start	end	text
0	25360	Oh my gosh. Talking. Come on, stream. Come on. All right. And we're live. All right.
25770	32560	We're here today with another speaker, talking about sniffing satellite traffic, whispers
32560	36840	among the stars, with James Pavor. Pavor? I didn't actually...
36840	37880	Yeah, Pavor.
37880	41160	Pavor. Got it right. Yeah. All right.
41160	46560	We'll be taking questions in the track one live QA. Do you want to give a quick summary
46560	52960	of your talk for anybody that might not have gotten a chance to see your talk right off the bat?
53640	58920	Yeah, sure. So the quick recap of the talk is that if you use kind of simple home television
58920	63780	equipment, you can intercept these radio waves coming off of satellites in geostationary orbit
63780	67980	that are providing internet service. And what we found is that these internet services are often
67980	71600	unencrypted at the internet service provider level, which means you get to see all kinds
71600	75240	of nifty traffic. We looked at it from a bunch of different perspectives. We saw traffic going
75240	80340	to like cargo ships and oil rigs in the ocean or to airplanes in the sky or to like wind turbines
80340	84920	on the ground. And across all of these domains, the talk kind of delves a little deeper into what
84920	88820	an attacker might do with that information or how they might abuse these signals to cause harm.
88820	92480	And then it concludes by talking about ways we can fix it by coming up with alternatives to
93000	95760	VPNs, which tend to be very slow on a satellite connection.
95760	105220	Awesome. So we do have our first question with RPTK2015, MVP question asker.
106060	110800	In your talk, you made an active attack by impersonating a ship response. I assume this
110800	114640	requires you to spoof your source address, but ingress filtering ISPs is supposed to prevent
114640	118740	IP spoofing. Can you please explain how you still did it?
119060	124120	Yeah, it's a great question. I'm not actually sure how that happened from an ingress filtering
124120	127440	perspective. I guess the answer would be that it looks like they weren't filtering correctly
127900	132180	because we were able to spoof in one specific network. It's worth noting, though, that the
132180	137140	vast majority of satellite networks we looked at were not trivially vulnerable to TCP session
137140	140900	hijacking because of the way that the sequence numbers were changed by those performance
140900	145700	enhancing proxies I talk about in my presentation. So there are only a handful of networks that were
145700	150080	directly vulnerable, and they seemed almost designed so that each operator's IP address
150080	155120	was a direct gateway to the internet, which might be why the individual customers
155120	157820	weren't checking IP addresses for spoofing.
158620	162740	Fair enough. So if they were peering directly into the backbone of the internet, they might just
163520	167460	trust that it's coming from a legitimate source already or already been filtered?
167740	168320	Yeah.
169340	170300	Cool.
170740	176980	I think Hawkeye asked one that would really fall in line with this. Why do you believe that
176980	182100	these high-profile enterprise SATCOM customers haven't adopted and implemented a simple
182100	185520	encryption-in-transit policy to stop this kind of spoofing?
186480	190580	So there are a couple of reasons. I think one is that, like I mentioned in the talk,
190580	194540	VPNs are really slow, and that's what a lot of people think an encryption-in-transit policy
194540	198380	would look like. And because of the way that VPNs interact with the internet service provider
198380	204920	offerings, they often end up seeing this kind of false tradeoff between privacy and performance.
204920	208680	That said, there are a lot of these enterprise customers. And when we reached out to them with
208680	213540	responsible disclosure, the answer would be that they kind of tried to implement a TLS everywhere
213540	218460	policy. But you're talking about kind of massive networks, like hundreds of ships at sea. And so
218460	222780	there are a lot of systems that are just forgotten, like legacy FTP services or services that they
222780	226920	think are behind some sort of firewall. And so they're willing to accept the risk without realizing
226920	229560	that that risk includes a wireless eavesdropping threat.
230120	236600	Yeah. And some of those ships have a lot of systems that are just unknown. Like a contractor
236600	241260	installed them at some point, they just got lost or forgotten and still plugged into a network in
241260	243720	there somewhere. Yeah, definitely.
245440	250320	So in your talk, you mentioned the performance-improving proxies. And
251500	255440	what I didn't understand was that that was something that would be run by the actual
255440	256860	operator. Is that right?
257900	262820	Yeah. So almost always that's the case. There's no like technical reason a customer couldn't
262820	268080	bring their own performance-enhancing proxy. But generally, satellite internet service providers
268080	273280	are acting as kind of benevolent eavesdroppers on your TCP sessions. And they're kind of messing
273280	277160	with your TCP three-way handshake to make your traffic faster. And that's just kind of part of
277160	282020	how they see providing customers with sufficiently performance satellite internet services.
282020	290270	Got it. You want to throw a question out there, Elle?
290270	295630	You know, I was... sorry. You had a lot of feedback on YouTube. And a lot of what I'm
295630	299190	seeing now is people going, could you do it with this? Could you do it with that?
299190	303270	And I know you gave a bit of an outline at the beginning of your talk on how you did it.
303270	307430	If somebody wanted to replicate this, play along with it, could you kind of give an outline,
307430	311430	you know, from beginning down to software, what they would need to just start out with?
311850	317410	Yeah, definitely. So I think the core bits that you need are some sort of satellite dish that's
317410	322250	capable of receiving satellite television. We researched the KU band, but there's no reason
322250	327130	you couldn't do it in the KA or C frequency bands as well. And then you need some kind
327130	331170	of way to interpret what that dish is saying on your computer. We use this specific kind
331170	335470	of professional grade PCIe card, which I think the model number is on the slide deck.
335570	339690	But you could actually get away with a bunch of like much less expensive cards.
339810	343030	The problem with that is that you won't be able to listen to some of the more interesting signals,
343030	349050	which use like 32 APSK modulation and seem to do really poorly. There are also some USB cards.
349230	353070	So you could do this with a laptop. You don't have to like build out a satellite spying computer
353530	358570	to be able to play with this stuff. From a software perspective, the tool that I show in
358570	363430	the actual like little demo video is I think what I would recommend first. It's called EBS Pro,
363430	367630	and it's designed for feed hunting. And it's really intuitive and has an interface that's
367630	372130	easy to use. If you're on the Linux side, the tooling is, I think, significantly worse.
372690	377150	So it might be worth spinning up a Windows VM to do this stuff. The other big tool in the space
377150	382130	is something called Crazy Scan, which is around on some of these like satellite television feed
382130	387350	hunting forums. And then once you have all of that lined up, if you're listening to older protocols,
387350	392150	so the MPEG-TS standard, Wireshark can actually just interpret those feeds directly.
392230	396490	If you're listening to newer protocols, you have to kind of parse the traffic dumps.
396550	400570	Unfortunately, the tool I talk about in my presentation is still awaiting our chance to
400570	404170	publish it as we're trying to be careful not to release an attack tool into the wild before
404170	410030	systems are patched. But we were able to build it using the Python library called KyTy, which is
410030	414530	used for like parsing various protocol formats. And so it wouldn't be that hard to kind of put
414530	423970	together your own GSE parser. Do you know what the signal width is on these? What grade of software
423970	429770	defined radio would you need to be able to receive these signals? That's a great question. I actually
429770	435470	have no idea. I know that on the DVBS side of the software defined radio community, I kind of
435470	439670	delved into this a tiny bit. And it looks like being able to keep up with these more complicated
439670	446050	modulation schemes is not something that your kind of standard SDR software is able to do.
446710	451250	Whereas these kind of like PCIe cards, I think they often use like specialized FPGAs for the
451250	458510	signal processing and are just better at it. I had two follow-ups on the previous question.
458510	462150	Somebody was asking, which I find funny, is if you're using kind of like the old dish network
462150	465850	up on your ceiling, do you need to go up there and kind of reorient the dish?
466490	470590	Yeah, so that was actually a big frustration for us because it turns out that I don't have any fine
470590	475170	motor skills. So there were like several hours between each satellite of me like swearing at
475170	479750	various bits of hardware on the roof. So what we ended up doing is purchasing this thing called the
479750	485210	DISEC motor, which allows you to steer a satellite dish across the horizon. And you can actually just
485210	489930	put in the specific location in geostationary orbit you want and direct it that way. It increased
489930	494490	the cost of the attack a little bit, but because we were looking at I think 18 satellites in total,
494490	498450	being able to hop between them without crawling onto the roof every time was a big benefit.
498450	505010	I can imagine. So the parts that you had listed in your talk were between like 300 and 400. What
505010	509910	was the like extra cost of that automated rotor? I don't remember off the top of my head. I want
509910	514690	to say it's around $100. You need to be careful that you get one that correctly mounts to the
514690	518190	dish you have, because different ones have different ways of attaching. So it's a little bit
518690	522350	less easy to just buy one off the shelf, but it's definitely doable.
522550	528450	Yeah, I've done some ham radio stuff with with aiming antennas, and it's always kind of
528450	530850	up in the air whether it's going to work or not.
533050	538870	Have you documented any of this like in a blog, you know, a GitHub, whatever it is that you're using?
539170	544230	Yeah, so there are two academic papers that I can put into the chat afterwards that talk about
544230	549930	our domain studies onto terrestrial users and maritime users. And those go into a lot more
549930	556150	detail. In particular, if you were interested in replicating the GSE extract tool, the appendix of
556150	561250	the maritime paper goes into a lot of depth on like how we actually parse the GSE packets and
561250	564190	how we deal with the corruption in the signals that we were getting.
564590	569350	Did you have a paper associated with the avionics stuff as well? Or is that just...
569350	575090	No, that's new for the Hacker Summer Camp. So that was new stuff. We're still... I think once
575090	579170	aviation picks up a little bit more, we can get consistent data, we may try to publish something
579170	583050	that's a little bit more robust. But because it was kind of a toss in the air as to whether or
583050	586750	not there would be a plane out that day, we didn't have as much data as we wanted.
586910	591410	Yeah, I mean, one of my next questions was going to be like, what are the future research look like
591410	595350	for you? Sounds like that's that's one of them. You got anything else like coming down the pipe
595350	596730	that you want to do with this kind of thing?
596730	601770	Yeah, so I mean, we're still looking at that proxy that I mentioned at the end of the paper.
601770	605250	So that's kind of going through peer review right now. It's always hard to kind of convince
605250	609590	academic peer reviewers that something can be both simple and novel. So who knows how that's
609590	613230	going to turn out in the end, but it's on GitHub. And we're kind of working to make that something
613230	618310	that people can hack on and use. And then I'm also interested in satellite security in general.
618310	622830	I'll be talking at the Aerospace Village tomorrow for a little bit on other threat models to
622830	629530	around like space debris tracking. And so just generally hacking satellites is kind of my focus
629530	636830	area. Sounds like a whole lot of fun. I think we were. Yeah. Is there a satellite hacking village
636830	641790	going on right now? Yeah. So the Aerospace Village is doing both aviation like last year,
641790	645630	and then they've got all kinds of new talks on satellites this year. Yeah, I knew there
645630	651390	was supposed to be a special event this year, but we went virtual. So maybe next year.
653150	658250	Hawkeye is asking, is there any reason you didn't go with a parabolic antenna in your research?
658250	663690	It seems that the gain might increase with one. Yeah, I think the gain would definitely increase
663690	668850	with one. The reason we use that self-sat flat panel is just literally because of the shape
668850	672630	of the area we were trying to fit it in with a bunch of other things up there. And it was just
672630	678250	the one that we ordered fastest. But I think that a curved dish would do better and would be cheaper.
678950	686810	Cool. I think it might be being addressed in the village, but one of the questions on YouTube was,
686810	690910	you know, you've talked about how you pull down information. What is the likelihood that you could
690910	695730	push up commands as well? And you know, started kind of attacking, well not even attacking, but
695730	701710	just impacting what you're seeing. So I haven't looked a ton at transmitting on these internet
701710	706650	feeds, and if there's any authentication there, in part because it's just harder to get a license
706650	712470	to transmit than a license to listen. But that said, if you wanted to engage in like attacks
712470	716070	against the telemetry link for the satellite, so actually steer the satellite and stuff,
716290	721130	a lot of those communications happen in different frequency bands. In particular, S-band is kind of
721130	725310	the dominant satellite telemetry band, and that would require completely different hardware and
725310	730130	use different protocols. That said, the general threat model of like being within kind of this
730130	734630	massive footprint areas, I think would still be relevant to think about in that context.
737170	742310	Cool. We've actually got a fair number of questions that we've backed up. I'm sorry,
742310	752610	guys, I'm not trying to ignore your questions. Let's see here. Since this is just a dbb-s
752610	757710	or dbb-s2, why not use one of the bazillion conditional access system solutions used for
757710	764210	video broadcast? That's a great question. I didn't even... oh, so you're talking about the like
764210	769730	streamwise encryption. That's something that I talk about a little bit in one of the papers. I
769730	774550	think these protocols are not well designed from a cryptographic perspective at all. There have
774550	778050	been a lot of vulnerabilities found in them, especially the proprietary ones, which seem
778050	782250	popular probably because they have a good marketing link behind them. But also kind of
782250	786050	doing a stream level encapsulation like these protocols do works great for television where
786050	790350	you don't want everyone watching a proprietary video feed, but it doesn't work well because
790350	794050	anyone who has the keys can listen to their neighbor's traffic. And you'll often have one
794050	799570	satellite transponder that's carrying the traffic of 20, 30, 50 users. And so it decreases the threat
799570	804870	model a lot and it's a big improvement, but it doesn't fix the underlying issues. And you mentioned
804870	811030	another solution that was sort of a replacement for the MPEG, which had been
811030	817370	jury-rigged to sort of take IP traffic. Does that have like the same level of like research
817370	820730	involved in it? Is the same level of like vulnerabilities or something like that? I know
820730	828310	that you're doing like probabilistic extraction of data from it, but... Yeah, so the MPEG standards
828310	831870	that are used for sending internet these days, there's something called multi-protocol encapsulation
831870	838290	or MPE and ultra lightweight encapsulation, I think, or ULE. And we looked at both of those.
838290	842550	Wireshark has built-in support for them. So the threat model is fairly trivial there if you can
842550	847150	get a good recording. What's interesting about the MPEG context though is that building your
847150	851730	own parser is a real pain because it's not a format that was designed for sending data,
851730	856690	much less secure data. And so it's an incredibly complicated and convoluted way of getting IP
856690	863750	packets from one place to another. I believe it. All those old things that are just like,
863750	868110	oh yeah, I'm sure we could fit this data in here somewhere. It'll work, right?
869950	876170	One of the questions I saw on YouTube is, you know, you talked in your talk about how a lot
876170	882530	of these are using, you know, old devices, obviously, old operating systems. And I don't
882530	885810	know how much you went into the past, but what they were wanting to know is have you seen any
885810	890250	progression in what they're trying to do to actually protect this data? Or is it just been
890250	896430	the same historically? Yeah. So there are companies out there that offer encrypted satellite internet
896430	901370	services. It's often something a customer has to pay extra for or accept like significant
901370	906950	performance degradation in the form of the VPN. One big product in this area is made by NewTek.
906950	912770	It's called Enhanced TCP or ETCP. There was a WikiLeaks document a few years ago that talked
912770	916390	about how there were built-in backdoors for law enforcement and intelligence agencies,
916390	921070	which is always the risk with using kind of these proprietary standards. But there definitely is an
921070	924690	initiative in parts of the industry to encrypt traffic. I think it's just one of those things
924690	927850	where the commercial incentives don't align with the need for customers.
929210	934810	So I just want to like, we previously talked about your performance improving proxy, which
934810	942150	you mentioned uses QUIC. There is, is there any potential benefits of just like using WireGuard
942450	948030	instead of like, it's another VPN. It's like you directly compare OpenVPN. WireGuard is supposed
948030	955110	to like, it's simpler. It's using UDP sessions, should be faster round trip. Is there, did you
955110	959350	look at that in comparison before you started working on your own QUIC proxy?
959430	963930	That's a great question. So we didn't test WireGuard specifically, although I would point
963930	968890	out so that GitHub repository that's linked at the end of the talk for QPAP is actually a generic
968890	972930	purpose like Docker test bed, where you could easily install whatever VPN you want and simulate
972930	979610	the satellite link. That said, I think that a UDP-based VPN like WireGuard will still hide the
979610	984290	TCP three-way handshake. So also send those ACK messages across the satellite link. And so it
984290	989170	might be a little bit faster, like starting the VPN session, but the encapsulated traffic is still
989170	993670	going to be hidden from the ISP. And so they can't optimize it correctly. So you really need to split
993670	999010	out the TCP sessions on the ground first, which most VPNs don't do because it'd be a little silly.
999150	1003770	Right. Fair. Yeah. And WireGuard is designed so that they specifically can't see those TCP sessions
1003770	1015310	or what's inside. Right. So kind of changing pace, sorry, talking and reading at the same time.
1016130	1021470	Have you looked into Starlink? I know it's a pretty hot topic that's going on right now.
1021470	1026810	See if they are actively using any kind of encryption or anything else like that.
1027830	1032110	So I haven't tested anything related to Starlink yet, although that's definitely... you talked
1032110	1035710	about like areas I'd be interested in the future. That's definitely an exciting topic.
1036250	1040690	Starlink is in low Earth orbit, which does change the dynamics a lot because the satellites are
1040690	1045410	closer. You don't have the same problems with TCP through a handshakes, which means that using a VPN
1045950	1050890	is generally viable because the latency is much lower. Although certain conditions can change that
1050890	1054990	if you have to make a lot of hops across the constellation. So I think that it would be easier
1054990	1059770	for SpaceX to implement an encrypted service than it would be for some of these geostationary
1059770	1067010	providers. Whether or not they do that remains to be seen. Fair enough. And like the receiving
1067010	1070310	traffic, it's like because they're in lower Earth orbit, they're going to have a much smaller
1070310	1075470	footprint. Yeah, that's a great point. Like the Iridium low Earth orbit constellation, each of
1075470	1080750	the satellites passes across the horizon in like seven minutes. So the area that an attacker could
1080750	1085350	be is still too large, right? It's dozens of miles, hundreds of miles, but it's nowhere near
1085350	1090710	comparable to a different continent. Yeah. Were you looking at like Iridium satellites as like
1090710	1096330	your testbed? Like you didn't mention actually which satellites were involved. Yeah, so we
1096330	1100350	didn't look at Iridium because it's a low Earth orbiting constellation. We made the decision not
1100350	1105950	to name specific satellite operators for like legal reasons, but they were geostationary
1105950	1111290	providers that were Europe. Yeah. I've always found the Iridium satellites, like the story
1111290	1117230	behind the Iridium satellite, super interesting. Like it's just like a fascinating evolution out
1117230	1126930	of Motorola. Yeah. Yeah. I was wondering, like as the, you know, I guess end result, if I'm up on
1126930	1130710	the airplane on a cruise ship and I decide to pay for internet and I'm getting things like text
1130710	1137350	messages, what can I do to protect the status? Something like a VPN enough to impact my protection?
1137350	1142530	So the text message case, I think you're kind of, you're kind of in a bad spot, whatever you do,
1142530	1146510	because that's over the femtocells and you don't have a ton of control over what their
1146510	1152330	backend looks like. But for emails and stuff, so many people, more people than ever should be,
1152330	1158490	were using just unsecure POP email inboxes and leaking deeply sensitive stuff over the feeds.
1158490	1164170	And I think just generally using like TLS for visiting websites or POP3 with TLS for
1164170	1169050	checking your inbox is a huge step up for protection. And then if you're willing to
1169050	1173810	take it a bit slower and have that latency problem, any VPN will be better than having
1173810	1178050	someone spy on your traffic, in my opinion. I think this is going to be the first year
1178990	1184110	in DEF CON's history since the wall of sheep started that they did not get plain text POP
1184110	1187810	or IMAP credentials. And that's only because they're not capturing traffic.
1191390	1194770	People attending these conferences should know at least that much.
1195330	1199890	Yeah. We're making a lot of assumptions here.
1200310	1205230	Yeah. I don't know. I feel like if you're going to a security convention, you could at least
1205930	1209950	not use POP. It's a good start.
1209950	1216690	Yeah. Is there anything else that we haven't brought up like that you might want to
1217350	1220130	talk about specifically? Anything that you might have left out of your
1220870	1225990	talk because it got cut by time that you're interested in? Anything like that?
1226630	1233210	There's not too much left. I think that one thing that I kind of highlighted in the talk
1233210	1237730	but ended up not happening is that GSE Extract is not in our GitHub repository yet.
1237890	1241170	But it's still something I'm aware of and trying to get out there for people who are
1241170	1246090	interested in checking it out. And so that's definitely something that I hope will be out
1246090	1252010	soon. Other than that, though, I think that the general idea of the talk is pretty straightforward,
1252010	1256910	right? It's that unencrypted traffic, wherever you put it, should be encrypted instead. And
1256910	1260650	satellites are especially frightening these days because of the way that their signal properties
1260650	1265290	are. But really, it's wherever you're using the internet, you don't know who's listening.
1265290	1269150	And so encrypting end-to-end and being sure that you understand kind of how that works
1269150	1272490	under the hood can go a really long way towards helping with privacy.
1273430	1282450	That's great. I know you mentioned one of the attack of using the downlink of the satellites
1282450	1289090	as a way to, like, exfiltrate data. And I know that there was one particular attack
1289590	1293930	in history that made use of this. And it was, like, somewhere in Africa. And they figured out
1293930	1298690	that someone was just driving a truck around collecting that data. Do you know anything
1298690	1301590	about the attack? It's been a year since I remember anything about that.
1301590	1305830	Yeah, so I think it was by Turla Group, which is a Russian state-affiliated, well,
1305830	1310570	depending on who you ask, state-affiliated advanced persistent threat group. And yeah,
1310570	1315790	they seem to have been using these satellite hops to make traffic just disappear over the internet.
1315790	1319650	And I think that's a really intuitive threat model, because all you have to do is be able
1319650	1322790	to send a packet to the right IP address. And you don't have to have any software
1322790	1327330	on the place that you're sending it. Really, really sneaky.
1328090	1334810	Uh-huh. So I can't think of any more questions. If anyone is out there watching the stream
1334810	1338230	is interested in asking more questions, we're still here for a couple more minutes.
1340130	1344290	Yep. My email is also at the end of the slide deck. Happy to answer any questions there,
1344290	1349010	too, or on Discord or wherever. Yeah. Do you have any additional, like,
1349010	1354370	resources you can share with us that we can just drop into track one? Anything that people might
1354370	1357190	be interested in further research? Yeah, definitely. I'll share links to those
1357190	1363310	academic papers. There's also a preprint paper talking about the proxy that hasn't been published
1363310	1368970	yet, but is generally the idea of what we're trying to get published. And so if anyone has
1368970	1372670	ideas to contribute to that GitHub repository, or has noticed mistakes that I've made because
1372670	1376610	I'm not a network programmer, feel free to pop up an issue on GitHub.
1376930	1383950	That's great. RPTK2015 says, how did you get to this project? Like,
1383950	1389370	what was your path to get here? Yeah, so it was all those earlier talks from...
1389370	1393910	so there was the researchers in 2005, which was kind of academic. And then there were two talks
1393910	1400910	at Black Hat DC in 2009 and 2010. And I was just fascinated by that as something that could be done.
1400910	1405570	And seeing what's changed was really the starting off point. And then it started out as literally
1405570	1409630	just a summer mini project. It was supposed to be six weeks, but we found so much information
1409630	1414890	in those six weeks, that I've sort of pivoted my PhD research around this satellite communications.
1414890	1419470	And everywhere we look, it just gets more and more fascinating, and honestly, worse and worse.
1420850	1426710	Fair enough. So here between us, just between friends, can you tell us what was the most
1426710	1430070	interesting piece of traffic that you kind of stumbled across?
1430430	1434690	Oh, that's so hard. I mean, it's really a different definition of interesting, right?
1434690	1439310	Like, I forget if I mentioned this in my briefing or not. But for example, there were two friends,
1439310	1443590	one guy was on a plane, one guy was on the ground, just chatting about some wild dream they had,
1443590	1447830	where this guy's mom popped up in a burning building and started trying to feed him.
1447850	1451230	And so you get all this real, you know, it's real people who are affected. And then,
1451230	1456070	I mentioned being able to track this billionaire's yacht, right? And that's kind of a different world
1456070	1461570	to know what the people in the yacht are eating for lunch that day, based off of the web APIs
1461570	1467290	that they're using to manage their food system. And so it's just a different world of security
1467290	1470990	problems. I don't think being able to listen to the internet is something a hacker expects
1470990	1476750	to get from any perspective. And the fact that it's so inexpensive and easy in a satellite world
1476750	1484310	is, I think, especially concerning. Yeah, but definitely, like, yeah, not great.
1486770	1490910	We do have someone calling out that this is one of the coolest talks that they've gotten
1490910	1497810	to see. Oh, I'm flattered. Yeah, it was a really good talk. And I'm definitely glad that I got to
1497810	1504850	do this QA session with you. It was fun research to do, so I enjoyed it. Have you talked to any of
1504850	1512110	the... I know there's some projects for, like, reviving old satellites and talking with them.
1512110	1516670	Have you talked with those guys at all? And it's like, they might have, like, additional knowledge
1516670	1521690	about, like, talking to satellites or different research projects that you might be interested in
1521690	1527330	doing. No, I haven't done that. But it is a very, very related field, right? Because to some extent,
1527330	1532550	reverse engineering a satellite that you can't touch is the same as exploiting one. A lot of
1532550	1536950	the cases, it's really understanding the systems as the entirety of the security properties.
1537330	1540190	And so, yeah, that's definitely a fascinating area I'd want to explore.
1540190	1545910	Yeah, I do know that they've also gotten special permission to do a bunch of transmissions to
1545910	1552650	satellites. That's part of it. That's part of the revival stuff. So, yeah, that was... they did a talk,
1552650	1557450	I want to say, two years ago about MicMoon, which was their headquarters for satellite communications.
1558090	1559050	That's awesome.
1559050	1571420	Yeah. Some people are making references to DOCSIS work from earlier DEF CONs. I don't
1571420	1576100	know how... if that's necessarily related, because DOCSIS is a cable protocol.
1577180	1581520	Yeah, I don't know anything about it. So if it is related, I completely missed it.
1582140	1584640	Definitely something for someone else to contribute.
1586760	1592340	And The Geek is asking about new radio and SDR again, which we did briefly cover.
1593740	1594640	But so...
1594640	1597980	Yeah, I think it's possible. I think it's just a little bit harder.
1597980	1601600	These things are pre-made and just easier to use and so widely available,
1601600	1604340	but it's easier to just pick up a satellite tuner yourself.
1604340	1607780	Yeah. Makes sense.
1610420	1614540	I think you're getting high compliments from Mav there, talking about how this feels
1614540	1620100	very much like, you know, the old Alexa Park content. So, wow, people are loving this.
1621040	1625280	I'm really flattered. Yeah, it was cool stuff to do. It was a little frightening at times, but
1625800	1631020	really enjoyable research. And I think space is a place people haven't done a lot of exploring. I
1631020	1635120	mean, there obviously are other people before me, but I think there's a lot of low-hanging
1635120	1640040	fruit for people who are interested in kind of living the days when hacking was maybe not easy,
1640040	1643920	but terrifying. Well done.
1647880	1653140	All right. Well, we're approaching the end of the session. Any final shout outs or anything
1653140	1658060	you want to do before we sign off? One other thing I might hit on,
1658060	1662800	as I mentioned, electronic flight bags in the talk as kind of an interesting component of the
1662800	1666380	aviation stuff. I didn't know it at the time when I was recording the talk, but there were actually
1666380	1673920	two village talks on electronic flight bags. One happened yesterday by Matt Gaffney,
1673920	1678160	and I thought it was really cool. And then there's one tonight by David Robinson. So if you're
1678160	1682200	interested in kind of the aviation side and what it might mean to hack an EFB, I definitely recommend
1682200	1688120	checking those out. I know I will be. That's awesome. And I think that at least the vast
1688120	1692220	majority of our village talks are also being recorded and put on YouTube. I don't know
1692220	1697600	if that village is. It's an opt-in, opt-out kind of thing. So it's up to everyone.
1698240	1702620	But it may already be available on YouTube. The one yesterday may already be available on YouTube
1702620	1710760	for people if they want to go watch it as well. Okay. Well, thank you very much for joining us
1710760	1716820	for this QA session. Thank you for making such great content for DEF CON. Thank you for being
1716820	1722200	part of our virtual experience. Thanks. It was great. Great talking to you all.
1722200	1723840	All right.