Slashdot Mirror
The Dismal State of SATCOM Security
An anonymous reader writes "Satellite Communications (SATCOM) play a vital role in the global telecommunications system, but the security of the devices used leaves much to be desired. The list of security weaknesses IOActive found while analyzing and reverse-engineering firmware used on the most widely deployed Inmarsat and Iridium SATCOM terminals does not include only design flaws but also features in the devices themselves that could be of use to attackers. The uncovered vulnerabilities include multiple backdoors, hardcoded credentials, undocumented and/or insecure protocols, and weak encryption algorithms. These vulnerabilities allow remote, unauthenticated attackers to compromise the affected products. In certain cases no user interaction is required to exploit the vulnerability; just sending a simple SMS or specially crafted message from one ship to another ship would be successful for some of the SATCOM systems."
Keep telling us! More Please! Again! Remind those that may have missed this before how any simpleton can hack satellites. Please, you're doing the entire
world a great service by restating what everyone wants no one to know. Like this HELPS in any form? Do you really think that the 'good guys' are going to listen to YOUR great words of, well, repetition?
so, just like your data communications in your house, if you don't want someone eavesdropping on your conversation toss a type1 encryption device in front of it, like every other security conscious satcom user.
Isn't it great how security went from a concern, to an afterthought, to completely irrelevant over the span of twenty years? Only to be magically resurrected as a hot button issue of worldwide concern for every other news story for arguably the next 5 years. And all because big corps, with all their endless offshoring, cost cutting, profit seeking, litigation circumvention, and merciless assault on tax avoidance will continue to skip to the loo with endless payrolls, blaming all of this all the while on "outside forces". It makes me feel like IT Security is as fun a joke in the boardroom as GAAP. We don't even have a real ruling body anymore according to IETF sources. Is there anything that isn't a mucked up mocked up half assed attempt at stopping this all?
Not nearly as interesting as a conversation with this guy.
You would have thought people who made satellites were, like rocket scientists. Not drunken lemmings.
TCAP-Abort
There are alot of guys who do it. One of the best was Ivan Artner, and he suspiciously died in a motorcycle accident.
They will take it seriously when someone pwns a communications satellite.
LDR services like Inmarsat were never meant to be secure. Now if this was about AEHF that would be news.
Anyone talking on a sat phone is by definition interesting to the government - any government. Why would you think that these would be secure?
Wasn't it just yesterday that someone has posted a flamebait summary about the Heartbleed bug changing the "Open source is safer" discussion?
This is a great evidence of what happens when you rely on security by obscurity in proprietary software. Nobody is forced to fix things, sloppy coding is the norm and there are backdoors galore ...
Unfortunately, the bad guys laugh, the vendors play ostrich with the heads in sand and everyone else is suffering the consequences ...
"Satellite Communications (SATCOM) play a vital role in the global telecommunications system, but the security of the devices used leaves much to be desired. The list of security weaknesses IOActive found while analyzing and reverse-engineering firmware used on the most widely deployed Inmarsat and Iridium SATCOM terminals includes not only design flaws, but also device features that attackers could leverage. The uncovered vulnerabilities include multiple backdoors, hardcoded credentials, undocumented and/or insecure protocols, and weak encryption algorithms. These vulnerabilities allow remote, unauthenticated attackers to compromise the affected products. In certain cases no user interaction is required to exploit the vulnerability; sending a simple SMS or specially crafted message from one ship to another ship would be enough to compromise some of the SATCOM systems."
Took 30 seconds, and makes the summary actually make sense.
Maybe in the 60s and 70s. Then people figured out what ~250ms of RTT costs and figured undersea cable was worth the investment. Satellite is mainly for:
1. Backup links when undersea cables are too congested to survive.
2. Sat phones which typically use LEO satellites and is really only viable if there are no other alternatives. I'll lump fixed basestation Internet access here as well, even though they're often geostationary satellites.
3. TV broadcast where latency doesn't matter.
The idea that you pick up a cell phone and the camera instantly pans to a beeping satellite and then down to who you're talking to is a great movie effect, but has little bearing on reality.
Hijacking satellites has been going on for some time. There is this story from Strategy Page:
-----
Brazil and the U.S. have been arresting people who have been illegally using obsolete, but still functioning, U.S. Navy FLTSATCOM communications satellites. The FLTSATCOM (Fleet Satellite Communications System) were eight communications satellites launched between 1978-89. Two of the launches failed, and FLTSATCOM was replaced by the UFO in the 1990s. Although the FLTSATCOM birds were built to last for seven years, two of them are still operational twenty years later.
As the navy stopped using FLTSATCOM in the late 1990s (shifting over to the more efficient UFO satellites), ham radio users in Brazil discovered that the FLTSATCOM satellites had no security on them. If you knew the frequency and had a satellite dish, you could send a signal to the FLTSATCOM satellite, that would then automatically be rebroadcast by the satellite over a wide area below. While the navy sent encrypted messages (which sound like static, for anyone picking it up below on ham radio gear), the Brazilians found that they could simply use FLTSATCOM to communicate over a wide area (the interior of the country) that lacked telephones. FLTSATCOM birds had multiple transponders, making several simultaneous conversations possible. There was no security because, back in the 1970s,the remote possibility of homemade satellite dishes using FLTSATCOM, did not seem to warrant the additional hassle of adding passwords to transmit from the satellites.
--------
https://www.strategypage.com/dls/articles/U.S.-Navy-Satellites-Hijacked-5-31-2009.asp
You don't need a giant dish. You see those Iridium handsets? That's all that you need. The newer ones fit in a cargo pocket.
Faster! Faster! Faster would be better!
You, uih, missed the whole 'anything mobile that may be out of range of a cell tower' thing.
... and that guy/guys who broadcast that Max Headroom bit back in the 80s!
> Anyone talking on a sat phone is by definition interesting to the government - any government.
Uh, no. I live on the coast and every big (especially charter) fishing boat has sat phones. Most of it the conversations are: "Yes honey I'm still at the office looks like I'm going to be REALLY late".
There are a couple of factors that are worth considering. Unlike fiber or coax transport systems, satellites are usually used for very long distance communications. Because of this, it is quite frequent that your link will terminate in another country or even continent. This will make standards compliance and procurement a challenge from day one since you can't guarantee everyone has access to the same equipment.
Secondly encryption standards have to be agreed upon and quite often, equipment from different manufacturers can't be cross-utilized, so you can't just assume that off-the-shelf crypto will be an option to everyone who will participate.. This means everyone has to agree what to use in advance, which could lead to still other challenges. So it's not as easy as the question implies.
Peace, K1
I think the Apache Foundation only hired illiterate morons. It's like the Apache people just string random words together.
A big ancient expensive government-backed system is full of security flaws.