1
00:00:00,000 --> 00:00:00,540
Oh my gosh.

2
00:00:01,500 --> 00:00:02,740
Talking.

3
00:00:04,080 --> 00:00:05,240
Come on, stream.

4
00:00:05,240 --> 00:00:06,400
Come on.

5
00:00:19,520 --> 00:00:21,060
All right.

6
00:00:21,400 --> 00:00:23,260
And we're live.

7
00:00:23,980 --> 00:00:25,360
All right.

8
00:00:25,770 --> 00:00:35,540
We're here today with another speaker, talking about sniffing satellite traffic, whispers among the stars, with James Pavor.

9
00:00:35,540 --> 00:00:35,880
Pavor?

10
00:00:35,880 --> 00:00:36,840
I didn't actually...

11
00:00:36,840 --> 00:00:37,880
Yeah, Pavor.

12
00:00:37,880 --> 00:00:38,360
Pavor.

13
00:00:38,360 --> 00:00:39,140
Got it right.

14
00:00:39,140 --> 00:00:40,040
Yeah.

15
00:00:40,200 --> 00:00:41,160
All right.

16
00:00:41,160 --> 00:00:44,700
We'll be taking questions in the track one live QA.

17
00:00:44,780 --> 00:00:52,960
Do you want to give a quick summary of your talk for anybody that might not have gotten a chance to see your talk right off the bat?

18
00:00:53,640 --> 00:00:54,440
Yeah, sure.

19
00:00:54,440 --> 00:01:05,680
So the quick recap of the talk is that if you use kind of simple home television equipment, you can intercept these radio waves coming off of satellites in geostationary orbit that are providing internet service.

20
00:01:05,720 --> 00:01:12,620
And what we found is that these internet services are often unencrypted at the internet service provider level, which means you get to see all kinds of nifty traffic.

21
00:01:12,680 --> 00:01:14,460
We looked at it from a bunch of different perspectives.

22
00:01:14,460 --> 00:01:21,340
We saw traffic going to like cargo ships and oil rigs in the ocean or to airplanes in the sky or to like wind turbines on the ground.

23
00:01:21,500 --> 00:01:28,820
And across all of these domains, the talk kind of delves a little deeper into what an attacker might do with that information or how they might abuse these signals to cause harm.

24
00:01:28,820 --> 00:01:35,760
And then it concludes by talking about ways we can fix it by coming up with alternatives to VPNs, which tend to be very slow on a satellite connection.

25
00:01:35,760 --> 00:01:37,200
Awesome.

26
00:01:37,640 --> 00:01:45,220
So we do have our first question with RPTK2015, MVP question asker.

27
00:01:46,060 --> 00:01:50,080
In your talk, you made an active attack by impersonating a ship response.

28
00:01:50,140 --> 00:01:56,600
I assume this requires you to spoof your source address, but ingress filtering ISPs is supposed to prevent IP spoofing.

29
00:01:56,600 --> 00:01:58,740
Can you please explain how you still did it?

30
00:01:59,060 --> 00:02:00,500
Yeah, it's a great question.

31
00:02:00,500 --> 00:02:04,780
I'm not actually sure how that happened from an ingress filtering perspective.

32
00:02:04,780 --> 00:02:10,920
I guess the answer would be that it looks like they weren't filtering correctly because we were able to spoof in one specific network.

33
00:02:10,920 --> 00:02:23,700
It's worth noting, though, that the vast majority of satellite networks we looked at were not trivially vulnerable to TCP session hijacking because of the way that the sequence numbers were changed by those performance enhancing proxies I talk about in my presentation.

34
00:02:23,700 --> 00:02:37,820
So there are only a handful of networks that were directly vulnerable, and they seemed almost designed so that each operator's IP address was a direct gateway to the internet, which might be why the individual customers weren't checking IP addresses for spoofing.

35
00:02:38,620 --> 00:02:38,960
Fair enough.

36
00:02:38,960 --> 00:02:47,460
So if they were peering directly into the backbone of the internet, they might just trust that it's coming from a legitimate source already or already been filtered?

37
00:02:47,740 --> 00:02:48,320
Yeah.

38
00:02:49,340 --> 00:02:50,300
Cool.

39
00:02:50,740 --> 00:02:55,720
I think Hawkeye asked one that would really fall in line with this.

40
00:02:55,800 --> 00:03:05,520
Why do you believe that these high-profile enterprise SATCOM customers haven't adopted and implemented a simple encryption-in-transit policy to stop this kind of spoofing?

41
00:03:06,480 --> 00:03:08,140
So there are a couple of reasons.

42
00:03:08,140 --> 00:03:15,580
I think one is that, like I mentioned in the talk, VPNs are really slow, and that's what a lot of people think an encryption-in-transit policy would look like.

43
00:03:15,580 --> 00:03:24,920
And because of the way that VPNs interact with the internet service provider offerings, they often end up seeing this kind of false tradeoff between privacy and performance.

44
00:03:24,920 --> 00:03:27,580
That said, there are a lot of these enterprise customers.

45
00:03:27,580 --> 00:03:34,380
And when we reached out to them with responsible disclosure, the answer would be that they kind of tried to implement a TLS everywhere policy.

46
00:03:34,380 --> 00:03:38,280
But you're talking about kind of massive networks, like hundreds of ships at sea.

47
00:03:38,280 --> 00:03:44,520
And so there are a lot of systems that are just forgotten, like legacy FTP services or services that they think are behind some sort of firewall.

48
00:03:44,520 --> 00:03:49,560
And so they're willing to accept the risk without realizing that that risk includes a wireless eavesdropping threat.

49
00:03:50,120 --> 00:03:50,560
Yeah.

50
00:03:50,560 --> 00:03:55,060
And some of those ships have a lot of systems that are just unknown.

51
00:03:55,060 --> 00:04:02,200
Like a contractor installed them at some point, they just got lost or forgotten and still plugged into a network in there somewhere.

52
00:04:02,660 --> 00:04:03,720
Yeah, definitely.

53
00:04:05,440 --> 00:04:10,220
So in your talk, you mentioned the performance-improving proxies.

54
00:04:10,220 --> 00:04:16,000
And what I didn't understand was that that was something that would be run by the actual operator.

55
00:04:16,000 --> 00:04:16,860
Is that right?

56
00:04:17,900 --> 00:04:18,560
Yeah.

57
00:04:18,560 --> 00:04:20,560
So almost always that's the case.

58
00:04:20,560 --> 00:04:25,020
There's no like technical reason a customer couldn't bring their own performance-enhancing proxy.

59
00:04:25,020 --> 00:04:32,640
But generally, satellite internet service providers are acting as kind of benevolent eavesdroppers on your TCP sessions.

60
00:04:32,640 --> 00:04:36,080
And they're kind of messing with your TCP three-way handshake to make your traffic faster.

61
00:04:36,080 --> 00:04:42,020
And that's just kind of part of how they see providing customers with sufficiently performance satellite internet services.

62
00:04:42,020 --> 00:04:43,080
Got it.

63
00:04:47,970 --> 00:04:50,270
You want to throw a question out there, Elle?

64
00:04:50,270 --> 00:04:52,290
You know, I was... sorry.

65
00:04:52,370 --> 00:04:54,590
You had a lot of feedback on YouTube.

66
00:04:54,670 --> 00:04:57,990
And a lot of what I'm seeing now is people going, could you do it with this?

67
00:04:57,990 --> 00:04:59,190
Could you do it with that?

68
00:04:59,190 --> 00:05:03,270
And I know you gave a bit of an outline at the beginning of your talk on how you did it.

69
00:05:03,270 --> 00:05:11,430
If somebody wanted to replicate this, play along with it, could you kind of give an outline, you know, from beginning down to software, what they would need to just start out with?

70
00:05:11,850 --> 00:05:12,850
Yeah, definitely.

71
00:05:12,850 --> 00:05:19,610
So I think the core bits that you need are some sort of satellite dish that's capable of receiving satellite television.

72
00:05:19,950 --> 00:05:25,530
We researched the KU band, but there's no reason you couldn't do it in the KA or C frequency bands as well.

73
00:05:25,790 --> 00:05:29,670
And then you need some kind of way to interpret what that dish is saying on your computer.

74
00:05:29,670 --> 00:05:35,470
We use this specific kind of professional grade PCIe card, which I think the model number is on the slide deck.

75
00:05:35,570 --> 00:05:39,690
But you could actually get away with a bunch of like much less expensive cards.

76
00:05:39,810 --> 00:05:47,150
The problem with that is that you won't be able to listen to some of the more interesting signals, which use like 32 APSK modulation and seem to do really poorly.

77
00:05:47,150 --> 00:05:49,050
There are also some USB cards.

78
00:05:49,230 --> 00:05:50,910
So you could do this with a laptop.

79
00:05:50,910 --> 00:05:55,510
You don't have to like build out a satellite spying computer to be able to play with this stuff.

80
00:05:55,510 --> 00:06:02,110
From a software perspective, the tool that I show in the actual like little demo video is I think what I would recommend first.

81
00:06:02,110 --> 00:06:05,350
It's called EBS Pro, and it's designed for feed hunting.

82
00:06:05,390 --> 00:06:08,690
And it's really intuitive and has an interface that's easy to use.

83
00:06:08,690 --> 00:06:12,130
If you're on the Linux side, the tooling is, I think, significantly worse.

84
00:06:12,690 --> 00:06:15,730
So it might be worth spinning up a Windows VM to do this stuff.

85
00:06:15,730 --> 00:06:23,230
The other big tool in the space is something called Crazy Scan, which is around on some of these like satellite television feed hunting forums.

86
00:06:23,710 --> 00:06:32,150
And then once you have all of that lined up, if you're listening to older protocols, so the MPEG-TS standard, Wireshark can actually just interpret those feeds directly.

87
00:06:32,230 --> 00:06:36,490
If you're listening to newer protocols, you have to kind of parse the traffic dumps.

88
00:06:36,550 --> 00:06:45,570
Unfortunately, the tool I talk about in my presentation is still awaiting our chance to publish it as we're trying to be careful not to release an attack tool into the wild before systems are patched.

89
00:06:45,570 --> 00:06:52,470
But we were able to build it using the Python library called KyTy, which is used for like parsing various protocol formats.

90
00:06:52,470 --> 00:06:56,410
And so it wouldn't be that hard to kind of put together your own GSE parser.

91
00:06:56,990 --> 00:07:00,970
Do you know what the signal width is on these?

92
00:07:00,970 --> 00:07:08,010
What grade of software defined radio would you need to be able to receive these signals?

93
00:07:08,490 --> 00:07:09,470
That's a great question.

94
00:07:09,470 --> 00:07:11,030
I actually have no idea.

95
00:07:11,030 --> 00:07:17,190
I know that on the DVBS side of the software defined radio community, I kind of delved into this a tiny bit.

96
00:07:17,250 --> 00:07:26,050
And it looks like being able to keep up with these more complicated modulation schemes is not something that your kind of standard SDR software is able to do.

97
00:07:26,710 --> 00:07:34,010
Whereas these kind of like PCIe cards, I think they often use like specialized FPGAs for the signal processing and are just better at it.

98
00:07:35,570 --> 00:07:38,510
I had two follow-ups on the previous question.

99
00:07:38,510 --> 00:07:45,850
Somebody was asking, which I find funny, is if you're using kind of like the old dish network up on your ceiling, do you need to go up there and kind of reorient the dish?

100
00:07:46,490 --> 00:07:51,590
Yeah, so that was actually a big frustration for us because it turns out that I don't have any fine motor skills.

101
00:07:51,610 --> 00:07:57,410
So there were like several hours between each satellite of me like swearing at various bits of hardware on the roof.

102
00:07:57,410 --> 00:08:04,070
So what we ended up doing is purchasing this thing called the DISEC motor, which allows you to steer a satellite dish across the horizon.

103
00:08:04,230 --> 00:08:09,110
And you can actually just put in the specific location in geostationary orbit you want and direct it that way.

104
00:08:09,190 --> 00:08:18,450
It increased the cost of the attack a little bit, but because we were looking at I think 18 satellites in total, being able to hop between them without crawling onto the roof every time was a big benefit.

105
00:08:18,450 --> 00:08:19,630
I can imagine.

106
00:08:19,630 --> 00:08:24,910
So the parts that you had listed in your talk were between like 300 and 400.

107
00:08:24,910 --> 00:08:27,550
What was the like extra cost of that automated rotor?

108
00:08:27,970 --> 00:08:29,630
I don't remember off the top of my head.

109
00:08:29,630 --> 00:08:31,290
I want to say it's around $100.

110
00:08:31,810 --> 00:08:37,330
You need to be careful that you get one that correctly mounts to the dish you have, because different ones have different ways of attaching.

111
00:08:37,330 --> 00:08:42,350
So it's a little bit less easy to just buy one off the shelf, but it's definitely doable.

112
00:08:42,550 --> 00:08:50,850
Yeah, I've done some ham radio stuff with with aiming antennas, and it's always kind of up in the air whether it's going to work or not.

113
00:08:53,050 --> 00:08:58,870
Have you documented any of this like in a blog, you know, a GitHub, whatever it is that you're using?

114
00:08:59,170 --> 00:09:08,890
Yeah, so there are two academic papers that I can put into the chat afterwards that talk about our domain studies onto terrestrial users and maritime users.

115
00:09:08,930 --> 00:09:10,270
And those go into a lot more detail.

116
00:09:10,270 --> 00:09:24,190
In particular, if you were interested in replicating the GSE extract tool, the appendix of the maritime paper goes into a lot of depth on like how we actually parse the GSE packets and how we deal with the corruption in the signals that we were getting.

117
00:09:24,590 --> 00:09:28,790
Did you have a paper associated with the avionics stuff as well?

118
00:09:28,790 --> 00:09:29,350
Or is that just...

119
00:09:29,350 --> 00:09:31,490
No, that's new for the Hacker Summer Camp.

120
00:09:31,490 --> 00:09:33,390
So that was new stuff.

121
00:09:33,610 --> 00:09:40,650
We're still... I think once aviation picks up a little bit more, we can get consistent data, we may try to publish something that's a little bit more robust.

122
00:09:40,750 --> 00:09:46,750
But because it was kind of a toss in the air as to whether or not there would be a plane out that day, we didn't have as much data as we wanted.

123
00:09:46,910 --> 00:09:52,070
Yeah, I mean, one of my next questions was going to be like, what are the future research look like for you?

124
00:09:52,110 --> 00:09:53,250
Sounds like that's that's one of them.

125
00:09:53,250 --> 00:09:56,730
You got anything else like coming down the pipe that you want to do with this kind of thing?

126
00:09:56,730 --> 00:10:01,770
Yeah, so I mean, we're still looking at that proxy that I mentioned at the end of the paper.

127
00:10:01,770 --> 00:10:03,970
So that's kind of going through peer review right now.

128
00:10:03,970 --> 00:10:08,370
It's always hard to kind of convince academic peer reviewers that something can be both simple and novel.

129
00:10:08,470 --> 00:10:11,390
So who knows how that's going to turn out in the end, but it's on GitHub.

130
00:10:11,390 --> 00:10:15,190
And we're kind of working to make that something that people can hack on and use.

131
00:10:15,190 --> 00:10:18,310
And then I'm also interested in satellite security in general.

132
00:10:18,310 --> 00:10:25,350
I'll be talking at the Aerospace Village tomorrow for a little bit on other threat models to around like space debris tracking.

133
00:10:25,730 --> 00:10:30,350
And so just generally hacking satellites is kind of my focus area.

134
00:10:30,930 --> 00:10:32,490
Sounds like a whole lot of fun.

135
00:10:32,490 --> 00:10:34,030
I think we were.

136
00:10:34,030 --> 00:10:34,550
Yeah.

137
00:10:34,930 --> 00:10:38,170
Is there a satellite hacking village going on right now?

138
00:10:38,530 --> 00:10:38,730
Yeah.

139
00:10:38,730 --> 00:10:44,690
So the Aerospace Village is doing both aviation like last year, and then they've got all kinds of new talks on satellites this year.

140
00:10:44,690 --> 00:10:49,210
Yeah, I knew there was supposed to be a special event this year, but we went virtual.

141
00:10:49,430 --> 00:10:51,390
So maybe next year.

142
00:10:53,150 --> 00:10:58,250
Hawkeye is asking, is there any reason you didn't go with a parabolic antenna in your research?

143
00:10:58,250 --> 00:11:00,830
It seems that the gain might increase with one.

144
00:11:01,830 --> 00:11:04,530
Yeah, I think the gain would definitely increase with one.

145
00:11:04,790 --> 00:11:11,950
The reason we use that self-sat flat panel is just literally because of the shape of the area we were trying to fit it in with a bunch of other things up there.

146
00:11:11,950 --> 00:11:14,330
And it was just the one that we ordered fastest.

147
00:11:14,730 --> 00:11:18,250
But I think that a curved dish would do better and would be cheaper.

148
00:11:18,950 --> 00:11:19,750
Cool.

149
00:11:20,670 --> 00:11:29,150
I think it might be being addressed in the village, but one of the questions on YouTube was, you know, you've talked about how you pull down information.

150
00:11:29,670 --> 00:11:32,810
What is the likelihood that you could push up commands as well?

151
00:11:32,810 --> 00:11:38,250
And you know, started kind of attacking, well not even attacking, but just impacting what you're seeing.

152
00:11:38,890 --> 00:11:48,730
So I haven't looked a ton at transmitting on these internet feeds, and if there's any authentication there, in part because it's just harder to get a license to transmit than a license to listen.

153
00:11:49,130 --> 00:11:59,090
But that said, if you wanted to engage in like attacks against the telemetry link for the satellite, so actually steer the satellite and stuff, a lot of those communications happen in different frequency bands.

154
00:11:59,250 --> 00:12:06,670
In particular, S-band is kind of the dominant satellite telemetry band, and that would require completely different hardware and use different protocols.

155
00:12:07,310 --> 00:12:14,630
That said, the general threat model of like being within kind of this massive footprint areas, I think would still be relevant to think about in that context.

156
00:12:17,170 --> 00:12:18,050
Cool.

157
00:12:18,790 --> 00:12:21,890
We've actually got a fair number of questions that we've backed up.

158
00:12:21,890 --> 00:12:24,810
I'm sorry, guys, I'm not trying to ignore your questions.

159
00:12:28,410 --> 00:12:29,790
Let's see here.

160
00:12:30,070 --> 00:12:38,790
Since this is just a dbb-s or dbb-s2, why not use one of the bazillion conditional access system solutions used for video broadcast?

161
00:12:40,350 --> 00:12:41,470
That's a great question.

162
00:12:41,470 --> 00:12:45,730
I didn't even... oh, so you're talking about the like streamwise encryption.

163
00:12:46,170 --> 00:12:49,670
That's something that I talk about a little bit in one of the papers.

164
00:12:49,670 --> 00:12:54,470
I think these protocols are not well designed from a cryptographic perspective at all.

165
00:12:54,470 --> 00:13:00,950
There have been a lot of vulnerabilities found in them, especially the proprietary ones, which seem popular probably because they have a good marketing link behind them.

166
00:13:00,950 --> 00:13:13,050
But also kind of doing a stream level encapsulation like these protocols do works great for television where you don't want everyone watching a proprietary video feed, but it doesn't work well because anyone who has the keys can listen to their neighbor's traffic.

167
00:13:13,050 --> 00:13:18,330
And you'll often have one satellite transponder that's carrying the traffic of 20, 30, 50 users.

168
00:13:18,410 --> 00:13:23,590
And so it decreases the threat model a lot and it's a big improvement, but it doesn't fix the underlying issues.

169
00:13:24,250 --> 00:13:33,130
And you mentioned another solution that was sort of a replacement for the MPEG, which had been jury-rigged to sort of take IP traffic.

170
00:13:34,450 --> 00:13:38,030
Does that have like the same level of like research involved in it?

171
00:13:38,030 --> 00:13:40,530
Is the same level of like vulnerabilities or something like that?

172
00:13:40,530 --> 00:13:55,010
I know that you're doing like probabilistic extraction of data from it, but... Yeah, so the MPEG standards that are used for sending internet these days, there's something called multi-protocol encapsulation or MPE and ultra lightweight encapsulation,

173
00:13:55,010 --> 00:13:56,330
I think, or ULE.

174
00:13:56,530 --> 00:13:58,290
And we looked at both of those.

175
00:13:58,290 --> 00:13:59,970
Wireshark has built-in support for them.

176
00:13:59,970 --> 00:14:03,930
So the threat model is fairly trivial there if you can get a good recording.

177
00:14:04,010 --> 00:14:13,190
What's interesting about the MPEG context though is that building your own parser is a real pain because it's not a format that was designed for sending data, much less secure data.

178
00:14:13,430 --> 00:14:18,590
And so it's an incredibly complicated and convoluted way of getting IP packets from one place to another.

179
00:14:19,450 --> 00:14:20,610
I believe it.

180
00:14:20,770 --> 00:14:26,810
All those old things that are just like, oh yeah, I'm sure we could fit this data in here somewhere.

181
00:14:26,990 --> 00:14:28,110
It'll work, right?

182
00:14:29,950 --> 00:14:41,890
One of the questions I saw on YouTube is, you know, you talked in your talk about how a lot of these are using, you know, old devices, obviously, old operating systems.

183
00:14:42,070 --> 00:14:49,230
And I don't know how much you went into the past, but what they were wanting to know is have you seen any progression in what they're trying to do to actually protect this data?

184
00:14:49,230 --> 00:14:51,530
Or is it just been the same historically?

185
00:14:52,370 --> 00:14:52,570
Yeah.

186
00:14:52,570 --> 00:14:57,210
So there are companies out there that offer encrypted satellite internet services.

187
00:14:57,210 --> 00:15:03,930
It's often something a customer has to pay extra for or accept like significant performance degradation in the form of the VPN.

188
00:15:04,350 --> 00:15:06,950
One big product in this area is made by NewTek.

189
00:15:06,950 --> 00:15:09,830
It's called Enhanced TCP or ETCP.

190
00:15:09,930 --> 00:15:19,910
There was a WikiLeaks document a few years ago that talked about how there were built-in backdoors for law enforcement and intelligence agencies, which is always the risk with using kind of these proprietary standards.

191
00:15:19,970 --> 00:15:23,670
But there definitely is an initiative in parts of the industry to encrypt traffic.

192
00:15:23,670 --> 00:15:27,850
I think it's just one of those things where the commercial incentives don't align with the need for customers.

193
00:15:29,210 --> 00:15:36,610
So I just want to like, we previously talked about your performance improving proxy, which you mentioned uses QUIC.

194
00:15:36,950 --> 00:15:45,230
There is, is there any potential benefits of just like using WireGuard instead of like, it's another VPN.

195
00:15:45,230 --> 00:15:47,310
It's like you directly compare OpenVPN.

196
00:15:47,410 --> 00:15:49,450
WireGuard is supposed to like, it's simpler.

197
00:15:49,450 --> 00:15:53,790
It's using UDP sessions, should be faster round trip.

198
00:15:54,050 --> 00:15:59,350
Is there, did you look at that in comparison before you started working on your own QUIC proxy?

199
00:15:59,430 --> 00:16:00,590
That's a great question.

200
00:16:00,590 --> 00:16:14,410
So we didn't test WireGuard specifically, although I would point out so that GitHub repository that's linked at the end of the talk for QPAP is actually a generic purpose like Docker test bed, where you could easily install whatever VPN you want and simulate the satellite link.

201
00:16:14,510 --> 00:16:20,750
That said, I think that a UDP-based VPN like WireGuard will still hide the TCP three-way handshake.

202
00:16:20,750 --> 00:16:23,530
So also send those ACK messages across the satellite link.

203
00:16:23,530 --> 00:16:30,630
And so it might be a little bit faster, like starting the VPN session, but the encapsulated traffic is still going to be hidden from the ISP.

204
00:16:30,630 --> 00:16:32,210
And so they can't optimize it correctly.

205
00:16:32,310 --> 00:16:39,010
So you really need to split out the TCP sessions on the ground first, which most VPNs don't do because it'd be a little silly.

206
00:16:39,150 --> 00:16:39,450
Right.

207
00:16:39,450 --> 00:16:39,790
Fair.

208
00:16:39,790 --> 00:16:40,010
Yeah.

209
00:16:40,010 --> 00:16:45,210
And WireGuard is designed so that they specifically can't see those TCP sessions or what's inside.

210
00:16:45,430 --> 00:16:45,990
Right.

211
00:16:47,150 --> 00:16:55,310
So kind of changing pace, sorry, talking and reading at the same time.

212
00:16:56,130 --> 00:16:58,670
Have you looked into Starlink?

213
00:16:58,670 --> 00:17:01,470
I know it's a pretty hot topic that's going on right now.

214
00:17:01,470 --> 00:17:06,810
See if they are actively using any kind of encryption or anything else like that.

215
00:17:07,830 --> 00:17:13,890
So I haven't tested anything related to Starlink yet, although that's definitely... you talked about like areas I'd be interested in the future.

216
00:17:13,890 --> 00:17:15,710
That's definitely an exciting topic.

217
00:17:16,250 --> 00:17:21,290
Starlink is in low Earth orbit, which does change the dynamics a lot because the satellites are closer.

218
00:17:21,290 --> 00:17:28,530
You don't have the same problems with TCP through a handshakes, which means that using a VPN is generally viable because the latency is much lower.

219
00:17:28,570 --> 00:17:33,550
Although certain conditions can change that if you have to make a lot of hops across the constellation.

220
00:17:33,790 --> 00:17:40,670
So I think that it would be easier for SpaceX to implement an encrypted service than it would be for some of these geostationary providers.

221
00:17:40,730 --> 00:17:43,790
Whether or not they do that remains to be seen.

222
00:17:44,630 --> 00:17:45,050
Fair enough.

223
00:17:45,050 --> 00:17:51,210
And like the receiving traffic, it's like because they're in lower Earth orbit, they're going to have a much smaller footprint.

224
00:17:51,670 --> 00:17:52,750
Yeah, that's a great point.

225
00:17:52,750 --> 00:17:58,250
Like the Iridium low Earth orbit constellation, each of the satellites passes across the horizon in like seven minutes.

226
00:17:58,250 --> 00:18:02,210
So the area that an attacker could be is still too large, right?

227
00:18:02,210 --> 00:18:07,090
It's dozens of miles, hundreds of miles, but it's nowhere near comparable to a different continent.

228
00:18:07,090 --> 00:18:07,390
Yeah.

229
00:18:07,430 --> 00:18:11,390
Were you looking at like Iridium satellites as like your testbed?

230
00:18:11,390 --> 00:18:15,370
Like you didn't mention actually which satellites were involved.

231
00:18:15,870 --> 00:18:19,110
Yeah, so we didn't look at Iridium because it's a low Earth orbiting constellation.

232
00:18:19,270 --> 00:18:27,130
We made the decision not to name specific satellite operators for like legal reasons, but they were geostationary providers that were Europe.

233
00:18:27,130 --> 00:18:27,770
Yeah.

234
00:18:28,690 --> 00:18:33,710
I've always found the Iridium satellites, like the story behind the Iridium satellite, super interesting.

235
00:18:34,730 --> 00:18:38,090
Like it's just like a fascinating evolution out of Motorola.

236
00:18:39,010 --> 00:18:39,450
Yeah.

237
00:18:40,870 --> 00:18:41,750
Yeah.

238
00:18:42,750 --> 00:18:53,470
I was wondering, like as the, you know, I guess end result, if I'm up on the airplane on a cruise ship and I decide to pay for internet and I'm getting things like text messages, what can I do to protect the status?

239
00:18:53,470 --> 00:18:57,350
Something like a VPN enough to impact my protection?

240
00:18:57,350 --> 00:19:07,430
So the text message case, I think you're kind of, you're kind of in a bad spot, whatever you do, because that's over the femtocells and you don't have a ton of control over what their backend looks like.

241
00:19:07,450 --> 00:19:18,490
But for emails and stuff, so many people, more people than ever should be, were using just unsecure POP email inboxes and leaking deeply sensitive stuff over the feeds.

242
00:19:18,490 --> 00:19:27,830
And I think just generally using like TLS for visiting websites or POP3 with TLS for checking your inbox is a huge step up for protection.

243
00:19:27,830 --> 00:19:36,090
And then if you're willing to take it a bit slower and have that latency problem, any VPN will be better than having someone spy on your traffic, in my opinion.

244
00:19:36,110 --> 00:19:45,410
I think this is going to be the first year in DEF CON's history since the wall of sheep started that they did not get plain text POP or IMAP credentials.

245
00:19:45,410 --> 00:19:47,810
And that's only because they're not capturing traffic.

246
00:19:51,390 --> 00:19:54,770
People attending these conferences should know at least that much.

247
00:19:55,330 --> 00:19:55,770
Yeah.

248
00:19:57,370 --> 00:19:59,890
We're making a lot of assumptions here.

249
00:20:00,310 --> 00:20:01,310
Yeah.

250
00:20:01,310 --> 00:20:02,090
I don't know.

251
00:20:02,090 --> 00:20:07,490
I feel like if you're going to a security convention, you could at least not use POP.

252
00:20:08,550 --> 00:20:09,950
It's a good start.

253
00:20:09,950 --> 00:20:10,630
Yeah.

254
00:20:11,810 --> 00:20:18,670
Is there anything else that we haven't brought up like that you might want to talk about specifically?

255
00:20:18,670 --> 00:20:24,350
Anything that you might have left out of your talk because it got cut by time that you're interested in?

256
00:20:24,650 --> 00:20:25,990
Anything like that?

257
00:20:26,630 --> 00:20:28,730
There's not too much left.

258
00:20:28,730 --> 00:20:37,730
I think that one thing that I kind of highlighted in the talk but ended up not happening is that GSE Extract is not in our GitHub repository yet.

259
00:20:37,890 --> 00:20:42,350
But it's still something I'm aware of and trying to get out there for people who are interested in checking it out.

260
00:20:42,890 --> 00:20:46,930
And so that's definitely something that I hope will be out soon.

261
00:20:47,030 --> 00:20:52,230
Other than that, though, I think that the general idea of the talk is pretty straightforward, right?

262
00:20:52,230 --> 00:20:56,670
It's that unencrypted traffic, wherever you put it, should be encrypted instead.

263
00:20:56,710 --> 00:21:01,430
And satellites are especially frightening these days because of the way that their signal properties are.

264
00:21:01,590 --> 00:21:05,290
But really, it's wherever you're using the internet, you don't know who's listening.

265
00:21:05,290 --> 00:21:12,490
And so encrypting end-to-end and being sure that you understand kind of how that works under the hood can go a really long way towards helping with privacy.

266
00:21:13,430 --> 00:21:14,530
That's great.

267
00:21:14,890 --> 00:21:27,030
I know you mentioned one of the attack of using the downlink of the satellites as a way to, like, exfiltrate data.

268
00:21:27,030 --> 00:21:31,310
And I know that there was one particular attack in history that made use of this.

269
00:21:31,310 --> 00:21:32,850
And it was, like, somewhere in Africa.

270
00:21:32,850 --> 00:21:37,970
And they figured out that someone was just driving a truck around collecting that data.

271
00:21:37,970 --> 00:21:39,190
Do you know anything about the attack?

272
00:21:39,190 --> 00:21:41,590
It's been a year since I remember anything about that.

273
00:21:41,590 --> 00:21:49,790
Yeah, so I think it was by Turla Group, which is a Russian state-affiliated, well, depending on who you ask, state-affiliated advanced persistent threat group.

274
00:21:50,150 --> 00:21:55,790
And yeah, they seem to have been using these satellite hops to make traffic just disappear over the internet.

275
00:21:55,790 --> 00:22:01,330
And I think that's a really intuitive threat model, because all you have to do is be able to send a packet to the right IP address.

276
00:22:01,330 --> 00:22:04,890
And you don't have to have any software on the place that you're sending it.

277
00:22:06,110 --> 00:22:07,330
Really, really sneaky.

278
00:22:08,090 --> 00:22:09,070
Uh-huh.

279
00:22:09,070 --> 00:22:12,110
So I can't think of any more questions.

280
00:22:13,110 --> 00:22:18,230
If anyone is out there watching the stream is interested in asking more questions, we're still here for a couple more minutes.

281
00:22:20,130 --> 00:22:20,530
Yep.

282
00:22:20,530 --> 00:22:22,670
My email is also at the end of the slide deck.

283
00:22:22,670 --> 00:22:26,410
Happy to answer any questions there, too, or on Discord or wherever.

284
00:22:26,510 --> 00:22:26,750
Yeah.

285
00:22:26,750 --> 00:22:32,290
Do you have any additional, like, resources you can share with us that we can just drop into track one?

286
00:22:32,290 --> 00:22:35,490
Anything that people might be interested in further research?

287
00:22:35,490 --> 00:22:36,170
Yeah, definitely.

288
00:22:36,170 --> 00:22:38,350
I'll share links to those academic papers.

289
00:22:38,430 --> 00:22:47,730
There's also a preprint paper talking about the proxy that hasn't been published yet, but is generally the idea of what we're trying to get published.

290
00:22:48,090 --> 00:22:56,610
And so if anyone has ideas to contribute to that GitHub repository, or has noticed mistakes that I've made because I'm not a network programmer, feel free to pop up an issue on GitHub.

291
00:22:56,930 --> 00:22:57,930
That's great.

292
00:23:00,990 --> 00:23:03,790
RPTK2015 says, how did you get to this project?

293
00:23:03,790 --> 00:23:06,070
Like, what was your path to get here?

294
00:23:06,570 --> 00:23:09,370
Yeah, so it was all those earlier talks from...

295
00:23:09,370 --> 00:23:12,710
so there was the researchers in 2005, which was kind of academic.

296
00:23:12,710 --> 00:23:16,850
And then there were two talks at Black Hat DC in 2009 and 2010.

297
00:23:16,890 --> 00:23:20,910
And I was just fascinated by that as something that could be done.

298
00:23:20,910 --> 00:23:23,790
And seeing what's changed was really the starting off point.

299
00:23:23,790 --> 00:23:26,910
And then it started out as literally just a summer mini project.

300
00:23:26,910 --> 00:23:34,890
It was supposed to be six weeks, but we found so much information in those six weeks, that I've sort of pivoted my PhD research around this satellite communications.

301
00:23:34,890 --> 00:23:39,470
And everywhere we look, it just gets more and more fascinating, and honestly, worse and worse.

302
00:23:40,850 --> 00:23:42,170
Fair enough.

303
00:23:42,690 --> 00:23:50,070
So here between us, just between friends, can you tell us what was the most interesting piece of traffic that you kind of stumbled across?

304
00:23:50,430 --> 00:23:51,550
Oh, that's so hard.

305
00:23:51,550 --> 00:23:54,690
I mean, it's really a different definition of interesting, right?

306
00:23:54,690 --> 00:23:57,290
Like, I forget if I mentioned this in my briefing or not.

307
00:23:57,290 --> 00:24:07,830
But for example, there were two friends, one guy was on a plane, one guy was on the ground, just chatting about some wild dream they had, where this guy's mom popped up in a burning building and started trying to feed him.

308
00:24:07,850 --> 00:24:10,890
And so you get all this real, you know, it's real people who are affected.

309
00:24:10,890 --> 00:24:14,550
And then, I mentioned being able to track this billionaire's yacht, right?

310
00:24:14,550 --> 00:24:24,310
And that's kind of a different world to know what the people in the yacht are eating for lunch that day, based off of the web APIs that they're using to manage their food system.

311
00:24:24,550 --> 00:24:27,810
And so it's just a different world of security problems.

312
00:24:27,810 --> 00:24:33,210
I don't think being able to listen to the internet is something a hacker expects to get from any perspective.

313
00:24:33,310 --> 00:24:39,090
And the fact that it's so inexpensive and easy in a satellite world is, I think, especially concerning.

314
00:24:39,950 --> 00:24:44,310
Yeah, but definitely, like, yeah, not great.

315
00:24:46,770 --> 00:24:52,090
We do have someone calling out that this is one of the coolest talks that they've gotten to see.

316
00:24:52,090 --> 00:24:53,110
Oh, I'm flattered.

317
00:24:53,110 --> 00:24:55,990
Yeah, it was a really good talk.

318
00:24:55,990 --> 00:24:59,790
And I'm definitely glad that I got to do this QA session with you.

319
00:25:00,350 --> 00:25:03,790
It was fun research to do, so I enjoyed it.

320
00:25:03,790 --> 00:25:12,110
Have you talked to any of the... I know there's some projects for, like, reviving old satellites and talking with them.

321
00:25:12,110 --> 00:25:13,730
Have you talked with those guys at all?

322
00:25:13,730 --> 00:25:22,350
And it's like, they might have, like, additional knowledge about, like, talking to satellites or different research projects that you might be interested in doing.

323
00:25:23,050 --> 00:25:23,990
No, I haven't done that.

324
00:25:23,990 --> 00:25:26,090
But it is a very, very related field, right?

325
00:25:26,090 --> 00:25:32,270
Because to some extent, reverse engineering a satellite that you can't touch is the same as exploiting one.

326
00:25:32,270 --> 00:25:36,950
A lot of the cases, it's really understanding the systems as the entirety of the security properties.

327
00:25:37,330 --> 00:25:40,190
And so, yeah, that's definitely a fascinating area I'd want to explore.

328
00:25:40,190 --> 00:25:46,590
Yeah, I do know that they've also gotten special permission to do a bunch of transmissions to satellites.

329
00:25:46,590 --> 00:25:47,510
That's part of it.

330
00:25:47,510 --> 00:25:49,330
That's part of the revival stuff.

331
00:25:49,830 --> 00:25:57,450
So, yeah, that was... they did a talk, I want to say, two years ago about MicMoon, which was their headquarters for satellite communications.

332
00:25:58,090 --> 00:25:59,050
That's awesome.

333
00:25:59,050 --> 00:25:59,770
Yeah.

334
00:26:06,560 --> 00:26:11,080
Some people are making references to DOCSIS work from earlier DEF CONs.

335
00:26:11,080 --> 00:26:16,100
I don't know how... if that's necessarily related, because DOCSIS is a cable protocol.

336
00:26:17,180 --> 00:26:19,200
Yeah, I don't know anything about it.

337
00:26:19,200 --> 00:26:21,520
So if it is related, I completely missed it.

338
00:26:22,140 --> 00:26:24,640
Definitely something for someone else to contribute.

339
00:26:26,760 --> 00:26:32,340
And The Geek is asking about new radio and SDR again, which we did briefly cover.

340
00:26:33,740 --> 00:26:34,640
But so...

341
00:26:34,640 --> 00:26:36,040
Yeah, I think it's possible.

342
00:26:36,040 --> 00:26:37,980
I think it's just a little bit harder.

343
00:26:37,980 --> 00:26:44,340
These things are pre-made and just easier to use and so widely available, but it's easier to just pick up a satellite tuner yourself.

344
00:26:44,340 --> 00:26:44,960
Yeah.

345
00:26:46,480 --> 00:26:47,780
Makes sense.

346
00:26:50,420 --> 00:26:57,420
I think you're getting high compliments from Mav there, talking about how this feels very much like, you know, the old Alexa Park content.

347
00:26:57,420 --> 00:27:00,100
So, wow, people are loving this.

348
00:27:01,040 --> 00:27:02,160
I'm really flattered.

349
00:27:02,160 --> 00:27:03,720
Yeah, it was cool stuff to do.

350
00:27:03,720 --> 00:27:07,280
It was a little frightening at times, but really enjoyable research.

351
00:27:07,280 --> 00:27:10,960
And I think space is a place people haven't done a lot of exploring.

352
00:27:10,960 --> 00:27:21,160
I mean, there obviously are other people before me, but I think there's a lot of low-hanging fruit for people who are interested in kind of living the days when hacking was maybe not easy, but terrifying.

353
00:27:22,700 --> 00:27:23,920
Well done.

354
00:27:27,880 --> 00:27:28,460
All right.

355
00:27:28,460 --> 00:27:31,180
Well, we're approaching the end of the session.

356
00:27:31,280 --> 00:27:35,440
Any final shout outs or anything you want to do before we sign off?

357
00:27:35,800 --> 00:27:43,760
One other thing I might hit on, as I mentioned, electronic flight bags in the talk as kind of an interesting component of the aviation stuff.

358
00:27:43,760 --> 00:27:50,160
I didn't know it at the time when I was recording the talk, but there were actually two village talks on electronic flight bags.

359
00:27:50,500 --> 00:27:55,180
One happened yesterday by Matt Gaffney, and I thought it was really cool.

360
00:27:55,180 --> 00:27:57,880
And then there's one tonight by David Robinson.

361
00:27:57,880 --> 00:28:03,060
So if you're interested in kind of the aviation side and what it might mean to hack an EFB, I definitely recommend checking those out.

362
00:28:03,060 --> 00:28:04,080
I know I will be.

363
00:28:04,080 --> 00:28:04,880
That's awesome.

364
00:28:04,920 --> 00:28:11,580
And I think that at least the vast majority of our village talks are also being recorded and put on YouTube.

365
00:28:11,580 --> 00:28:14,200
I don't know if that village is.

366
00:28:14,540 --> 00:28:16,580
It's an opt-in, opt-out kind of thing.

367
00:28:16,580 --> 00:28:17,600
So it's up to everyone.

368
00:28:18,240 --> 00:28:21,000
But it may already be available on YouTube.

369
00:28:21,000 --> 00:28:25,700
The one yesterday may already be available on YouTube for people if they want to go watch it as well.

370
00:28:28,540 --> 00:28:29,080
Okay.

371
00:28:29,080 --> 00:28:31,600
Well, thank you very much for joining us for this QA session.

372
00:28:31,600 --> 00:28:34,700
Thank you for making such great content for DEF CON.

373
00:28:36,040 --> 00:28:38,240
Thank you for being part of our virtual experience.

374
00:28:39,540 --> 00:28:40,000
Thanks.

375
00:28:40,000 --> 00:28:40,760
It was great.

376
00:28:40,760 --> 00:28:42,200
Great talking to you all.

377
00:28:42,200 --> 00:28:43,840
All right.