How To Hack Satellite Internet & Surf Anonymously

2 Comments

 

A Spanish researcher demos new satellite-hijacking tricks with cybercriminal potential.

Satellites can bring a digital signal to places where the Internet seems like a miracle: off-the-grid desert solar farms, the Arctic or an aircraft carrier at sea. But in beaming data to and from the world’s most remote places, satellite Internet may also offer its signal to a less benign recipient: any digital miscreant within thousands of miles.

In a presentation at the Black Hat security conference in Arlington, Va., Tuesday, Spanish cybersecurity researcher Leonardo Nve presented a variety of tricks for gaining access to and exploiting satellite Internet connections. Using less than $75 in tools, Nve, a researcher with security firm S21Sec, says that he can intercept Digital Video Broadcast (DVB) signals to get free high-speed Internet. And while that’s not a particularly new trick–hackers have long been able to intercept satellite TV or other sky-borne signals–Nve also went a step further, describing how he was able to use satellite signals to anonymize his Internet connection, gain access to private networks and even intercept satellite Internet users’ requests for Web pages and replace them with spoofed sites.

“What’s interesting about this is that it’s very, very easy,” says Nve. “Anyone can do it: phishers or Chinese hackers … it’s like a very big Wi-Fi network that’s easy to access.”

In a penetration test on a client’s network, Nve used a Skystar 2 PCI satellite receiver card, a piece of hardware that can be bought on eBay ( EBAY – news – people ) for $30 or less, along with open source Linux DVB software applications and the network data analysis or “sniffing” tool Wireshark.

Exploiting that signal, Nve says he was able to impersonate any user connecting to the Internet via satellite, effectively creating a high-speed, untraceable anonymous Internet connection that that can be used for nefarious online activities.

Nve also reversed the trick, impersonating Web sites that a satellite user is attempting to visit by intercepting a Domain Name System (DNS) request–a request for an Internet service provider (ISP) to convert a spelled out Web site name into the numerical IP address where it’s stored–and sending back an answer faster than the ISP. That allows him to replace a Web site that a user navigates to directly with a site of his choosing, creating the potential for undetectable cybercrime sites that steal passwords or installs malicious software.

In his tests on the client’s network, Nve says he was also able to hijack signals using GRE or TCP protocols that enterprises use to communicate between PCs and servers or between offices, using the connections to gain access to a corporation or government agency’s local area network.

The Barcelona-based researcher tested his methods on geosynchronous satellites aimed at Europe, Africa and South America. But he says there’s little doubt that the same tricks would work on satellites facing North America or anywhere else.

What makes his attacks possible, Nve says, is that DVB signals are usually left unencrypted. That lack of simple security, he says, stems from the logistical and legal complications of scrambling the signal, which might make it harder to share data among companies or agencies and–given that a satellite signal covers many countries–could run into red tape surrounding international use of cryptography. “Each [country] can have its own law for crypto,” says Nve. “It’s easier not to have encryption at the DVB layer.”

Nve isn’t the first to show the vulnerability of supposedly secure satellite connections. John Walker, a British satellite enthusiast, told the BBC in 2002 that he could watch unencrypted NATO video feeds from surveillance sorties in the Balkans. And the same lack of encryption allowed insurgents to hack into the video feed of unmanned U.S. drone planes scouting Afghanistan, the Wall Street Journal reported in December.

In fact, the techniques that Nve demonstrated are probably known to other satellite hackers but never publicized, says Jim Geovedi, a satellite security researcher and consultant with the firm Bellua in Indonesia. He compares satellite hacking to early phone hacking or “phreaking,” a practice that’s not well protected against but performed by only a small number of people worldwide. “This satellite hacking thing is still considered blackbox knowledge,” he wrote in an e-mail to Forbes. “I believe there are many people out there who conduct similar research. They may have some cool tricks but have kept them secret for ages.”

At last year’s Black Hat D.C. conference, British cybersecurity researcher Adam Laurie demonstrated how he intercepts satellite signals with techniques similar to Nve, using a DreamBox satellite receiver and Wireshark. But Nve argues that his method is far cheaper–Laurie’s DreamBox setup cost around $750–and that he’s the first to demonstrate satellite signal hijacking rather than mere interception.

“I’m not just talking about watching TV,” says Nve. “I’m talking about doing some very scary things.”

 

 

At 12:57 PM, Anonymous satellite_hacker said…

Satellite hacking for fun isn’t cheap! One of the sessions I was really looking forward to ahead of the Black Hat DC event this year was Adam Laurie’s session titled – Satellite Hacking for Fun and Profit.

It’s a session that didn’t disappoint, Laurie is always entertaining, but it also revealed how much effort is actually required to try and get at satellite signals.

First off, Laurie prefaced his talk by noting that he wasn’t going to talk about hacking the actual satellite in space itself.

“I’m playing it safe and just looking at what is coming down,” Laurie told the Black Hat audience.

Instead what Laurie focused his talk on was something he called ‘Feed Hunting’ – that is looking for satellite feeds that are not supposed to be found. Laurie claimed that he has been doing satellite feed hunting for years – at least as far back as the untimely demise of the late Princess Diana in 1997. Laurie claimed that he was able to find a non-public feed from a TV broadcaster that had left their transponder on in a Paris hotel room.

Fast forward a dozen years and Laurie commented that the technology to identify satellite feeds has progressed dramatically. Among the reasons why he satellite feed hunting has gotten easier is an open source based satellite received called the dreambox.

Laurie explained that the dreambox has a web interface that makes it easier to find streams and provides information on what the stream includes. Another open source technology also helps to feed hunt satellite content.

A project called dvbsnoop is a DVB (dIgital video broadcasting) and MPEG stream analyzer that lets the user access raw data from DVB card. By sifting through the raw data, Laurie demonstrated that interesting satellite feeds that weren’t intended to be public could be found.

Going a step further, Laurie claimed that he had created his own python based script called dreaMMap that could create a 3d model of satellite frequency transmissions. With the 3D model the user just does a point and click to steer dish to a particular satellite frequency. One memory of the Black Hat audience asked Laurie if what he was doing was legal. Laurie shrugged and commented:

“I’m in the US giving a talk where I’m tunneled to my server in the UK and looking at a satellite in space that is over Africa – so who would get me?”

All told there is a financial cost to Laurie’s satellite feed hunting techniques – and that cost is approximately $785 for the Dreambox hardware, the actual satellite dish and then the motor and the mount for the dish. Well I guess if you’ve got the money to burn…

SOURCE: Satellite Internet Blog

By

Tags: , , , , , , ,


Readers Comments (2)

  1. dagyboy

    i would like to be able to get satellite internet out in the sticks here in Australia. would like to know “the cost” of a “hacked system” including the parts or equipment needed to gain satellite internet access. have got a satellite television dish with a hacked “card” but they changed the frequency was changed and no longer have television either. any info would be greatly appreciated. thanks.

    Reply »
  2. Sarah

    The title says “How to…” ?

    Reply »




Powered by sweetCaptcha


"In Life, the mystery we unravel is relative to the questions we are willing to ask. Pursuing reality's enigmas begins with difficult questions, but the answers have never been more accessible. Now is the time to decide if you are ready to surrender all bias, and make friends with the unknown."
-Max Maverick-
Disclaimer & Fair Use
This website may contain copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available in efforts to advance the understanding of humanity's challenges and ideally to help uncover valid, achievable solutions for those challenges [self-imposed evolutionary limitations]. This website preserves & archives valuable information that is now more often being censored or wiped from its original source. Thus, we find this constitutes a 'fair use' of any such copyrighted material as provided for in section 107 of the US Copyright Law. In accordance with Title 17 U.S.C. Section 107, the material on this site is distributed without profit to those who have expressed a prior interest in receiving the included information for research and educational purposes. Reading the articles posted on this website represents such a request for information. Consistent with this notice you are welcome to make 'fair use' of anything you find in the archives. However, if you wish to use copyrighted material from this website for purposes of your own that go beyond 'fair use', you must obtain permission from the copyright owner. You can read more about 'fair use' and US Copyright Law at the Legal Information Institute of Cornell Law School.