WEBVTT 00:00.000 --> 00:00.540 Oh my gosh. 00:01.500 --> 00:02.740 Talking. 00:04.080 --> 00:05.240 Come on, stream. 00:05.240 --> 00:06.400 Come on. 00:19.520 --> 00:21.060 All right. 00:21.400 --> 00:23.260 And we're live. 00:23.980 --> 00:25.360 All right. 00:25.770 --> 00:35.540 We're here today with another speaker, talking about sniffing satellite traffic, whispers among the stars, with James Pavor. 00:35.540 --> 00:35.880 Pavor? 00:35.880 --> 00:36.840 I didn't actually... 00:36.840 --> 00:37.880 Yeah, Pavor. 00:37.880 --> 00:38.360 Pavor. 00:38.360 --> 00:39.140 Got it right. 00:39.140 --> 00:40.040 Yeah. 00:40.200 --> 00:41.160 All right. 00:41.160 --> 00:44.700 We'll be taking questions in the track one live QA. 00:44.780 --> 00:52.960 Do you want to give a quick summary of your talk for anybody that might not have gotten a chance to see your talk right off the bat? 00:53.640 --> 00:54.440 Yeah, sure. 00:54.440 --> 01:05.680 So the quick recap of the talk is that if you use kind of simple home television equipment, you can intercept these radio waves coming off of satellites in geostationary orbit that are providing internet service. 01:05.720 --> 01:12.620 And what we found is that these internet services are often unencrypted at the internet service provider level, which means you get to see all kinds of nifty traffic. 01:12.680 --> 01:14.460 We looked at it from a bunch of different perspectives. 01:14.460 --> 01:21.340 We saw traffic going to like cargo ships and oil rigs in the ocean or to airplanes in the sky or to like wind turbines on the ground. 01:21.500 --> 01:28.820 And across all of these domains, the talk kind of delves a little deeper into what an attacker might do with that information or how they might abuse these signals to cause harm. 01:28.820 --> 01:35.760 And then it concludes by talking about ways we can fix it by coming up with alternatives to VPNs, which tend to be very slow on a satellite connection. 01:35.760 --> 01:37.200 Awesome. 01:37.640 --> 01:45.220 So we do have our first question with RPTK2015, MVP question asker. 01:46.060 --> 01:50.080 In your talk, you made an active attack by impersonating a ship response. 01:50.140 --> 01:56.600 I assume this requires you to spoof your source address, but ingress filtering ISPs is supposed to prevent IP spoofing. 01:56.600 --> 01:58.740 Can you please explain how you still did it? 01:59.060 --> 02:00.500 Yeah, it's a great question. 02:00.500 --> 02:04.780 I'm not actually sure how that happened from an ingress filtering perspective. 02:04.780 --> 02:10.920 I guess the answer would be that it looks like they weren't filtering correctly because we were able to spoof in one specific network. 02:10.920 --> 02:23.700 It's worth noting, though, that the vast majority of satellite networks we looked at were not trivially vulnerable to TCP session hijacking because of the way that the sequence numbers were changed by those performance enhancing proxies I talk about in my presentation. 02:23.700 --> 02:37.820 So there are only a handful of networks that were directly vulnerable, and they seemed almost designed so that each operator's IP address was a direct gateway to the internet, which might be why the individual customers weren't checking IP addresses for spoofing. 02:38.620 --> 02:38.960 Fair enough. 02:38.960 --> 02:47.460 So if they were peering directly into the backbone of the internet, they might just trust that it's coming from a legitimate source already or already been filtered? 02:47.740 --> 02:48.320 Yeah. 02:49.340 --> 02:50.300 Cool. 02:50.740 --> 02:55.720 I think Hawkeye asked one that would really fall in line with this. 02:55.800 --> 03:05.520 Why do you believe that these high-profile enterprise SATCOM customers haven't adopted and implemented a simple encryption-in-transit policy to stop this kind of spoofing? 03:06.480 --> 03:08.140 So there are a couple of reasons. 03:08.140 --> 03:15.580 I think one is that, like I mentioned in the talk, VPNs are really slow, and that's what a lot of people think an encryption-in-transit policy would look like. 03:15.580 --> 03:24.920 And because of the way that VPNs interact with the internet service provider offerings, they often end up seeing this kind of false tradeoff between privacy and performance. 03:24.920 --> 03:27.580 That said, there are a lot of these enterprise customers. 03:27.580 --> 03:34.380 And when we reached out to them with responsible disclosure, the answer would be that they kind of tried to implement a TLS everywhere policy. 03:34.380 --> 03:38.280 But you're talking about kind of massive networks, like hundreds of ships at sea. 03:38.280 --> 03:44.520 And so there are a lot of systems that are just forgotten, like legacy FTP services or services that they think are behind some sort of firewall. 03:44.520 --> 03:49.560 And so they're willing to accept the risk without realizing that that risk includes a wireless eavesdropping threat. 03:50.120 --> 03:50.560 Yeah. 03:50.560 --> 03:55.060 And some of those ships have a lot of systems that are just unknown. 03:55.060 --> 04:02.200 Like a contractor installed them at some point, they just got lost or forgotten and still plugged into a network in there somewhere. 04:02.660 --> 04:03.720 Yeah, definitely. 04:05.440 --> 04:10.220 So in your talk, you mentioned the performance-improving proxies. 04:10.220 --> 04:16.000 And what I didn't understand was that that was something that would be run by the actual operator. 04:16.000 --> 04:16.860 Is that right? 04:17.900 --> 04:18.560 Yeah. 04:18.560 --> 04:20.560 So almost always that's the case. 04:20.560 --> 04:25.020 There's no like technical reason a customer couldn't bring their own performance-enhancing proxy. 04:25.020 --> 04:32.640 But generally, satellite internet service providers are acting as kind of benevolent eavesdroppers on your TCP sessions. 04:32.640 --> 04:36.080 And they're kind of messing with your TCP three-way handshake to make your traffic faster. 04:36.080 --> 04:42.020 And that's just kind of part of how they see providing customers with sufficiently performance satellite internet services. 04:42.020 --> 04:43.080 Got it. 04:47.970 --> 04:50.270 You want to throw a question out there, Elle? 04:50.270 --> 04:52.290 You know, I was... sorry. 04:52.370 --> 04:54.590 You had a lot of feedback on YouTube. 04:54.670 --> 04:57.990 And a lot of what I'm seeing now is people going, could you do it with this? 04:57.990 --> 04:59.190 Could you do it with that? 04:59.190 --> 05:03.270 And I know you gave a bit of an outline at the beginning of your talk on how you did it. 05:03.270 --> 05:11.430 If somebody wanted to replicate this, play along with it, could you kind of give an outline, you know, from beginning down to software, what they would need to just start out with? 05:11.850 --> 05:12.850 Yeah, definitely. 05:12.850 --> 05:19.610 So I think the core bits that you need are some sort of satellite dish that's capable of receiving satellite television. 05:19.950 --> 05:25.530 We researched the KU band, but there's no reason you couldn't do it in the KA or C frequency bands as well. 05:25.790 --> 05:29.670 And then you need some kind of way to interpret what that dish is saying on your computer. 05:29.670 --> 05:35.470 We use this specific kind of professional grade PCIe card, which I think the model number is on the slide deck. 05:35.570 --> 05:39.690 But you could actually get away with a bunch of like much less expensive cards. 05:39.810 --> 05:47.150 The problem with that is that you won't be able to listen to some of the more interesting signals, which use like 32 APSK modulation and seem to do really poorly. 05:47.150 --> 05:49.050 There are also some USB cards. 05:49.230 --> 05:50.910 So you could do this with a laptop. 05:50.910 --> 05:55.510 You don't have to like build out a satellite spying computer to be able to play with this stuff. 05:55.510 --> 06:02.110 From a software perspective, the tool that I show in the actual like little demo video is I think what I would recommend first. 06:02.110 --> 06:05.350 It's called EBS Pro, and it's designed for feed hunting. 06:05.390 --> 06:08.690 And it's really intuitive and has an interface that's easy to use. 06:08.690 --> 06:12.130 If you're on the Linux side, the tooling is, I think, significantly worse. 06:12.690 --> 06:15.730 So it might be worth spinning up a Windows VM to do this stuff. 06:15.730 --> 06:23.230 The other big tool in the space is something called Crazy Scan, which is around on some of these like satellite television feed hunting forums. 06:23.710 --> 06:32.150 And then once you have all of that lined up, if you're listening to older protocols, so the MPEG-TS standard, Wireshark can actually just interpret those feeds directly. 06:32.230 --> 06:36.490 If you're listening to newer protocols, you have to kind of parse the traffic dumps. 06:36.550 --> 06:45.570 Unfortunately, the tool I talk about in my presentation is still awaiting our chance to publish it as we're trying to be careful not to release an attack tool into the wild before systems are patched. 06:45.570 --> 06:52.470 But we were able to build it using the Python library called KyTy, which is used for like parsing various protocol formats. 06:52.470 --> 06:56.410 And so it wouldn't be that hard to kind of put together your own GSE parser. 06:56.990 --> 07:00.970 Do you know what the signal width is on these? 07:00.970 --> 07:08.010 What grade of software defined radio would you need to be able to receive these signals? 07:08.490 --> 07:09.470 That's a great question. 07:09.470 --> 07:11.030 I actually have no idea. 07:11.030 --> 07:17.190 I know that on the DVBS side of the software defined radio community, I kind of delved into this a tiny bit. 07:17.250 --> 07:26.050 And it looks like being able to keep up with these more complicated modulation schemes is not something that your kind of standard SDR software is able to do. 07:26.710 --> 07:34.010 Whereas these kind of like PCIe cards, I think they often use like specialized FPGAs for the signal processing and are just better at it. 07:35.570 --> 07:38.510 I had two follow-ups on the previous question. 07:38.510 --> 07:45.850 Somebody was asking, which I find funny, is if you're using kind of like the old dish network up on your ceiling, do you need to go up there and kind of reorient the dish? 07:46.490 --> 07:51.590 Yeah, so that was actually a big frustration for us because it turns out that I don't have any fine motor skills. 07:51.610 --> 07:57.410 So there were like several hours between each satellite of me like swearing at various bits of hardware on the roof. 07:57.410 --> 08:04.070 So what we ended up doing is purchasing this thing called the DISEC motor, which allows you to steer a satellite dish across the horizon. 08:04.230 --> 08:09.110 And you can actually just put in the specific location in geostationary orbit you want and direct it that way. 08:09.190 --> 08:18.450 It increased the cost of the attack a little bit, but because we were looking at I think 18 satellites in total, being able to hop between them without crawling onto the roof every time was a big benefit. 08:18.450 --> 08:19.630 I can imagine. 08:19.630 --> 08:24.910 So the parts that you had listed in your talk were between like 300 and 400. 08:24.910 --> 08:27.550 What was the like extra cost of that automated rotor? 08:27.970 --> 08:29.630 I don't remember off the top of my head. 08:29.630 --> 08:31.290 I want to say it's around $100. 08:31.810 --> 08:37.330 You need to be careful that you get one that correctly mounts to the dish you have, because different ones have different ways of attaching. 08:37.330 --> 08:42.350 So it's a little bit less easy to just buy one off the shelf, but it's definitely doable. 08:42.550 --> 08:50.850 Yeah, I've done some ham radio stuff with with aiming antennas, and it's always kind of up in the air whether it's going to work or not. 08:53.050 --> 08:58.870 Have you documented any of this like in a blog, you know, a GitHub, whatever it is that you're using? 08:59.170 --> 09:08.890 Yeah, so there are two academic papers that I can put into the chat afterwards that talk about our domain studies onto terrestrial users and maritime users. 09:08.930 --> 09:10.270 And those go into a lot more detail. 09:10.270 --> 09:24.190 In particular, if you were interested in replicating the GSE extract tool, the appendix of the maritime paper goes into a lot of depth on like how we actually parse the GSE packets and how we deal with the corruption in the signals that we were getting. 09:24.590 --> 09:28.790 Did you have a paper associated with the avionics stuff as well? 09:28.790 --> 09:29.350 Or is that just... 09:29.350 --> 09:31.490 No, that's new for the Hacker Summer Camp. 09:31.490 --> 09:33.390 So that was new stuff. 09:33.610 --> 09:40.650 We're still... I think once aviation picks up a little bit more, we can get consistent data, we may try to publish something that's a little bit more robust. 09:40.750 --> 09:46.750 But because it was kind of a toss in the air as to whether or not there would be a plane out that day, we didn't have as much data as we wanted. 09:46.910 --> 09:52.070 Yeah, I mean, one of my next questions was going to be like, what are the future research look like for you? 09:52.110 --> 09:53.250 Sounds like that's that's one of them. 09:53.250 --> 09:56.730 You got anything else like coming down the pipe that you want to do with this kind of thing? 09:56.730 --> 10:01.770 Yeah, so I mean, we're still looking at that proxy that I mentioned at the end of the paper. 10:01.770 --> 10:03.970 So that's kind of going through peer review right now. 10:03.970 --> 10:08.370 It's always hard to kind of convince academic peer reviewers that something can be both simple and novel. 10:08.470 --> 10:11.390 So who knows how that's going to turn out in the end, but it's on GitHub. 10:11.390 --> 10:15.190 And we're kind of working to make that something that people can hack on and use. 10:15.190 --> 10:18.310 And then I'm also interested in satellite security in general. 10:18.310 --> 10:25.350 I'll be talking at the Aerospace Village tomorrow for a little bit on other threat models to around like space debris tracking. 10:25.730 --> 10:30.350 And so just generally hacking satellites is kind of my focus area. 10:30.930 --> 10:32.490 Sounds like a whole lot of fun. 10:32.490 --> 10:34.030 I think we were. 10:34.030 --> 10:34.550 Yeah. 10:34.930 --> 10:38.170 Is there a satellite hacking village going on right now? 10:38.530 --> 10:38.730 Yeah. 10:38.730 --> 10:44.690 So the Aerospace Village is doing both aviation like last year, and then they've got all kinds of new talks on satellites this year. 10:44.690 --> 10:49.210 Yeah, I knew there was supposed to be a special event this year, but we went virtual. 10:49.430 --> 10:51.390 So maybe next year. 10:53.150 --> 10:58.250 Hawkeye is asking, is there any reason you didn't go with a parabolic antenna in your research? 10:58.250 --> 11:00.830 It seems that the gain might increase with one. 11:01.830 --> 11:04.530 Yeah, I think the gain would definitely increase with one. 11:04.790 --> 11:11.950 The reason we use that self-sat flat panel is just literally because of the shape of the area we were trying to fit it in with a bunch of other things up there. 11:11.950 --> 11:14.330 And it was just the one that we ordered fastest. 11:14.730 --> 11:18.250 But I think that a curved dish would do better and would be cheaper. 11:18.950 --> 11:19.750 Cool. 11:20.670 --> 11:29.150 I think it might be being addressed in the village, but one of the questions on YouTube was, you know, you've talked about how you pull down information. 11:29.670 --> 11:32.810 What is the likelihood that you could push up commands as well? 11:32.810 --> 11:38.250 And you know, started kind of attacking, well not even attacking, but just impacting what you're seeing. 11:38.890 --> 11:48.730 So I haven't looked a ton at transmitting on these internet feeds, and if there's any authentication there, in part because it's just harder to get a license to transmit than a license to listen. 11:49.130 --> 11:59.090 But that said, if you wanted to engage in like attacks against the telemetry link for the satellite, so actually steer the satellite and stuff, a lot of those communications happen in different frequency bands. 11:59.250 --> 12:06.670 In particular, S-band is kind of the dominant satellite telemetry band, and that would require completely different hardware and use different protocols. 12:07.310 --> 12:14.630 That said, the general threat model of like being within kind of this massive footprint areas, I think would still be relevant to think about in that context. 12:17.170 --> 12:18.050 Cool. 12:18.790 --> 12:21.890 We've actually got a fair number of questions that we've backed up. 12:21.890 --> 12:24.810 I'm sorry, guys, I'm not trying to ignore your questions. 12:28.410 --> 12:29.790 Let's see here. 12:30.070 --> 12:38.790 Since this is just a dbb-s or dbb-s2, why not use one of the bazillion conditional access system solutions used for video broadcast? 12:40.350 --> 12:41.470 That's a great question. 12:41.470 --> 12:45.730 I didn't even... oh, so you're talking about the like streamwise encryption. 12:46.170 --> 12:49.670 That's something that I talk about a little bit in one of the papers. 12:49.670 --> 12:54.470 I think these protocols are not well designed from a cryptographic perspective at all. 12:54.470 --> 13:00.950 There have been a lot of vulnerabilities found in them, especially the proprietary ones, which seem popular probably because they have a good marketing link behind them. 13:00.950 --> 13:13.050 But also kind of doing a stream level encapsulation like these protocols do works great for television where you don't want everyone watching a proprietary video feed, but it doesn't work well because anyone who has the keys can listen to their neighbor's traffic. 13:13.050 --> 13:18.330 And you'll often have one satellite transponder that's carrying the traffic of 20, 30, 50 users. 13:18.410 --> 13:23.590 And so it decreases the threat model a lot and it's a big improvement, but it doesn't fix the underlying issues. 13:24.250 --> 13:33.130 And you mentioned another solution that was sort of a replacement for the MPEG, which had been jury-rigged to sort of take IP traffic. 13:34.450 --> 13:38.030 Does that have like the same level of like research involved in it? 13:38.030 --> 13:40.530 Is the same level of like vulnerabilities or something like that? 13:40.530 --> 13:55.010 I know that you're doing like probabilistic extraction of data from it, but... Yeah, so the MPEG standards that are used for sending internet these days, there's something called multi-protocol encapsulation or MPE and ultra lightweight encapsulation, 13:55.010 --> 13:56.330 I think, or ULE. 13:56.530 --> 13:58.290 And we looked at both of those. 13:58.290 --> 13:59.970 Wireshark has built-in support for them. 13:59.970 --> 14:03.930 So the threat model is fairly trivial there if you can get a good recording. 14:04.010 --> 14:13.190 What's interesting about the MPEG context though is that building your own parser is a real pain because it's not a format that was designed for sending data, much less secure data. 14:13.430 --> 14:18.590 And so it's an incredibly complicated and convoluted way of getting IP packets from one place to another. 14:19.450 --> 14:20.610 I believe it. 14:20.770 --> 14:26.810 All those old things that are just like, oh yeah, I'm sure we could fit this data in here somewhere. 14:26.990 --> 14:28.110 It'll work, right? 14:29.950 --> 14:41.890 One of the questions I saw on YouTube is, you know, you talked in your talk about how a lot of these are using, you know, old devices, obviously, old operating systems. 14:42.070 --> 14:49.230 And I don't know how much you went into the past, but what they were wanting to know is have you seen any progression in what they're trying to do to actually protect this data? 14:49.230 --> 14:51.530 Or is it just been the same historically? 14:52.370 --> 14:52.570 Yeah. 14:52.570 --> 14:57.210 So there are companies out there that offer encrypted satellite internet services. 14:57.210 --> 15:03.930 It's often something a customer has to pay extra for or accept like significant performance degradation in the form of the VPN. 15:04.350 --> 15:06.950 One big product in this area is made by NewTek. 15:06.950 --> 15:09.830 It's called Enhanced TCP or ETCP. 15:09.930 --> 15:19.910 There was a WikiLeaks document a few years ago that talked about how there were built-in backdoors for law enforcement and intelligence agencies, which is always the risk with using kind of these proprietary standards. 15:19.970 --> 15:23.670 But there definitely is an initiative in parts of the industry to encrypt traffic. 15:23.670 --> 15:27.850 I think it's just one of those things where the commercial incentives don't align with the need for customers. 15:29.210 --> 15:36.610 So I just want to like, we previously talked about your performance improving proxy, which you mentioned uses QUIC. 15:36.950 --> 15:45.230 There is, is there any potential benefits of just like using WireGuard instead of like, it's another VPN. 15:45.230 --> 15:47.310 It's like you directly compare OpenVPN. 15:47.410 --> 15:49.450 WireGuard is supposed to like, it's simpler. 15:49.450 --> 15:53.790 It's using UDP sessions, should be faster round trip. 15:54.050 --> 15:59.350 Is there, did you look at that in comparison before you started working on your own QUIC proxy? 15:59.430 --> 16:00.590 That's a great question. 16:00.590 --> 16:14.410 So we didn't test WireGuard specifically, although I would point out so that GitHub repository that's linked at the end of the talk for QPAP is actually a generic purpose like Docker test bed, where you could easily install whatever VPN you want and simulate the satellite link. 16:14.510 --> 16:20.750 That said, I think that a UDP-based VPN like WireGuard will still hide the TCP three-way handshake. 16:20.750 --> 16:23.530 So also send those ACK messages across the satellite link. 16:23.530 --> 16:30.630 And so it might be a little bit faster, like starting the VPN session, but the encapsulated traffic is still going to be hidden from the ISP. 16:30.630 --> 16:32.210 And so they can't optimize it correctly. 16:32.310 --> 16:39.010 So you really need to split out the TCP sessions on the ground first, which most VPNs don't do because it'd be a little silly. 16:39.150 --> 16:39.450 Right. 16:39.450 --> 16:39.790 Fair. 16:39.790 --> 16:40.010 Yeah. 16:40.010 --> 16:45.210 And WireGuard is designed so that they specifically can't see those TCP sessions or what's inside. 16:45.430 --> 16:45.990 Right. 16:47.150 --> 16:55.310 So kind of changing pace, sorry, talking and reading at the same time. 16:56.130 --> 16:58.670 Have you looked into Starlink? 16:58.670 --> 17:01.470 I know it's a pretty hot topic that's going on right now. 17:01.470 --> 17:06.810 See if they are actively using any kind of encryption or anything else like that. 17:07.830 --> 17:13.890 So I haven't tested anything related to Starlink yet, although that's definitely... you talked about like areas I'd be interested in the future. 17:13.890 --> 17:15.710 That's definitely an exciting topic. 17:16.250 --> 17:21.290 Starlink is in low Earth orbit, which does change the dynamics a lot because the satellites are closer. 17:21.290 --> 17:28.530 You don't have the same problems with TCP through a handshakes, which means that using a VPN is generally viable because the latency is much lower. 17:28.570 --> 17:33.550 Although certain conditions can change that if you have to make a lot of hops across the constellation. 17:33.790 --> 17:40.670 So I think that it would be easier for SpaceX to implement an encrypted service than it would be for some of these geostationary providers. 17:40.730 --> 17:43.790 Whether or not they do that remains to be seen. 17:44.630 --> 17:45.050 Fair enough. 17:45.050 --> 17:51.210 And like the receiving traffic, it's like because they're in lower Earth orbit, they're going to have a much smaller footprint. 17:51.670 --> 17:52.750 Yeah, that's a great point. 17:52.750 --> 17:58.250 Like the Iridium low Earth orbit constellation, each of the satellites passes across the horizon in like seven minutes. 17:58.250 --> 18:02.210 So the area that an attacker could be is still too large, right? 18:02.210 --> 18:07.090 It's dozens of miles, hundreds of miles, but it's nowhere near comparable to a different continent. 18:07.090 --> 18:07.390 Yeah. 18:07.430 --> 18:11.390 Were you looking at like Iridium satellites as like your testbed? 18:11.390 --> 18:15.370 Like you didn't mention actually which satellites were involved. 18:15.870 --> 18:19.110 Yeah, so we didn't look at Iridium because it's a low Earth orbiting constellation. 18:19.270 --> 18:27.130 We made the decision not to name specific satellite operators for like legal reasons, but they were geostationary providers that were Europe. 18:27.130 --> 18:27.770 Yeah. 18:28.690 --> 18:33.710 I've always found the Iridium satellites, like the story behind the Iridium satellite, super interesting. 18:34.730 --> 18:38.090 Like it's just like a fascinating evolution out of Motorola. 18:39.010 --> 18:39.450 Yeah. 18:40.870 --> 18:41.750 Yeah. 18:42.750 --> 18:53.470 I was wondering, like as the, you know, I guess end result, if I'm up on the airplane on a cruise ship and I decide to pay for internet and I'm getting things like text messages, what can I do to protect the status? 18:53.470 --> 18:57.350 Something like a VPN enough to impact my protection? 18:57.350 --> 19:07.430 So the text message case, I think you're kind of, you're kind of in a bad spot, whatever you do, because that's over the femtocells and you don't have a ton of control over what their backend looks like. 19:07.450 --> 19:18.490 But for emails and stuff, so many people, more people than ever should be, were using just unsecure POP email inboxes and leaking deeply sensitive stuff over the feeds. 19:18.490 --> 19:27.830 And I think just generally using like TLS for visiting websites or POP3 with TLS for checking your inbox is a huge step up for protection. 19:27.830 --> 19:36.090 And then if you're willing to take it a bit slower and have that latency problem, any VPN will be better than having someone spy on your traffic, in my opinion. 19:36.110 --> 19:45.410 I think this is going to be the first year in DEF CON's history since the wall of sheep started that they did not get plain text POP or IMAP credentials. 19:45.410 --> 19:47.810 And that's only because they're not capturing traffic. 19:51.390 --> 19:54.770 People attending these conferences should know at least that much. 19:55.330 --> 19:55.770 Yeah. 19:57.370 --> 19:59.890 We're making a lot of assumptions here. 20:00.310 --> 20:01.310 Yeah. 20:01.310 --> 20:02.090 I don't know. 20:02.090 --> 20:07.490 I feel like if you're going to a security convention, you could at least not use POP. 20:08.550 --> 20:09.950 It's a good start. 20:09.950 --> 20:10.630 Yeah. 20:11.810 --> 20:18.670 Is there anything else that we haven't brought up like that you might want to talk about specifically? 20:18.670 --> 20:24.350 Anything that you might have left out of your talk because it got cut by time that you're interested in? 20:24.650 --> 20:25.990 Anything like that? 20:26.630 --> 20:28.730 There's not too much left. 20:28.730 --> 20:37.730 I think that one thing that I kind of highlighted in the talk but ended up not happening is that GSE Extract is not in our GitHub repository yet. 20:37.890 --> 20:42.350 But it's still something I'm aware of and trying to get out there for people who are interested in checking it out. 20:42.890 --> 20:46.930 And so that's definitely something that I hope will be out soon. 20:47.030 --> 20:52.230 Other than that, though, I think that the general idea of the talk is pretty straightforward, right? 20:52.230 --> 20:56.670 It's that unencrypted traffic, wherever you put it, should be encrypted instead. 20:56.710 --> 21:01.430 And satellites are especially frightening these days because of the way that their signal properties are. 21:01.590 --> 21:05.290 But really, it's wherever you're using the internet, you don't know who's listening. 21:05.290 --> 21:12.490 And so encrypting end-to-end and being sure that you understand kind of how that works under the hood can go a really long way towards helping with privacy. 21:13.430 --> 21:14.530 That's great. 21:14.890 --> 21:27.030 I know you mentioned one of the attack of using the downlink of the satellites as a way to, like, exfiltrate data. 21:27.030 --> 21:31.310 And I know that there was one particular attack in history that made use of this. 21:31.310 --> 21:32.850 And it was, like, somewhere in Africa. 21:32.850 --> 21:37.970 And they figured out that someone was just driving a truck around collecting that data. 21:37.970 --> 21:39.190 Do you know anything about the attack? 21:39.190 --> 21:41.590 It's been a year since I remember anything about that. 21:41.590 --> 21:49.790 Yeah, so I think it was by Turla Group, which is a Russian state-affiliated, well, depending on who you ask, state-affiliated advanced persistent threat group. 21:50.150 --> 21:55.790 And yeah, they seem to have been using these satellite hops to make traffic just disappear over the internet. 21:55.790 --> 22:01.330 And I think that's a really intuitive threat model, because all you have to do is be able to send a packet to the right IP address. 22:01.330 --> 22:04.890 And you don't have to have any software on the place that you're sending it. 22:06.110 --> 22:07.330 Really, really sneaky. 22:08.090 --> 22:09.070 Uh-huh. 22:09.070 --> 22:12.110 So I can't think of any more questions. 22:13.110 --> 22:18.230 If anyone is out there watching the stream is interested in asking more questions, we're still here for a couple more minutes. 22:20.130 --> 22:20.530 Yep. 22:20.530 --> 22:22.670 My email is also at the end of the slide deck. 22:22.670 --> 22:26.410 Happy to answer any questions there, too, or on Discord or wherever. 22:26.510 --> 22:26.750 Yeah. 22:26.750 --> 22:32.290 Do you have any additional, like, resources you can share with us that we can just drop into track one? 22:32.290 --> 22:35.490 Anything that people might be interested in further research? 22:35.490 --> 22:36.170 Yeah, definitely. 22:36.170 --> 22:38.350 I'll share links to those academic papers. 22:38.430 --> 22:47.730 There's also a preprint paper talking about the proxy that hasn't been published yet, but is generally the idea of what we're trying to get published. 22:48.090 --> 22:56.610 And so if anyone has ideas to contribute to that GitHub repository, or has noticed mistakes that I've made because I'm not a network programmer, feel free to pop up an issue on GitHub. 22:56.930 --> 22:57.930 That's great. 23:00.990 --> 23:03.790 RPTK2015 says, how did you get to this project? 23:03.790 --> 23:06.070 Like, what was your path to get here? 23:06.570 --> 23:09.370 Yeah, so it was all those earlier talks from... 23:09.370 --> 23:12.710 so there was the researchers in 2005, which was kind of academic. 23:12.710 --> 23:16.850 And then there were two talks at Black Hat DC in 2009 and 2010. 23:16.890 --> 23:20.910 And I was just fascinated by that as something that could be done. 23:20.910 --> 23:23.790 And seeing what's changed was really the starting off point. 23:23.790 --> 23:26.910 And then it started out as literally just a summer mini project. 23:26.910 --> 23:34.890 It was supposed to be six weeks, but we found so much information in those six weeks, that I've sort of pivoted my PhD research around this satellite communications. 23:34.890 --> 23:39.470 And everywhere we look, it just gets more and more fascinating, and honestly, worse and worse. 23:40.850 --> 23:42.170 Fair enough. 23:42.690 --> 23:50.070 So here between us, just between friends, can you tell us what was the most interesting piece of traffic that you kind of stumbled across? 23:50.430 --> 23:51.550 Oh, that's so hard. 23:51.550 --> 23:54.690 I mean, it's really a different definition of interesting, right? 23:54.690 --> 23:57.290 Like, I forget if I mentioned this in my briefing or not. 23:57.290 --> 24:07.830 But for example, there were two friends, one guy was on a plane, one guy was on the ground, just chatting about some wild dream they had, where this guy's mom popped up in a burning building and started trying to feed him. 24:07.850 --> 24:10.890 And so you get all this real, you know, it's real people who are affected. 24:10.890 --> 24:14.550 And then, I mentioned being able to track this billionaire's yacht, right? 24:14.550 --> 24:24.310 And that's kind of a different world to know what the people in the yacht are eating for lunch that day, based off of the web APIs that they're using to manage their food system. 24:24.550 --> 24:27.810 And so it's just a different world of security problems. 24:27.810 --> 24:33.210 I don't think being able to listen to the internet is something a hacker expects to get from any perspective. 24:33.310 --> 24:39.090 And the fact that it's so inexpensive and easy in a satellite world is, I think, especially concerning. 24:39.950 --> 24:44.310 Yeah, but definitely, like, yeah, not great. 24:46.770 --> 24:52.090 We do have someone calling out that this is one of the coolest talks that they've gotten to see. 24:52.090 --> 24:53.110 Oh, I'm flattered. 24:53.110 --> 24:55.990 Yeah, it was a really good talk. 24:55.990 --> 24:59.790 And I'm definitely glad that I got to do this QA session with you. 25:00.350 --> 25:03.790 It was fun research to do, so I enjoyed it. 25:03.790 --> 25:12.110 Have you talked to any of the... I know there's some projects for, like, reviving old satellites and talking with them. 25:12.110 --> 25:13.730 Have you talked with those guys at all? 25:13.730 --> 25:22.350 And it's like, they might have, like, additional knowledge about, like, talking to satellites or different research projects that you might be interested in doing. 25:23.050 --> 25:23.990 No, I haven't done that. 25:23.990 --> 25:26.090 But it is a very, very related field, right? 25:26.090 --> 25:32.270 Because to some extent, reverse engineering a satellite that you can't touch is the same as exploiting one. 25:32.270 --> 25:36.950 A lot of the cases, it's really understanding the systems as the entirety of the security properties. 25:37.330 --> 25:40.190 And so, yeah, that's definitely a fascinating area I'd want to explore. 25:40.190 --> 25:46.590 Yeah, I do know that they've also gotten special permission to do a bunch of transmissions to satellites. 25:46.590 --> 25:47.510 That's part of it. 25:47.510 --> 25:49.330 That's part of the revival stuff. 25:49.830 --> 25:57.450 So, yeah, that was... they did a talk, I want to say, two years ago about MicMoon, which was their headquarters for satellite communications. 25:58.090 --> 25:59.050 That's awesome. 25:59.050 --> 25:59.770 Yeah. 26:06.560 --> 26:11.080 Some people are making references to DOCSIS work from earlier DEF CONs. 26:11.080 --> 26:16.100 I don't know how... if that's necessarily related, because DOCSIS is a cable protocol. 26:17.180 --> 26:19.200 Yeah, I don't know anything about it. 26:19.200 --> 26:21.520 So if it is related, I completely missed it. 26:22.140 --> 26:24.640 Definitely something for someone else to contribute. 26:26.760 --> 26:32.340 And The Geek is asking about new radio and SDR again, which we did briefly cover. 26:33.740 --> 26:34.640 But so... 26:34.640 --> 26:36.040 Yeah, I think it's possible. 26:36.040 --> 26:37.980 I think it's just a little bit harder. 26:37.980 --> 26:44.340 These things are pre-made and just easier to use and so widely available, but it's easier to just pick up a satellite tuner yourself. 26:44.340 --> 26:44.960 Yeah. 26:46.480 --> 26:47.780 Makes sense. 26:50.420 --> 26:57.420 I think you're getting high compliments from Mav there, talking about how this feels very much like, you know, the old Alexa Park content. 26:57.420 --> 27:00.100 So, wow, people are loving this. 27:01.040 --> 27:02.160 I'm really flattered. 27:02.160 --> 27:03.720 Yeah, it was cool stuff to do. 27:03.720 --> 27:07.280 It was a little frightening at times, but really enjoyable research. 27:07.280 --> 27:10.960 And I think space is a place people haven't done a lot of exploring. 27:10.960 --> 27:21.160 I mean, there obviously are other people before me, but I think there's a lot of low-hanging fruit for people who are interested in kind of living the days when hacking was maybe not easy, but terrifying. 27:22.700 --> 27:23.920 Well done. 27:27.880 --> 27:28.460 All right. 27:28.460 --> 27:31.180 Well, we're approaching the end of the session. 27:31.280 --> 27:35.440 Any final shout outs or anything you want to do before we sign off? 27:35.800 --> 27:43.760 One other thing I might hit on, as I mentioned, electronic flight bags in the talk as kind of an interesting component of the aviation stuff. 27:43.760 --> 27:50.160 I didn't know it at the time when I was recording the talk, but there were actually two village talks on electronic flight bags. 27:50.500 --> 27:55.180 One happened yesterday by Matt Gaffney, and I thought it was really cool. 27:55.180 --> 27:57.880 And then there's one tonight by David Robinson. 27:57.880 --> 28:03.060 So if you're interested in kind of the aviation side and what it might mean to hack an EFB, I definitely recommend checking those out. 28:03.060 --> 28:04.080 I know I will be. 28:04.080 --> 28:04.880 That's awesome. 28:04.920 --> 28:11.580 And I think that at least the vast majority of our village talks are also being recorded and put on YouTube. 28:11.580 --> 28:14.200 I don't know if that village is. 28:14.540 --> 28:16.580 It's an opt-in, opt-out kind of thing. 28:16.580 --> 28:17.600 So it's up to everyone. 28:18.240 --> 28:21.000 But it may already be available on YouTube. 28:21.000 --> 28:25.700 The one yesterday may already be available on YouTube for people if they want to go watch it as well. 28:28.540 --> 28:29.080 Okay. 28:29.080 --> 28:31.600 Well, thank you very much for joining us for this QA session. 28:31.600 --> 28:34.700 Thank you for making such great content for DEF CON. 28:36.040 --> 28:38.240 Thank you for being part of our virtual experience. 28:39.540 --> 28:40.000 Thanks. 28:40.000 --> 28:40.760 It was great. 28:40.760 --> 28:42.200 Great talking to you all. 28:42.200 --> 28:43.840 All right.