start	end	text
14490	22190	It's August 2018. A sysadmin logs in to the control panel of a wind turbine in southern
22190	28210	France to update its firmware. More than 600 kilometers away,
28210	35230	their PHP session token appears on my screen. Eight months later, an Egyptian oil tanker
35230	40350	pulls into the port of Sfax, Tunisia, with a malfunctioning alternator on board.
40350	44430	From my vantage point, more than 1500 kilometers away,
44430	47870	I learn that this ship will be out of commission for at least a month,
47870	53570	and I learn the name and passport number of the engineer who's flying away to fix it.
54410	60310	Just this summer, 13,000 meters above the Atlantic Ocean, the accountant of a Polish
60310	65990	real estate group put the finishing touches on their annual financial report. The Word document
65990	71390	she prepared reached my computer at the same time it arrived at the inboxes of her colleagues
71390	76810	at her parent company, one of Europe's largest private commercial real estate trusts.
76890	81090	How does this sort of thing happen? How do I get this kind of information,
81090	86530	and how do we protect it in the future? I'm James Pavore. I'm a PhD student at
86530	92350	Oxford University, where I research satellite cybersecurity. And today, I want to talk about
92350	98930	the results of more than two years of experiments looking at real world use of satellite broadband.
99050	103410	I do this work with a bunch of talented people from both the UK and Switzerland,
103410	108750	and I'm honored to get to share what we've found. This actually started as a fairly small kind of
108750	114630	summer project. What we wanted to do is take a look at some research from the mid to late 2000s
114630	119950	and see if we could replicate these findings. And what was cool about this research is that
119950	125570	these people found that there were these satellite television feeds that were encapsulating internet
125570	129870	traffic as well, and that if you had the right equipment and the right know-how, you could
129870	135750	actually find sensitive, unencrypted internet traffic inside those feeds. Now, a lot has changed
135750	140670	both about the way we use satellites and the way we use the internet since 2005, right? We have like
140670	145330	smartphones and stuff now. And so we wanted to update this research and also to make it a little
145330	150810	bit broader and more systematic, kind of look at large-scale use of these patterns. So what we
150810	156010	ended up doing is conducting a series of domain-focused experiments, looking at real-world
156010	162550	users at land, at sea, and in the sky for these satellite internet connections. In total, we
162550	168550	analyzed signals from 18 satellites in geostationary orbit with a combined coverage area of about 100
168550	173470	million square kilometers. To put that into perspective, that means we were able to receive
173470	179650	signals from as far away as parts of the United States and the Caribbean, China, and India. A massive
179650	186170	coverage area for an attacker. And in all 18 of these feeds, we identified deeply sensitive internet
186170	191070	traffic, whether it was being transmitted using those protocols that had issues we've known about
191070	197590	since 2005 or using newer protocols that have replaced it. And it wasn't just any data. It was
197590	203530	some pretty interesting traffic. We saw sensitive information from nine members of the Fortune
203530	209850	Global 500 that we're able to identify. Traffic belonging to passengers on six of the ten largest
209850	216650	airlines in the world by passenger count. Traffic belonging to maritime companies who together make
216650	223210	up 40% of the world's cargo shipping capacity by volume. And traffic belonging to government
223210	228890	agencies ranging from the postal service of an Eastern European nation to an actual Air Force
228890	235030	jet belonging to a North African country. We even saw traffic from regular people like you. People
235030	241190	who might browse Wi-Fi in a coffee shop or update their Instagram while they're on a cruise. Now,
241190	246030	before I delve into kind of the meat of this traffic, how we got at it, and what it has inside,
246030	250530	I want to kind of be sure we're all starting at the same point and give you a bit of a crash course
250530	254830	in satellite communications. So I'm going to run through a very simple scenario here
254830	261090	to kind of explain what satellite communications look like in practice. So here's our satellite.
261090	266630	It's in geostationary orbit, which means it's 30,000 kilometers above the Earth's surface.
266650	270870	We have a customer in the Atlantic Ocean who wants to talk to this satellite.
271730	277230	And to do this, they want to visit a website over the satellite feed that's hosted over here
277230	283750	in Ireland. We'll say it's Google.com. And they have a device on their boat that's called a VSAT
283750	288410	terminal, or a Very Small Aperture Terminal, which is what they'll use for this connection.
288490	293490	And that device was sold to them by an internet service provider who runs a ground station here
293490	299450	in Madrid. We'll also imagine an attacker who's quite far away from this conversation, down here
299450	304590	in Accra, but still wants to intercept the communications. So how does this play out?
304590	308790	Well, because our satellite's in geostationary orbit, it doesn't move around. So our customer
308790	313890	just needs to point their satellite dish at the sky and say, get me Google.com, using whatever
313890	319070	weird satellite protocol is used in this network. The satellite is more or less a dumb bent pipe.
319070	324210	It doesn't really do any processing or networking. It just sends that signal right back down on a
324210	328870	focused beam towards the ground station in Madrid. You'll notice this beam is very narrow,
328870	333190	so it passes over our attacker at Accra's head. They can't intercept this communication.
333190	338390	Once we get to Madrid, the satellite internet service provider will convert this weird satellite
338390	342870	protocol into normal IP traffic and route it to Google, just like if you were visiting a webpage
342870	348190	at home, terrestrially. It'll get the response over the terrestrial internet and then beam it
348190	354970	back up into space. It's worth noting that when I say beam up into space, this isn't a fast process.
354970	359290	The round-trip time for a conversation like this can be as long as 700 milliseconds, because the
359290	363870	speed of light is only so fast, and geostationary orbit, which is the kind of satellite we're
363870	369630	looking at, is very far away. Once we finally make it out there, though, there's one last step,
369630	374650	which is to beam this signal back down to Earth. Only this time, we'll do it with a kind of critical
374650	379230	difference, which is because satellites are expensive and we want to serve a lot of customers,
379230	383630	we'll send it on a really broad forward link signal. You'll notice that the footprint of
383630	387790	this signal reaches both our attacker in Ghana and our customer in the Atlantic Ocean,
387790	392570	so those radio waves carrying that response from Google will hit our attacker's satellite dish at
392570	398370	the same time as they hit the customer's. This is the crux of satellite eavesdropping. An attacker
398370	404630	can reliably expect to intercept the signal from very far away on these forward links, but they
404630	408990	can't always be guaranteed to see both sides of the conversation, which is somewhat unusual for
408990	414870	an eavesdropper. Additionally, we can kind of think about the security properties in this context,
414870	420490	because if we're imagining, say, a vulnerability in Wi-Fi or GSM, where the attacker has to be in
420490	425490	your city or in your neighborhood to intercept your communications, here an attacker can be in
425590	429730	a different country or on a different continent from their victim. So what does an attacker
429730	435030	actually need to pull off this attack? Let's talk a little bit about our threat model.
435190	440770	So in this case, if the attacker is a nation state, it's very simple. They simply need a
440770	445750	bit of money. There are companies out there that sell specialized modems for intelligence
445750	450490	collection purposes, like this one, and you hook them up to a multi-million dollar ground station,
450490	455090	like this one, and you're off to the races just listening to whatever satellite signals you want.
455090	459870	And it's a pretty reasonable assumption to say that national intelligence services are doing this.
460510	466330	However, they don't really give this equipment to PhD students. So I had to find a different way to
466330	471510	information, and that prior research that talked about using television signals is kind of what
471510	477690	led our next step. So we tried to see how far we could get using simple home television equipment
477690	483430	that's widely available. We picked up this nifty flat panel satellite dish, which cost around 90
483430	488150	bucks, although honestly you could get something free off of Craigslist or Gumtree most of the
488150	492330	time. You may even have a satellite dish kind of like rusting on your roof that you could use.
492470	495450	And then we got a card to interpret these signals in our computer.
495450	501110	Now we used a professional end card, which tends to run about $200 to $300. You could use a much
501110	506230	cheaper card in like the $80 price range at the cost of maybe not being able to comprehend the
506230	511330	more complex internet signals, but you'd still definitely find something. Once we have this
511330	517730	equipment, the next test is to actually use it to connect to a satellite signal. And figuring out
517730	521630	where the satellite is is easy. It's public information, and since they're in geostationary
521630	526490	orbit, they're not moving anywhere. But actually connecting is a little bit trickier. So let me
526490	531870	show you what that looks like in our lab environment. So what we're going to go ahead
531870	537570	and do is use a tool called EBS Pro, which is designed to help people find satellite television
537570	542050	feeds to listen to if they want to watch TV on their computer. And we're going to scan to hunt
542050	547270	for internet signals instead. Now what we're going to do is point our dish at a satellite that we
547270	552050	think has internet service, say because of a press release. And we're going to scan the KU band of
552050	555810	the radio spectrum, because that's what our equipment is set up for. And what we're looking
555810	560430	for is kind of signal against all of this background noise that's indicative of channels
560430	566050	that might have information. In this case, the signal is pretty noisy, but we do see a few distinct
566050	571030	humps in the spectrum graph that might contain actual traffic inside them. We'll go ahead and
571030	575170	tell our card to connect to this one and interpret it as a digital video broadcasting for satellite
575170	580430	feed. After a few seconds, we get a lock, meaning that we found a satellite and we're listening to
580430	585090	signals from it. Now for the demo, I'm going to connect to this weaker signal here because I know
585090	589570	it has interesting information. You'll see the signal to noise ratio is pretty abysmal, so we're
589570	593510	not likely to get all of the packets in this network, but hopefully we'll find something.
593610	598070	I'll go ahead and real quick just jot down some information about the frequency, the orientation,
598070	601890	and the symbol rate, because we're going to have to switch tools. This tool doesn't get us all the
601890	606490	way, it's designed for television feeds, and what we really want is raw data from that digital video
606490	611910	broadcasting signal. So to do that, I'll use a tool that's provided with our device, that PCIe card
611910	616310	in the drivers. We'll lock to that signal we discovered, and then we'll kick off a quick
616310	621530	recording. The amount of traffic you get in a recording like this is hugely variable. You could
621530	625850	get a terabyte in a week, you could get a megabyte in a week, it depends on your equipment and the
625850	630430	signal you're listening to. In this case, I'm just going to record a couple hundred kilobytes, and
630430	634450	we'll take a look at the file and see if we have any indicators that it has internet traffic instead
634450	640350	of television traffic. There's no trick here to differentiating between the two types. All I'm
640350	646590	going to do is just kind of grep through that binary file for the string HTTP, which we would
646590	651230	expect to see in an internet recording, but we wouldn't expect to see in a television feed.
651450	659130	And sure enough, we see here what looks like the output of a SOAP API. At this point, this is a
659130	664310	clear text information from someone else's internet signal using freely available tools and
664310	668890	commercial off-the-shelf equipment. And that's pretty bad, right? They could have sensitive
668890	673950	information just in this API string. But as an attacker, what we really want is to see if we
673950	678330	can pull off something even worse. We want to understand the semantics of this connection, kind
678330	682690	of the nature of the communications. And to do that, we have to delve a bit into the protocols
682690	688190	that are being used. So in our research, we've looked at two protocols, although there are others
688190	694690	out there. The first is called MPEG-TS. Now, you might be saying, MPEG, isn't that a video streaming
694690	700470	format? And you'd be correct. MPEG is widely used across the internet for sending videos.
701070	705730	It's used for satellite television video feeds, for example. And over the years, people have kind
705730	710770	of added all kinds of weird additions. They've added the ability to, like, pause live satellite
710770	717350	television or update your set-top boxes firmware over these feeds. And these functionalities have
717350	723770	been kind of hacked together to offer interactivity and internet services. And so, inside all of these
723770	728450	layers of weird protocols, you have a fairly standard container format that there's a lot of
728450	733710	great tooling for working with. And so, in fact, if you're, like, really lucky and you get a high
733710	738170	quality signal-to-noise ratio, you may just be able to open that file we saved in the desktop
738170	743630	directly in Wireshark and start seeing real packets. This is kind of where prior research
743630	747910	focused, because it was a pretty straightforward process to line up all the tools correctly.
748050	751170	And then you could spend most of your time looking at the contents of the traffic, which is the
751170	756750	interesting bit. However, MPEG-TS is still a used standard for satellite internet, but it's getting
756750	763550	replaced by newer protocols like GSE, or generic stream encapsulation. GSE makes a lot more sense.
763550	768550	It essentially has an IP layer, which is embedded inside of this generic stream, which is broken up
768550	772670	into fragments and then put directly into that digital video broadcasting feed. So, you have none
772670	777790	of the weird MPEG characteristics that are intended for video streaming and aren't relevant to internet.
778270	783130	We found that it was particularly popular among enterprise customers. So, people who had an entire
783130	788090	satellite transponder for their network, think like maritime customers or aviation customers.
788110	793470	But these customers also had much better equipment than we do. They would spend tens to hundreds of
793470	799550	thousands of dollars on signal processing hardware, whereas we're using, like, 200 bucks of a PCIe card.
799550	804150	So, when we were trying to receive these signals, we were often missing fragments of IP packets and
804150	808450	had super corrupted feeds, which meant that existing tools weren't able to parse these
808450	813870	signals for us. We didn't get much help in that regard. So, what we did instead is build our own
813870	821370	tool called GSE Extract. And the goal of GSE Extract is to forensically reconstruct PCAP files
821370	827750	from corrupted recordings of GSE feeds. And it does this by taking some shortcuts. If we were
827750	831850	designing a satellite modem, we would have to consider all of the edge cases and how a network
831850	837150	operates or how a packet gets sent. But for GSE Extract, we can say, generally, we would expect the
837150	842730	start of an IP packet to appear here. Or we would expect this fragment to belong to this payload.
842910	847330	And by making some of those assumptions, GSE Extract is able to help us figure out what to do
847330	853830	with between 50 and 70% of the frames that are hitting our dish. This is significantly better
853830	858070	than an existing tool, which would just throw an error message because the feed is so corrupted.
859150	864090	Hopefully, by the time that you're watching this recording, GSE Extract will be available on my
864090	868610	research group's GitHub. It may take a little bit longer because we're still kind of doing
868610	874090	some responsible disclosure review process stuff. But it should eventually end up there. In the
874090	878610	interim, if you want to delve into how it works a little bit deeper, it's described in pretty
878610	883270	high detail in a related academic paper that we published a few months ago in the appendix of that
883270	889910	paper. So this is kind of what you get at the end of the day by using GSE Extract. This is a JPEG
889910	895430	file that we intercepted from an engineer aboard a maritime vessel who was dealing with a maintenance
895430	899690	issue and sending pictures to his colleagues. You'll see that we're able to get like the start
899690	903430	of the packet. We're able to kind of figure out, you know, this is a JPEG file. We knew what port
903430	907850	it was going to. We kind of knew the nature of the communications. But at some point, we start
907850	912070	losing fragments. And then in the case of like a compressed file like this, we weren't able to get
912070	917490	everything. That said, the first chunk of an IP payload often has the most interesting bits. It
917490	921970	may be the entire packet, or it may be the parts that you care about from like a session login or
921970	927210	something. And so we think this is still useful to an attacker, even if it's not 100% recovery,
927210	932770	and allows someone to get away with $200 or $300 of home television equipment and do harm that
932770	936690	they would otherwise need tens of thousands of dollars to play with in these networks.
938090	944710	All right, so at this point, we're in a good spot. We have a satellite dish that we can use to talk
944710	949870	to signals. We know that if those signals are in a digital video broadcasting for satellite format,
949870	954770	which is very common from geostationary orbit, we can parse that using that PCIe card on our
954770	960610	computer. Depending on the contents of those streams, we can use existing tools like DVBSnoop
960610	966930	or Wireshark, or tools we've written ourselves like GSExtract, to get meaningful PCAP data out
966930	971930	of it and understand the internet traffic inside. The next step is really to understand the impact
971930	977090	of what we found. How does this affect modern users of terrestrial satellite communications,
977090	983310	maritime, and aviation communication links? So across all three of these domains, there are a
983310	988130	couple of general things we found that are worth highlighting. The first is that none of the ISPs
988130	993530	we looked at appear to employ encryption by default. That is to say that individual customers
993530	998690	might choose to encrypt their traffic, but the satellite ISP was sending over the satellite feed
998690	1004870	traffic in essentially the same format that was coming into the modem. What this means is that as
1004870	1010070	an attacker, we had an ISP-level vantage point on the traffic that was coming to a customer.
1010070	1015070	We saw every website they visited, every bit torrent they downloaded, every connection they made
1015070	1019190	would pass over that satellite link and we would get it. But when we looked at the enterprise
1019190	1024110	customers, this got even more interesting because a lot of these enterprise networks operate basically
1024110	1029270	as a LAN environment across the satellite feed. A good example is a cruise line we were looking at
1029270	1034350	that had Windows machines on all of their ships. And the internal Windows LDAP traffic
1034350	1038590	from that network, that Windows local area environment, was being broadcast across the
1038590	1044250	satellite feed. Getting to see Windows-to-Windows corporate LAN communications as a wireless
1044250	1048970	eavesdropper is really unusual and we thought it was a particularly interesting angle because it
1048970	1055270	got us behind the firewall of a lot of these big corporations' networks. So the first environment
1055270	1059210	I want to talk about, the first domain, is terrestrial customers. And these were really
1059210	1063170	interesting to us because they're real people, they're kind of your home internet users, and
1063170	1068490	they care about privacy. Now, I know what you might be saying. You might say, wait a second,
1068490	1073630	my browser has this lock icon on it which says that my traffic is encrypted. What could an
1073630	1079850	eavesdropper do to cause harm to me? And I would say to you, convenient made-up straw man, that
1079850	1084970	there's actually a lot that an attacker can do to mess with your communications in this context.
1085610	1091190	So even though we can't see exactly the content of your communications, we get to see your DNS
1091190	1095790	queries, for example, which is essentially every website you're visiting, and we can use that to
1095790	1101130	piece together your browsing history. Additionally, those TLS certificates that you think are
1101130	1105590	protecting your traffic, or protecting the contents of that traffic, but they're fingerprinting the
1105590	1110270	websites you're visiting, which allowed us to determine like which networks devices belong to
1110270	1115910	or generally where users were going. Now, this is a mild privacy concern. You don't want an entire
1115910	1121050	continent to hear your browsing history. But it gets worse when you slip up. One of the most
1121050	1126710	illustrative examples of this comes from a lawyer whose emails we intercepted across this feed. So
1126710	1131110	this lawyer in Spain was communicating with one of his clients about an upcoming court case. He
1131110	1136290	happened to be a defense attorney. And we intercepted the emails that were going to his inbox,
1136290	1142630	because he was using POP3 to download them over the satellite link. And so this is obviously
1142630	1147250	bad news for that attorney's client, and for attorney-client privilege, and customer privacy
1147250	1152370	in general, and all of that. But it gets a little bit worse if we think about it in the context of
1152370	1157250	everything else we know about this lawyer. Because we also know what other websites he was visiting,
1157250	1162830	and so we can say, hey, this lawyer goes to PayPal.com. We see that from his DNS queries.
1162830	1166590	We have his email address, and we can read everything that goes to his inbox.
1166590	1172170	We can go and hit the reset my password link on PayPal, and essentially hijack his accounts.
1172250	1176270	This demonstrates how a man-in-the-middle attacker who's listening to your entire connection,
1176270	1180930	who's essentially an internet service provider, can engage in attacks that are way more sophisticated
1180930	1184910	than someone who's just eavesdropping in a single connection to an insecure service.
1186750	1191030	So, the other thing we were curious about were kind of IoT systems, because these didn't really
1191030	1194990	exist when people were looking at these feeds last time, especially in kind of the electricity
1194990	1200350	and critical infrastructure domain. We found that a lot of operators seem to be using these
1200350	1205030	networks under the assumption that they were secure against eavesdropping. A great example
1205030	1211770	of this is a major electricity provider in Europe who had this HTTP basic authentication login that
1211770	1217050	you see on the left to access the Cisco router inside their network's configuration page.
1217290	1221030	And I've blocked out all of the sensitive information, but clearly this is a clear text
1221030	1225430	admin username and credential that could probably change some settings on that router.
1225630	1229830	And if you have a keen eye, you'll see that the host IP address for this router is publicly
1229830	1234310	routable, meaning that anyone with an internet connection could use these credentials to log
1234310	1239370	into the device. Very similarly, I kind of touched on this at the beginning, there are a lot of wind
1239370	1243190	turbines that use satellite connections because they're in remote locations and they don't have
1243190	1248350	terrestrial internet access. And what we found is that a lot of them have these control panels that
1248350	1253690	were used to configure the devices that were being sent over the satellite feed. And these control
1253690	1259010	panels are publicly routable over the open internet. So we could get these credentials that were being
1259010	1263270	leaked in clear text over the satellite feed, whether that be a login cookie or username and
1263270	1268070	password, and combine it with any internet connection to potentially start messing around
1268070	1272330	with these power generation facilities. Now, obviously, we didn't engage in any attacks on
1272330	1276210	an electrical grid system. So there could be another protection when you log in as some sort
1276210	1280510	of second factor control. But I think it's intuitively concerning that this stuff is
1280510	1287350	getting sent in clear text. So heading out to sea for a moment, I think one of the most interesting
1287350	1292330	things for us about the maritime case was how unique every boat in the network is. So we had
1292330	1296430	these terabytes and terabytes of traffic from all kinds of different companies and all kinds of
1296430	1301770	different ships. And what we really wanted to do was figure out a way to tie an IP address in this
1301770	1307870	massive PCAP file to a specific boat in the ocean to figure out what it was doing. So we picked 100
1307870	1312610	random IP addresses from the thousands that we had, and we set ourselves a little challenge.
1312610	1317930	We designed a fingerprint based off of DNS queries and TLS certificates and a couple of strings from
1317930	1322850	the first few kilobytes of their traffic. And we used that to see if we could de-anonymize IP
1322850	1328810	addresses and identify ships. This very basic kind of manual process was sufficient to de-anonymize
1328810	1333910	10% of the vessels in that case study. So we de-anonymized 12 vessels. I've hidden their names
1333910	1338330	here because I want to maintain the privacy of their owners, but you get a real sense for the
1338330	1343730	breadth of the type of ships impacted by this research. So the smallest fleet that we listened
1343730	1348530	to was this fishing fleet here, which had a single fishing vessel and was using some sort of software
1348530	1353510	over the satellite feed to help it find fish. I'm not really sure how it works. On the flip side, we
1353510	1357610	have this enormous container ship, one of the larger container ships in the world, belonging to
1357610	1362250	one of the larger shipping companies in the world. And it's operating within the same kind of IP
1362250	1368230	address space as that random fishing crew. Beyond being able to identify like which companies and
1368230	1372670	organizations are affected, another cool thing we could do is kind of fingerprint operational
1372670	1378310	technology aboard the vessel. A good example is this subsea repair ship down here, which is owned
1378310	1383390	by a major petroleum company. And we were able to identify from the traffic inside those PCAP
1383390	1387830	files that there was a device on board the ship running a vulnerable version of Windows Server
1387830	1393490	2003 that had all kinds of CVEs that could be deployed against it. At this point, if we wanted
1393490	1399350	to attack that ship, we could potentially deploy CVEs not just against that one, but against any
1399350	1404930	ship in this petroleum company's fleet and potentially cause some serious harm.
1406090	1410850	So another piece of operational technology we were curious about was something called
1410850	1417350	electronic chart display and information systems, or ECTIS. And ECTIS are essentially GPS nav terminals
1417350	1422470	for boats. They tell boats like where they can go safely or illegally. They have like various
1422470	1427230	hazard updates for mariners. And there's been a lot of great research on securing them. There are
1427230	1431450	actually formats out there to stop people from tampering with these charts using various
1431450	1435870	cryptographic authenticity guarantees. Unfortunately, we saw that a lot of maritime
1435870	1441750	operators were using older or proprietary versions of these formats that did not have protections
1441750	1446950	against tampering attacks that we could see. Now, you might be saying, why does this matter, right?
1446950	1450790	You can get free nautical charts and maybe save a couple hundred bucks if you want to go on a
1450790	1455670	sailing expedition. But can you really mess with this data as someone who's just passively listening
1455790	1461130	to a satellite connection? It turns out that you can, because a lot of these are updated insecurely.
1461130	1466850	A great example is this ship, which had a publicly routable FTP server on board.
1467010	1470150	And the way they would get their chart updates is someone on land in the back office
1470150	1475410	would copy the latest chart files into a folder called chart delivery on an FTP server,
1475410	1480210	and then it would get deployed to the ECTOS terminal. Now, because this FTP server is
1480210	1484170	accessible over the internet, anyone with an internet connection can connect to it.
1484170	1489050	And the password is getting sent in clear text over the satellite feed because they didn't use SFTP.
1489050	1493550	And so it would be pretty trivial to send a false chart to this folder or even deploy
1493550	1499150	targeted malware. Another common way that charts get update is via emails. And generally there's
1499150	1505710	an email address like chartupdates underscore ship name at shipcompany.org, which will get
1505710	1510450	updates every so often as attachments to the inbox. The captain will copy those files onto
1510610	1515190	a flash drive, walk over to the ECTOS terminal, plug it in, and kind of update the information.
1515910	1520290	That's not inherently insecure, but if you're like this captain and you use an insecure email
1520290	1525110	protocol, then we get a pretty good template for a targeted social engineering operation
1525110	1530090	that might persuade you to copy malicious charts or malware onto your own vessel's
1530090	1536170	critical operational technology. Beyond this kind of operational technology, I think it's
1536170	1541790	important to remember that there are real people aboard these ships who have real privacy concerns,
1541790	1546690	like billionaires sailing around on their super yachts. Now I know getting up at DefCon and saying
1546690	1551690	think of the billionaires is not a great starting point, but this was a really fun case study that I
1551690	1556170	want to kind of delve into a little bit. So we were listening to this traffic from this Greek
1556170	1561330	billionaire's mega yacht, and there were all kinds of interesting anecdotes that came up in the
1561330	1566130	traffic that really painted a picture of what was going on. For example, one day the captain of this
1566130	1572010	yacht forgot to log in to his Microsoft account, and so the credentials for that captain's account
1572010	1576630	came across the satellite feed in clear text in the format of an account reset link.
1576930	1580650	Now at this point, we could hijack the account of someone who has reason to communicate
1580650	1585090	with a very high net worth individual and potentially engage in some super targeted
1585090	1589930	social engineering attacks. Because the captain's email address included the name of the yacht,
1589930	1594310	we could also very easily identify which billionaire was affected by this traffic.
1595630	1600070	Additionally, once we had kind of de-anonymized the owner of this yacht, there were other things we
1600070	1605310	could piece together. For example, the yacht used software to manage, like, lunch orders and stuff
1605310	1609470	for the crew members and for guests, and so we could see who this billionaire was inviting on
1609470	1613850	their yacht or where they were going or even what they were eating for lunch on a particular day,
1613850	1617910	which is, like, not inherently sensitive, but if you're hiding who you're meeting or you don't want
1617910	1621910	an entire continent to know about your social life, it could be a little bit concerning for
1621910	1626630	these individuals. Beyond the billionaires, though, there are also regular people on
1626630	1632650	vessels across the sea who have privacy concerns. Another privacy thing that we encountered was what
1632650	1637150	looked like point-of-sale terminal traffic coming off of cruise ships from a major European cruise
1637150	1641990	operator. And I don't know if there were credit card numbers in here, so I've censored the data
1641990	1646510	very heavily. A lot of the numbers did pass the loan check, but it could have been coincidental.
1646810	1650810	At the very least, anything that tells you how much someone paid for a soda, what their name was,
1650810	1656690	is pretty deeply concerning that it's being broadcast across an entire continent in clear text.
1657230	1660850	Another example of sensitive information from, like, real people on cruise ships
1661370	1667290	or on vessels would be when ports have cargo vessels come in. They often require the crew to
1667290	1672250	share some visa information. And this particular port authority thought that a great way to do that
1672250	1677230	would be an insecure HTTP web service. And so as a result, we could see from the cargo vessels
1677230	1681950	pulling into this port, all of the names and passport numbers and date of birth of the crew
1681950	1686670	members aboard these ships. Obviously, this is deeply sensitive information that should have
1686670	1692570	been encrypted. All right, let's head out to the skies. So the aviation use case is really
1692570	1697430	interesting to me because it's the newest one. We were going to do this as our 2020 experiment.
1697430	1701470	We're going to get all kinds of great data from airplanes this year and really get a feeling for
1701470	1706670	how aviation intersects with satellite communication security. And we started out great. We had some
1706670	1711250	great traffic from these in-flight entertainment systems in February. We're super excited for the
1711250	1717890	year. And then everyone stopped flying. The number of people in airplanes sank dramatically because
1717890	1722090	of the pandemic. And so the amount of traffic we were getting also tanked. I was originally
1722090	1726950	pretty salty about this, but then I realized that there's actually a silver lining here.
1727390	1732210	You see, back in February, the traffic we were seeing was a lot, but it was mostly garbage. It
1732210	1736030	was people checking their Facebook on a flight, which isn't that interesting from a security
1736030	1741130	researcher perspective. But in April, when the airplanes were flying empty, almost all of the
1741130	1745470	traffic in these networks was somehow essential to either the operation of the airline or the
1745470	1749990	operation of the airplane. There were no passengers to generate noise. And even as passenger counts
1749990	1754810	increased, the passengers we saw tended to be like high-value business executives as opposed to just
1754810	1759470	random tourists, which made the traffic a little bit more interesting from a privacy perspective.
1759990	1764990	Now, because we had this unique opportunity, there was something I wanted to test, which was a claim
1764990	1769970	that was made by a researcher whose work I really admire. So Ruben Santamarta does research in satellite
1769970	1774330	modems. He's definitely presented at Black Hat and DEFCON and stuff, doing a lot of hardware
1774330	1778570	reverse engineering. And he has this blog post where he looks at in-flight entertainment systems,
1778570	1783370	including some of the systems that we were seeing traffic from. And he posited that he suspects the
1783370	1787670	satellite terminal could be a bridge between the part of the airplane that keeps people entertained
1787670	1792010	and happy and the part of the airplane that keeps it in the sky and going in the right direction.
1792010	1796370	And we wanted to see if there was anything in these traffic captures that crossed that red
1796370	1800730	line and kind of crossed those two separate information security domains, which shouldn't
1800730	1806010	be happening. We would have missed this if we had all of that Facebook traffic. We actually
1806010	1810870	had traffic from this device for several months, and we didn't realize it until coronavirus hit.
1810870	1816070	But we found what I'm going to call the loneliest EFB. So an EFB is an electronic flight bag. It's
1816070	1820650	essentially an information terminal like an ECTIS terminal, but for airplanes it includes
1820650	1824950	navigational information and weather updates and all kinds of stuff that the pilot needs to manage
1824950	1830270	the flight. And this specific Chinese airline had made a mistake in configuring their EFB
1830790	1835190	such that it wasn't logging in correctly. Someone had like fat fingered a password or something.
1835190	1838930	And so all of the requests it was sending were getting bounced off of this redirect page from
1838930	1844170	the satellite modem and reaching us. And we could use that to not only fingerprint like how this API
1844170	1848350	works and what sort of data is being sent from the airplane and where the airplane was at any time,
1848350	1854870	but we could also identify other vessels that were using this same device. And even though
1854870	1859910	it seems to be encrypted over the air in most cases, we're able to confirm that the network
1859910	1864290	that's carrying this operational technology traffic is the same one as the person a few
1864290	1870610	rows back who's browsing Instagram. Another case that we were interested in for airplanes is
1870610	1874510	something called a femtocell. There have been a couple of talks at DEFCON about it, I think.
1874510	1879170	And it's essentially a miniature cell tower that they put in airplanes that allows customers to
1879170	1883970	use their cell phones as if they were on the ground. And we saw that the front end of these
1883970	1889970	is fairly secure. It uses GSM or LTE or whatever, which has some security guarantees over the air.
1889970	1896370	But the back end was being routed unencrypted in these kind of SCTP wrappers over the satellite
1896370	1901370	signal. And so we're able to see like the contents of people's cellular communications.
1901370	1905470	What's particularly scary about this is that we don't know if these customers were aware
1905470	1909090	of what they were doing. If you forgot to put your phone into airplane mode,
1909090	1913190	it's very possible a text message that you received during your flight will show up in
1913190	1916790	our packet captures. You're not even aware you're connected to a satellite network.
1917190	1922130	And to kind of bring home the severity, here's a good example. There's this person who was on
1922290	1925810	a flight and in the middle of their flight, they got their negative coronavirus test result.
1925930	1929690	Now that's a huge relief for anyone who's sitting next to him on the airplane, right?
1929690	1934330	But for the rest of us who care about health data privacy, it's a huge information breach that
1934330	1939050	this is being sent in clear text across a continent. We saw all kinds of wild text messages.
1939050	1943630	I remember listening to some guy who spoke Croatian in his text messages talking about
1943810	1948350	a wild dream he had where his friend's mom showed up in a burning house or something.
1948350	1953090	Just real people's personal communications are being sent in clear text. And it's not
1953090	1958730	just personal communications. If you've ever used SMS as a second factor for account login,
1958730	1962390	it's very clear how this could be deployed in an account hijacking attack.
1964050	1969010	So fundamentally, everything we've done is passive. We haven't gotten any equipment to send signals
1969010	1972970	in these networks. We don't have a license to do that. But is it possible that there are other
1972970	1978350	sort of semi-active or fully active attacks we could deploy against these networks? One scenario
1978350	1983430	I saw, which is based off of some malware that actually has been used in practice by a Russian
1983430	1990170	group, would be to use satellites for untraceable data exfiltration. And there are only two
1990170	1994630	requirements for this to play out. First, you have to compromise a device that you want to steal data
1994630	1999630	from. And it needs to be connected to a network that has a route to a satellite IP address.
1999770	2003210	Generally, the internet is sufficient because there are a lot of satellite devices that have
2003210	2007990	internet routable IP addresses, but it could also be a device inside someone's LAN environment.
2008870	2012990	Additionally, as an attacker, you need to be able to be inside that satellite signals
2012990	2016910	forward link footprint. You need to be able to eavesdrop on the traffic. And that's it.
2016910	2021250	Let's see how this plays out. So an attacker who's compromised the device has a problem.
2021250	2025630	They want to send the sensitive data they've stolen to their server somewhere on the internet.
2025630	2030890	The problem is that if they decide to just route this along the internet, just send a post request
2030890	2036650	with whatever file they have to a web server they run, then law enforcement can very easily trace
2036650	2041390	that post request and identify where the attacker's command and control server or data exfiltration
2041390	2047930	database is. But if the attacker uses a satellite hop as an intermediary, they can really cause some
2047930	2053270	trouble for law enforcement. Because you see, the compromised computer with the malware can send a
2053270	2058270	signal to a satellite customer that will be routed over the satellite feed. And this customer doesn't
2058270	2062350	need to be involved at all. It can just be a random ship in the ocean that happens to have an
2062350	2066670	IP address. It doesn't even need a service running at that port. It could be a closed port or broken
2066670	2070990	connection. And what will happen is the satellite will beam that signal down across its footprint
2070990	2077030	area. And if the pilot, if a law enforcement officer tries to investigate this, they'll see it
2077030	2083830	reach this like broken surface on a maritime ship and have no idea where it's gone. Meanwhile, behind
2083830	2089690	the scenes, the attacker can be using a satellite dish to eavesdrop on that connection and leak
2089690	2094630	information in clear text. Even if the satellite network had some degree of encryption, which there
2094630	2099690	are some network out networks out there that do, the attacker might still be able to use even just
2099690	2105310	the size of packets or the content of packets or the existence of packets as a signal that's
2105310	2110150	virtually untraceable because they're somewhere in this massive continent-sized footprint and
2110150	2115770	that's all law enforcement could possibly know. Another attack that we tried to pull off is
2115770	2120450	something called TCP session hijacking, which is a very classic kind of networking attack.
2120470	2124810	Essentially, TCP has this three-way handshake to set up connections where you have to know these
2124810	2129170	randomly selected sequence numbers to prove you are who you say you are. And what we found is that
2129170	2133650	in certain satellite environments, you could actually impersonate one of these endpoints very
2133650	2139510	reliably due to the physical characteristics of orbit and hijack arbitrary TCP session numbers.
2139570	2143990	We did this against our own connection to one device in one specific satellite network, but we
2143990	2147230	didn't test it at a very broad scale because we didn't want to mess with anything important.
2147570	2151210	Let me give you a show of how this kind of works from a physical perspective.
2151330	2156530	Let's take a look. So just like before, we have someone in Ireland, only this time they're a
2156530	2160330	maritime office that wants to visit a website that's hosted on the cargo vessel with status
2160330	2166930	information. So what they'll do is they'll send a TCP SYN number as a start of a TCP three-way
2166930	2171350	handshake. And this has a sequence number that you have to know to prove that you received the start
2171350	2175030	of the handshake and that you're part of this conversation. This is like a very fundamental
2175030	2180270	protection against spoofing attacks. However, our attacker can easily get the sequence number over
2180270	2184750	the unencrypted satellite link. And at the next step, our attacker, remember how I said they were
2184750	2191190	in Ghana? So Accra happens to have some of the fastest terrestrial internet in Africa and a
2191190	2195330	direct backbone link to the UK, although that doesn't necessarily matter. But because the speed
2195330	2201250	of light is only so fast, the attacker 100% of the time can beat the legitimate acknowledgement
2201250	2206350	message from that handshake to our maritime office in Ireland. And at this point, the maritime office
2206350	2210410	will start a conversation thinking they're talking to the vessel when they're actually
2210410	2215490	sending information to our attacker. Our attacker can continue to eavesdrop over the satellite link
2215490	2220030	and that message with their spoofed acknowledgement will reach the ship at sea, who will simply
2220030	2223530	ignore it because it has incorrect sequence numbers. But our attacker at this point has
2223530	2228350	free reign to send whatever information they want to the maritime office and impersonate the ship
2228350	2232050	in a way that's virtually undetectable if you're not employing some sort of certificate signing
2232050	2239170	scheme. So this is like a very simple example that shows that even though we can't transmit
2239170	2243030	directly in the satellite network, we're fundamentally part of a broader network, which
2243030	2248310	is the internet. And in that environment, active attacks are definitely possible. So obviously, this
2248310	2253010	research has some ethical implications. It's real world networks and real people. So we're very
2253010	2256990	careful to adhere to the laws and go above and beyond that. You might be a little disappointed
2256990	2261450	today that I haven't named and shamed any companies. That's a conscious choice, because I don't want
2261450	2265670	this to be about X airline is leaking your data. I want the focus to be on the fact that this is a
2265670	2270930	systemic issue that affects a lot, thousands, tens of thousands of satellite customers around the world.
2271690	2275470	We've, of course, engaged in responsible disclosure. Many of the satellite companies have known about
2275470	2280050	this as early as 2019, as well as some of their customers who have leaked particularly interesting
2280050	2284930	data or particularly large. Most people were receptive to this. We talked to a lot of CISOs
2284930	2288270	who have started changing around their networks. We don't know exactly what they're doing, but at
2288270	2292290	least they're aware of the risks. And we only had one company threatened to sue us, which is really
2292290	2297770	good for this kind of systemic cybersecurity research. We got a huge boost to responsible
2297770	2302190	disclosure, courtesy of the Federal Bureau of Investigation, who releases threat intelligence
2302190	2308050	notification to the maritime industry. And what's really interesting about this notification is that
2308050	2314930	it showed up online from the FBI almost a month before our academic paper was publicly available.
2314930	2319450	So the only people that accessed this PDF file were people who were responsibly disclosed to you
2319450	2325430	with the request that they keep it private and our academic peer reviewers. Yet somehow the FBI
2325430	2331550	was able to cite specific information from a chart inside that paper. Now, as a researcher, this is,
2331550	2335390	you know, a little bit unsettling. How did the FBI get my paper before I gave it to anyone?
2335450	2338450	But if you're ever wondering that you should join one of these like threat intelligence
2338450	2343450	schemes, it's like clear that the FBI does a good job at getting a scoop ahead of like
2343450	2347170	the industry or even the researchers themselves thinking it's out there.
2347810	2352030	So how do we protect against these attacks going forward? How do we defend these networks?
2352170	2356130	Well, I think we need to understand why these kinds of attacks can happen. And it's easy to say
2356130	2360390	it's because satellite operators are ignorant, but the reality is more complicated. Remember when I
2360390	2364970	said the speed of light is only so fast? That means that sending a signal to space is slow,
2364970	2369890	which makes all of those TCP connections you get when you visit a website add up to make your
2369890	2375170	internet seem really slow. So what ISPs have done is they started splitting these handshakes as a
2375170	2379510	man-in-the-middle attacker, basically, who benevolently accelerates your connection via
2379510	2383630	what we call a performance-enhancing proxy. The problem is that if a customer uses like
2383630	2387770	end-to-end encryption over a VPN, these performance-enhancing proxies can't find
2387770	2394650	those TCP handshakes, and so they can't accelerate the connection. So in the short term, you might
2394650	2398810	have to accept that as reality and just say, you know what, passport numbers are sensitive enough
2398810	2403190	that we should send them encrypted or not send them at all. And in many cases, if you're using
2403410	2408890	a TCP layer encryption protocol or a UDP encryption protocol, it doesn't affect performance at all.
2408890	2412790	You should never be using POP for your emails, although we found thousands and thousands of
2412790	2418330	people still do. You should be using an encrypted email client. And since ISPs are already screwing
2418330	2422950	around with TCP sequence numbers and TCP sessions, if they just change those sequence numbers over
2422950	2427470	the air from what they are on the ground, they can prevent TCP hijacking attacks. A lot of ISPs
2427470	2432090	seem to do this already, although I think it's largely accidental. In the longer term, though,
2432090	2436810	we're trying to work on a solution that makes it easier for individual customers to be sure their
2436810	2441030	data is always encrypted, regardless of what protocol mistakes they might make. We're building
2441210	2446990	a tool called QPEP, which uses the QUIC protocol, which is a TCP replacement that is encrypted by
2447350	2451530	default. And it's kind of a combination between like a tunneling VPN and a performance enhancing
2451530	2458310	proxy. If you want to take a look at QPEP, there is a public GitHub repository for it. This isn't
2458510	2462370	a commercial product. The goal is to build a tool for people to start playing around with
2462370	2467050	securing these networks. It's designed to be much more accessible than existing PEPs, which tend to
2467050	2472010	be written in these obtuse C libraries for networking. It's written in Python as a test bed
2472010	2476090	so you can simulate it without a satellite equipment at all. And most of the networking
2476090	2481750	layer is written in Go for performance reasons. And the end goal is to help individuals protect
2481750	2486110	their traffic instead of trying to berate ISPs into encrypting data, which we know doesn't work
2486110	2492990	because we've been doing it since 2005. So this kind of shows the difference between those two
2492990	2498190	options versus using an encrypted proxy like the one that we're building and using a very good
2498190	2502230	open source VPN, but one that doesn't take into account the unique aspects of satellite
2502230	2506350	communications. And you can see the difference in the amount of time it takes to load just a
2506350	2511570	very typical web page as an indicator of why customers aren't encrypting their data. It's
2511570	2515670	not that they don't know privacy is at risk. Many of the people responsibly disclosed to were like
2515670	2521430	this isn't a security vulnerability because everyone knows about it, which has its own problems. But I
2521430	2526530	think fundamentally when you give someone a choice between performance and privacy, it's very likely
2526530	2531490	that they will choose performance, especially in an environment like satellite where you already have
2531490	2536830	kind of sluggish connections. And so finding technological solutions that enable people to
2536830	2541790	have as good of a performance as they've come to expect while adding in privacy basically invisible
2541790	2547350	in the background is I think the best way that we can bolster privacy and security in these
2547350	2554110	networks for real satellite customers. So to sum things up, today I've kind of presented the case
2554110	2558710	that satellite broadband as it's used in the status quo is vulnerable to long-range eavesdropping
2558710	2563670	attacks. Someone in a different country or on a different continent from you can be listening to
2563670	2568750	your internet communications and yet many people act like this isn't the case. Whether it's a
2568750	2573850	massive Fortune 500 company or a random person in a coffee shop somewhere, people are leaking
2573850	2578170	deeply sensitive traffic over satellite feeds as if they don't know that an eavesdropper could be
2578170	2583250	listening. We think this can be changed. We think the underlying reason that this is still a problem
2583250	2588670	is that performant encryption is something that ISPs have to build into their satellite networks
2588670	2592650	instead of something that individuals can just run for themselves when they connect to a satellite
2592650	2597090	terminal. And we think that we can balance out that trade-off and bring security to customers
2597090	2601910	regardless of how they interface with a satellite connection. So if I wanted to give a broader
2601910	2607450	lesson, kind of a major takeaway from this talk that has almost nothing to do with satellites,
2607450	2612990	it would be very simple. And that is that the next hop is unknown. When you connect to the internet,
2612990	2617210	there's a whole web of different nodes and connections that's constantly changing that's
2617210	2623630	routing your traffic. And any one of those nodes could be a satellite link or a wireless tower or
2624130	2630070	a wiretapped ethernet cable. And so if we want to be sure that no one is listening to our traffic
2630070	2634090	wherever it might go next, right? Because we could connect to a Wi-Fi hotspot and it could have
2634090	2639170	the best encryption in the world. But if the next hop is a satellite link, that does us no good.
2639330	2643950	So having the ability to encrypt your own traffic, having the right to encrypt your own traffic,
2643950	2647970	and having the knowledge to make that encryption as secure and robust as possible
2647970	2652990	is, I think, critical to preventing this whole class of attack regardless of the domain we
2652990	2658630	consider it in. Thank you so much for listening to my presentation. I'm happy to answer any email
2658630	2663990	questions via email or in a breakout session after this. And I hope you enjoyed the talk.