" or blanked out addresses were still listed in clear text just below the erased entries, albeit in slightly smaller text? Best part is they still let you see the protocol types the sites responded to. Telnet for the win, are they serious?
Are you saying we can hack our residential TV dishes like from Dish, DirecTV, etc.?
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
If a hacker gets into a box on a Hughesnet, He'll notice the 1200 millisecond ping times and 64 Kbps upstream bandwidth and say "Ewww! Hughesnet!" then promptly logout and never return again.
Aside from the attack in the article, one might think that VSAT terminals are much more susceptible to DDoS attacks because of their limited bandwidth and the carrier's Fair Access Policy. One might assume that pretty much anyone who wanted to could just send data to the IP address of one and The FAP will restrict the throughput.
The thing is, the commercial VSAT providers have already thought of this. Each terminal is on a private network behind a NAT already, even if you're not using the software proxy accelerator. Incidentally, modern terminals already have the network accelerator built into the VSAT modem, but regardless of this most VSAT terminals are on private networks and can't be reached directly.
Back to the article, the uplink exploit is well-known and several decades old, as another poster reminds us of the 1980 Captain Midnight incident. Even in this case, the best you can do is deny service, and you'll eventually be caught doing it.
At the earth station you're not going to be stealing any data, as it's encrypted on the way down and you're not going to be breaking into the facility.
You're not likely to find them by scanning networks, either, as mentioned earlier most VSAT terminals are on private networks. Even if you were to reach the terminal directly the management port isn't reachable from the outside world, just the private network of the VSAT operator.
The article is an interesting bit of speculation, and has the obligatory mentions of Afhanistan, SCADA, and the SHODAN search engine.
Kriston