Oh my gosh. Talking. Come on, stream. Come on. All right. And we're live. All right.
We're here today with another speaker, talking about sniffing satellite traffic, whispers
among the stars, with James Pavor. Pavor? I didn't actually...
Yeah, Pavor.
Pavor. Got it right. Yeah. All right.
We'll be taking questions in the track one live QA. Do you want to give a quick summary
of your talk for anybody that might not have gotten a chance to see your talk right off the bat?
Yeah, sure. So the quick recap of the talk is that if you use kind of simple home television
equipment, you can intercept these radio waves coming off of satellites in geostationary orbit
that are providing internet service. And what we found is that these internet services are often
unencrypted at the internet service provider level, which means you get to see all kinds
of nifty traffic. We looked at it from a bunch of different perspectives. We saw traffic going
to like cargo ships and oil rigs in the ocean or to airplanes in the sky or to like wind turbines
on the ground. And across all of these domains, the talk kind of delves a little deeper into what
an attacker might do with that information or how they might abuse these signals to cause harm.
And then it concludes by talking about ways we can fix it by coming up with alternatives to
VPNs, which tend to be very slow on a satellite connection.
Awesome. So we do have our first question with RPTK2015, MVP question asker.
In your talk, you made an active attack by impersonating a ship response. I assume this
requires you to spoof your source address, but ingress filtering ISPs is supposed to prevent
IP spoofing. Can you please explain how you still did it?
Yeah, it's a great question. I'm not actually sure how that happened from an ingress filtering
perspective. I guess the answer would be that it looks like they weren't filtering correctly
because we were able to spoof in one specific network. It's worth noting, though, that the
vast majority of satellite networks we looked at were not trivially vulnerable to TCP session
hijacking because of the way that the sequence numbers were changed by those performance
enhancing proxies I talk about in my presentation. So there are only a handful of networks that were
directly vulnerable, and they seemed almost designed so that each operator's IP address
was a direct gateway to the internet, which might be why the individual customers
weren't checking IP addresses for spoofing.
Fair enough. So if they were peering directly into the backbone of the internet, they might just
trust that it's coming from a legitimate source already or already been filtered?
Yeah.
Cool.
I think Hawkeye asked one that would really fall in line with this. Why do you believe that
these high-profile enterprise SATCOM customers haven't adopted and implemented a simple
encryption-in-transit policy to stop this kind of spoofing?
So there are a couple of reasons. I think one is that, like I mentioned in the talk,
VPNs are really slow, and that's what a lot of people think an encryption-in-transit policy
would look like. And because of the way that VPNs interact with the internet service provider
offerings, they often end up seeing this kind of false tradeoff between privacy and performance.
That said, there are a lot of these enterprise customers. And when we reached out to them with
responsible disclosure, the answer would be that they kind of tried to implement a TLS everywhere
policy. But you're talking about kind of massive networks, like hundreds of ships at sea. And so
there are a lot of systems that are just forgotten, like legacy FTP services or services that they
think are behind some sort of firewall. And so they're willing to accept the risk without realizing
that that risk includes a wireless eavesdropping threat.
Yeah. And some of those ships have a lot of systems that are just unknown. Like a contractor
installed them at some point, they just got lost or forgotten and still plugged into a network in
there somewhere. Yeah, definitely.
So in your talk, you mentioned the performance-improving proxies. And
what I didn't understand was that that was something that would be run by the actual
operator. Is that right?
Yeah. So almost always that's the case. There's no like technical reason a customer couldn't
bring their own performance-enhancing proxy. But generally, satellite internet service providers
are acting as kind of benevolent eavesdroppers on your TCP sessions. And they're kind of messing
with your TCP three-way handshake to make your traffic faster. And that's just kind of part of
how they see providing customers with sufficiently performance satellite internet services.
Got it. You want to throw a question out there, Elle?
You know, I was... sorry. You had a lot of feedback on YouTube. And a lot of what I'm
seeing now is people going, could you do it with this? Could you do it with that?
And I know you gave a bit of an outline at the beginning of your talk on how you did it.
If somebody wanted to replicate this, play along with it, could you kind of give an outline,
you know, from beginning down to software, what they would need to just start out with?
Yeah, definitely. So I think the core bits that you need are some sort of satellite dish that's
capable of receiving satellite television. We researched the KU band, but there's no reason
you couldn't do it in the KA or C frequency bands as well. And then you need some kind
of way to interpret what that dish is saying on your computer. We use this specific kind
of professional grade PCIe card, which I think the model number is on the slide deck.
But you could actually get away with a bunch of like much less expensive cards.
The problem with that is that you won't be able to listen to some of the more interesting signals,
which use like 32 APSK modulation and seem to do really poorly. There are also some USB cards.
So you could do this with a laptop. You don't have to like build out a satellite spying computer
to be able to play with this stuff. From a software perspective, the tool that I show in
the actual like little demo video is I think what I would recommend first. It's called EBS Pro,
and it's designed for feed hunting. And it's really intuitive and has an interface that's
easy to use. If you're on the Linux side, the tooling is, I think, significantly worse.
So it might be worth spinning up a Windows VM to do this stuff. The other big tool in the space
is something called Crazy Scan, which is around on some of these like satellite television feed
hunting forums. And then once you have all of that lined up, if you're listening to older protocols,
so the MPEG-TS standard, Wireshark can actually just interpret those feeds directly.
If you're listening to newer protocols, you have to kind of parse the traffic dumps.
Unfortunately, the tool I talk about in my presentation is still awaiting our chance to
publish it as we're trying to be careful not to release an attack tool into the wild before
systems are patched. But we were able to build it using the Python library called KyTy, which is
used for like parsing various protocol formats. And so it wouldn't be that hard to kind of put
together your own GSE parser. Do you know what the signal width is on these? What grade of software
defined radio would you need to be able to receive these signals? That's a great question. I actually
have no idea. I know that on the DVBS side of the software defined radio community, I kind of
delved into this a tiny bit. And it looks like being able to keep up with these more complicated
modulation schemes is not something that your kind of standard SDR software is able to do.
Whereas these kind of like PCIe cards, I think they often use like specialized FPGAs for the
signal processing and are just better at it. I had two follow-ups on the previous question.
Somebody was asking, which I find funny, is if you're using kind of like the old dish network
up on your ceiling, do you need to go up there and kind of reorient the dish?
Yeah, so that was actually a big frustration for us because it turns out that I don't have any fine
motor skills. So there were like several hours between each satellite of me like swearing at
various bits of hardware on the roof. So what we ended up doing is purchasing this thing called the
DISEC motor, which allows you to steer a satellite dish across the horizon. And you can actually just
put in the specific location in geostationary orbit you want and direct it that way. It increased
the cost of the attack a little bit, but because we were looking at I think 18 satellites in total,
being able to hop between them without crawling onto the roof every time was a big benefit.
I can imagine. So the parts that you had listed in your talk were between like 300 and 400. What
was the like extra cost of that automated rotor? I don't remember off the top of my head. I want
to say it's around $100. You need to be careful that you get one that correctly mounts to the
dish you have, because different ones have different ways of attaching. So it's a little bit
less easy to just buy one off the shelf, but it's definitely doable.
Yeah, I've done some ham radio stuff with with aiming antennas, and it's always kind of
up in the air whether it's going to work or not.
Have you documented any of this like in a blog, you know, a GitHub, whatever it is that you're using?
Yeah, so there are two academic papers that I can put into the chat afterwards that talk about
our domain studies onto terrestrial users and maritime users. And those go into a lot more
detail. In particular, if you were interested in replicating the GSE extract tool, the appendix of
the maritime paper goes into a lot of depth on like how we actually parse the GSE packets and
how we deal with the corruption in the signals that we were getting.
Did you have a paper associated with the avionics stuff as well? Or is that just...
No, that's new for the Hacker Summer Camp. So that was new stuff. We're still... I think once
aviation picks up a little bit more, we can get consistent data, we may try to publish something
that's a little bit more robust. But because it was kind of a toss in the air as to whether or
not there would be a plane out that day, we didn't have as much data as we wanted.
Yeah, I mean, one of my next questions was going to be like, what are the future research look like
for you? Sounds like that's that's one of them. You got anything else like coming down the pipe
that you want to do with this kind of thing?
Yeah, so I mean, we're still looking at that proxy that I mentioned at the end of the paper.
So that's kind of going through peer review right now. It's always hard to kind of convince
academic peer reviewers that something can be both simple and novel. So who knows how that's
going to turn out in the end, but it's on GitHub. And we're kind of working to make that something
that people can hack on and use. And then I'm also interested in satellite security in general.
I'll be talking at the Aerospace Village tomorrow for a little bit on other threat models to
around like space debris tracking. And so just generally hacking satellites is kind of my focus
area. Sounds like a whole lot of fun. I think we were. Yeah. Is there a satellite hacking village
going on right now? Yeah. So the Aerospace Village is doing both aviation like last year,
and then they've got all kinds of new talks on satellites this year. Yeah, I knew there
was supposed to be a special event this year, but we went virtual. So maybe next year.
Hawkeye is asking, is there any reason you didn't go with a parabolic antenna in your research?
It seems that the gain might increase with one. Yeah, I think the gain would definitely increase
with one. The reason we use that self-sat flat panel is just literally because of the shape
of the area we were trying to fit it in with a bunch of other things up there. And it was just
the one that we ordered fastest. But I think that a curved dish would do better and would be cheaper.
Cool. I think it might be being addressed in the village, but one of the questions on YouTube was,
you know, you've talked about how you pull down information. What is the likelihood that you could
push up commands as well? And you know, started kind of attacking, well not even attacking, but
just impacting what you're seeing. So I haven't looked a ton at transmitting on these internet
feeds, and if there's any authentication there, in part because it's just harder to get a license
to transmit than a license to listen. But that said, if you wanted to engage in like attacks
against the telemetry link for the satellite, so actually steer the satellite and stuff,
a lot of those communications happen in different frequency bands. In particular, S-band is kind of
the dominant satellite telemetry band, and that would require completely different hardware and
use different protocols. That said, the general threat model of like being within kind of this
massive footprint areas, I think would still be relevant to think about in that context.
Cool. We've actually got a fair number of questions that we've backed up. I'm sorry,
guys, I'm not trying to ignore your questions. Let's see here. Since this is just a dbb-s
or dbb-s2, why not use one of the bazillion conditional access system solutions used for
video broadcast? That's a great question. I didn't even... oh, so you're talking about the like
streamwise encryption. That's something that I talk about a little bit in one of the papers. I
think these protocols are not well designed from a cryptographic perspective at all. There have
been a lot of vulnerabilities found in them, especially the proprietary ones, which seem
popular probably because they have a good marketing link behind them. But also kind of
doing a stream level encapsulation like these protocols do works great for television where
you don't want everyone watching a proprietary video feed, but it doesn't work well because
anyone who has the keys can listen to their neighbor's traffic. And you'll often have one
satellite transponder that's carrying the traffic of 20, 30, 50 users. And so it decreases the threat
model a lot and it's a big improvement, but it doesn't fix the underlying issues. And you mentioned
another solution that was sort of a replacement for the MPEG, which had been
jury-rigged to sort of take IP traffic. Does that have like the same level of like research
involved in it? Is the same level of like vulnerabilities or something like that? I know
that you're doing like probabilistic extraction of data from it, but... Yeah, so the MPEG standards
that are used for sending internet these days, there's something called multi-protocol encapsulation
or MPE and ultra lightweight encapsulation, I think, or ULE. And we looked at both of those.
Wireshark has built-in support for them. So the threat model is fairly trivial there if you can
get a good recording. What's interesting about the MPEG context though is that building your
own parser is a real pain because it's not a format that was designed for sending data,
much less secure data. And so it's an incredibly complicated and convoluted way of getting IP
packets from one place to another. I believe it. All those old things that are just like,
oh yeah, I'm sure we could fit this data in here somewhere. It'll work, right?
One of the questions I saw on YouTube is, you know, you talked in your talk about how a lot
of these are using, you know, old devices, obviously, old operating systems. And I don't
know how much you went into the past, but what they were wanting to know is have you seen any
progression in what they're trying to do to actually protect this data? Or is it just been
the same historically? Yeah. So there are companies out there that offer encrypted satellite internet
services. It's often something a customer has to pay extra for or accept like significant
performance degradation in the form of the VPN. One big product in this area is made by NewTek.
It's called Enhanced TCP or ETCP. There was a WikiLeaks document a few years ago that talked
about how there were built-in backdoors for law enforcement and intelligence agencies,
which is always the risk with using kind of these proprietary standards. But there definitely is an
initiative in parts of the industry to encrypt traffic. I think it's just one of those things
where the commercial incentives don't align with the need for customers.
So I just want to like, we previously talked about your performance improving proxy, which
you mentioned uses QUIC. There is, is there any potential benefits of just like using WireGuard
instead of like, it's another VPN. It's like you directly compare OpenVPN. WireGuard is supposed
to like, it's simpler. It's using UDP sessions, should be faster round trip. Is there, did you
look at that in comparison before you started working on your own QUIC proxy?
That's a great question. So we didn't test WireGuard specifically, although I would point
out so that GitHub repository that's linked at the end of the talk for QPAP is actually a generic
purpose like Docker test bed, where you could easily install whatever VPN you want and simulate
the satellite link. That said, I think that a UDP-based VPN like WireGuard will still hide the
TCP three-way handshake. So also send those ACK messages across the satellite link. And so it
might be a little bit faster, like starting the VPN session, but the encapsulated traffic is still
going to be hidden from the ISP. And so they can't optimize it correctly. So you really need to split
out the TCP sessions on the ground first, which most VPNs don't do because it'd be a little silly.
Right. Fair. Yeah. And WireGuard is designed so that they specifically can't see those TCP sessions
or what's inside. Right. So kind of changing pace, sorry, talking and reading at the same time.
Have you looked into Starlink? I know it's a pretty hot topic that's going on right now.
See if they are actively using any kind of encryption or anything else like that.
So I haven't tested anything related to Starlink yet, although that's definitely... you talked
about like areas I'd be interested in the future. That's definitely an exciting topic.
Starlink is in low Earth orbit, which does change the dynamics a lot because the satellites are
closer. You don't have the same problems with TCP through a handshakes, which means that using a VPN
is generally viable because the latency is much lower. Although certain conditions can change that
if you have to make a lot of hops across the constellation. So I think that it would be easier
for SpaceX to implement an encrypted service than it would be for some of these geostationary
providers. Whether or not they do that remains to be seen. Fair enough. And like the receiving
traffic, it's like because they're in lower Earth orbit, they're going to have a much smaller
footprint. Yeah, that's a great point. Like the Iridium low Earth orbit constellation, each of
the satellites passes across the horizon in like seven minutes. So the area that an attacker could
be is still too large, right? It's dozens of miles, hundreds of miles, but it's nowhere near
comparable to a different continent. Yeah. Were you looking at like Iridium satellites as like
your testbed? Like you didn't mention actually which satellites were involved. Yeah, so we
didn't look at Iridium because it's a low Earth orbiting constellation. We made the decision not
to name specific satellite operators for like legal reasons, but they were geostationary
providers that were Europe. Yeah. I've always found the Iridium satellites, like the story
behind the Iridium satellite, super interesting. Like it's just like a fascinating evolution out
of Motorola. Yeah. Yeah. I was wondering, like as the, you know, I guess end result, if I'm up on
the airplane on a cruise ship and I decide to pay for internet and I'm getting things like text
messages, what can I do to protect the status? Something like a VPN enough to impact my protection?
So the text message case, I think you're kind of, you're kind of in a bad spot, whatever you do,
because that's over the femtocells and you don't have a ton of control over what their
backend looks like. But for emails and stuff, so many people, more people than ever should be,
were using just unsecure POP email inboxes and leaking deeply sensitive stuff over the feeds.
And I think just generally using like TLS for visiting websites or POP3 with TLS for
checking your inbox is a huge step up for protection. And then if you're willing to
take it a bit slower and have that latency problem, any VPN will be better than having
someone spy on your traffic, in my opinion. I think this is going to be the first year
in DEF CON's history since the wall of sheep started that they did not get plain text POP
or IMAP credentials. And that's only because they're not capturing traffic.
People attending these conferences should know at least that much.
Yeah. We're making a lot of assumptions here.
Yeah. I don't know. I feel like if you're going to a security convention, you could at least
not use POP. It's a good start.
Yeah. Is there anything else that we haven't brought up like that you might want to
talk about specifically? Anything that you might have left out of your
talk because it got cut by time that you're interested in? Anything like that?
There's not too much left. I think that one thing that I kind of highlighted in the talk
but ended up not happening is that GSE Extract is not in our GitHub repository yet.
But it's still something I'm aware of and trying to get out there for people who are
interested in checking it out. And so that's definitely something that I hope will be out
soon. Other than that, though, I think that the general idea of the talk is pretty straightforward,
right? It's that unencrypted traffic, wherever you put it, should be encrypted instead. And
satellites are especially frightening these days because of the way that their signal properties
are. But really, it's wherever you're using the internet, you don't know who's listening.
And so encrypting end-to-end and being sure that you understand kind of how that works
under the hood can go a really long way towards helping with privacy.
That's great. I know you mentioned one of the attack of using the downlink of the satellites
as a way to, like, exfiltrate data. And I know that there was one particular attack
in history that made use of this. And it was, like, somewhere in Africa. And they figured out
that someone was just driving a truck around collecting that data. Do you know anything
about the attack? It's been a year since I remember anything about that.
Yeah, so I think it was by Turla Group, which is a Russian state-affiliated, well,
depending on who you ask, state-affiliated advanced persistent threat group. And yeah,
they seem to have been using these satellite hops to make traffic just disappear over the internet.
And I think that's a really intuitive threat model, because all you have to do is be able
to send a packet to the right IP address. And you don't have to have any software
on the place that you're sending it. Really, really sneaky.
Uh-huh. So I can't think of any more questions. If anyone is out there watching the stream
is interested in asking more questions, we're still here for a couple more minutes.
Yep. My email is also at the end of the slide deck. Happy to answer any questions there,
too, or on Discord or wherever. Yeah. Do you have any additional, like,
resources you can share with us that we can just drop into track one? Anything that people might
be interested in further research? Yeah, definitely. I'll share links to those
academic papers. There's also a preprint paper talking about the proxy that hasn't been published
yet, but is generally the idea of what we're trying to get published. And so if anyone has
ideas to contribute to that GitHub repository, or has noticed mistakes that I've made because
I'm not a network programmer, feel free to pop up an issue on GitHub.
That's great. RPTK2015 says, how did you get to this project? Like,
what was your path to get here? Yeah, so it was all those earlier talks from...
so there was the researchers in 2005, which was kind of academic. And then there were two talks
at Black Hat DC in 2009 and 2010. And I was just fascinated by that as something that could be done.
And seeing what's changed was really the starting off point. And then it started out as literally
just a summer mini project. It was supposed to be six weeks, but we found so much information
in those six weeks, that I've sort of pivoted my PhD research around this satellite communications.
And everywhere we look, it just gets more and more fascinating, and honestly, worse and worse.
Fair enough. So here between us, just between friends, can you tell us what was the most
interesting piece of traffic that you kind of stumbled across?
Oh, that's so hard. I mean, it's really a different definition of interesting, right?
Like, I forget if I mentioned this in my briefing or not. But for example, there were two friends,
one guy was on a plane, one guy was on the ground, just chatting about some wild dream they had,
where this guy's mom popped up in a burning building and started trying to feed him.
And so you get all this real, you know, it's real people who are affected. And then,
I mentioned being able to track this billionaire's yacht, right? And that's kind of a different world
to know what the people in the yacht are eating for lunch that day, based off of the web APIs
that they're using to manage their food system. And so it's just a different world of security
problems. I don't think being able to listen to the internet is something a hacker expects
to get from any perspective. And the fact that it's so inexpensive and easy in a satellite world
is, I think, especially concerning. Yeah, but definitely, like, yeah, not great.
We do have someone calling out that this is one of the coolest talks that they've gotten
to see. Oh, I'm flattered. Yeah, it was a really good talk. And I'm definitely glad that I got to
do this QA session with you. It was fun research to do, so I enjoyed it. Have you talked to any of
the... I know there's some projects for, like, reviving old satellites and talking with them.
Have you talked with those guys at all? And it's like, they might have, like, additional knowledge
about, like, talking to satellites or different research projects that you might be interested in
doing. No, I haven't done that. But it is a very, very related field, right? Because to some extent,
reverse engineering a satellite that you can't touch is the same as exploiting one. A lot of
the cases, it's really understanding the systems as the entirety of the security properties.
And so, yeah, that's definitely a fascinating area I'd want to explore.
Yeah, I do know that they've also gotten special permission to do a bunch of transmissions to
satellites. That's part of it. That's part of the revival stuff. So, yeah, that was... they did a talk,
I want to say, two years ago about MicMoon, which was their headquarters for satellite communications.
That's awesome.
Yeah. Some people are making references to DOCSIS work from earlier DEF CONs. I don't
know how... if that's necessarily related, because DOCSIS is a cable protocol.
Yeah, I don't know anything about it. So if it is related, I completely missed it.
Definitely something for someone else to contribute.
And The Geek is asking about new radio and SDR again, which we did briefly cover.
But so...
Yeah, I think it's possible. I think it's just a little bit harder.
These things are pre-made and just easier to use and so widely available,
but it's easier to just pick up a satellite tuner yourself.
Yeah. Makes sense.
I think you're getting high compliments from Mav there, talking about how this feels
very much like, you know, the old Alexa Park content. So, wow, people are loving this.
I'm really flattered. Yeah, it was cool stuff to do. It was a little frightening at times, but
really enjoyable research. And I think space is a place people haven't done a lot of exploring. I
mean, there obviously are other people before me, but I think there's a lot of low-hanging
fruit for people who are interested in kind of living the days when hacking was maybe not easy,
but terrifying. Well done.
All right. Well, we're approaching the end of the session. Any final shout outs or anything
you want to do before we sign off? One other thing I might hit on,
as I mentioned, electronic flight bags in the talk as kind of an interesting component of the
aviation stuff. I didn't know it at the time when I was recording the talk, but there were actually
two village talks on electronic flight bags. One happened yesterday by Matt Gaffney,
and I thought it was really cool. And then there's one tonight by David Robinson. So if you're
interested in kind of the aviation side and what it might mean to hack an EFB, I definitely recommend
checking those out. I know I will be. That's awesome. And I think that at least the vast
majority of our village talks are also being recorded and put on YouTube. I don't know
if that village is. It's an opt-in, opt-out kind of thing. So it's up to everyone.
But it may already be available on YouTube. The one yesterday may already be available on YouTube
for people if they want to go watch it as well. Okay. Well, thank you very much for joining us
for this QA session. Thank you for making such great content for DEF CON. Thank you for being
part of our virtual experience. Thanks. It was great. Great talking to you all.
All right.