6 ms·

Decoding Data from Iridium Satellites

168 points by yashinm92 10y ago

MrBuddyCasino 10y ago
> Later in the presentation he shows some interesting examples such as an intercepted Iridium satellte phone call to a C-37 aircraft. So Iridium has been cracked, and no reactions so far? Am I missing something? This sounds like a Big Deal.
- noselasd 10y ago
  No. As with other satellite phones, security/encryption is an additional feature that you buy. For everyone else, there's no security/encryption - you just need to implement the system and protocols to tap into it - which is what has been done here. (And for the parts that have encryption, it's the data that's encrypted, while metadata (e.g. call setup) is still plain text)
  - MrBuddyCasino 10y ago
    That puts it into perspective, thanks. Interesting that unprotected metadata is something that the US army is willing to accept.
  - manarth 10y ago
    Here's a transcript of the intercepted call that they played: > You have reached the 310 airlift squadron C-37 aircraft, tail number 0028. > To call the CSL press 1. > To call secure telephone number one, press 2. > To call secure telephone number two, press <missing> > Satcom direct Inmarsat connection in progress, please hold while we attempt to connect your call. > The approximate global connect time is <missing> > <ringing> I suppose that selecting to connect to the secure phones could trigger an encryption layer on top of the call.
  - rsync 10y ago
    Also ... correct me if I misremember ... but I think it is the case that with Iridium - encryption or no encryption - Eve can discern your physical location and get GPS coordinates for you. Am I remembering that correctly ? I believe that got some journalists killed in Syria a few years ago ...
    - pjc50 10y ago
      I remember hearing that as well, although I can't find a citation.
    - fisherjeff 10y ago
      They mention in the talk that the satellite will periodically downlink both its location as well as where it thinks the particular spot beam you're using hits the earth. So while at the very least I'm not sure you'd get GPS-quality data, if you monitored that data for awhile I'd think you could eventually get "good enough" accuracy.
    - netsharc 10y ago
      I've also read about the Syrian bombs targeting Iridium users. Maybe they used triangulation to locate the source of the signal that was being broadcast from earth. Does/did the Syrian govt have that tech? Would they need satellites, or would helicopters be enough? And which government/supplier did they buy it from?
      - ris 10y ago
        You can probably deduce quite a lot position-wise by observing the doppler shifts and doppler shift corrections.
  - exabrial 10y ago
    Whats the timestamp in the youtube video for that
- kejaed 10y ago
  It sort of like how US drones used to broadcast video unencrypted. They didn't bother since they thought the barrier to entry for seeing the feed was too high, until it wasn't. https://www.wired.com/2012/10/hack-proof-drone/ https://www.wired.com/2012/10/hack-proof-drone/
  - digi_owl 10y ago
    Nobody seems to have learned a thing since the phreakers poked and prodded the phone network...
  - rasz_pl 10y ago
    same story with israeli drones https://theintercept.com/2016/01/28/israeli-drone-feeds-hacked-by-british-and-american-intelligence/ https://theintercept.com/2016/01/28/israeli-drone-feeds-hack...
- revelation 10y ago
  There was nothing to crack, the only security is in the availability of easy-to-use receivers. Assume that any intelligence agency in the world has an archive of Iridium transmissions going many years back.
  - digi_owl 10y ago
    Was there not some talk about how Taliban or some such used open sat coms, and still "we" were unable to find them?
deleted 10y ago
[deleted]
finchisko 10y ago
It's not surprising considering age of Iridium. Also I believe they don't make lot of money, so any development (also security related) is pretty much ceased.
- dasmoth 10y ago
  They make enough money that they've been able to fund the construction of a new generation of satellites. The first batch is due to launch next month.
- iheartmemcache 10y ago
  Iridium is basically only still in business because of US armed forces (and maybe diplomatic services? though not sure how much field work they do..) operational dependencies. Editorial retraction, mea culpa: Wrong about the TACSAT statement here. See parent below for the http://www.airspacemag.com/space/the-rise-and-fall-and-rise-of-iridium-5615034/?no-ist http://www.airspacemag.com/space/the-rise-and-fall-and-rise-... Post chapter-11 (2000), investors got the whole Iridium infrastructure at sub-pennies on the dollar. (Literally. They got it for the price of the _single launch_ (i.e., not including materials, R&D, labor, etc) of their multitude (60ish) of sub-orbitals.). Which I'm sure they're selling at absurd prices thanks to Sept 11. Editorial retraction, mea culpa, #2 [conflated the hell out of ARSOF, again, see below. The economic analysis + usage of Iridium still holds.] C-37 is USAF aircraft - this dude seriously compromised his personal security by making this talk [and implicitly, his identity] public. He's going to have the pleasure of having SSSS scribbled onto every airline ticket he purchases from now on, I'd wager. Iridium was such a brilliant buy. ROI at must be absolute insanity. @Dasmoth - 64 billion dollars in grey-money was allocated for "Overseas Contingency Operations" by the Omnibus bill last December. I'm sure SAIC/Northrup/whoever gets the contract to 'fix this hole' is going to be enjoying the 800 million they secure from the Pentagon to basically modify transmissions/upgrade the firmware of the phones to use Diffie-Hellman handshakes and AES haha.
  - nxzero 10y ago
    SSSS is meaningless, never heard of anyone that had meaningful issues as a result of having this flag. What is SSSS? See the Wikipedia page: https://en.m.wikipedia.org/wiki/Secondary_Security_Screening_Selection https://en.m.wikipedia.org/wiki/Secondary_Security_Screening...
wyldfire 10y ago
The doppler shift described at ~14:45 was a really interesting component of Iridium that I recall when I learned about it many years ago. These guys are great, this was an enjoyable presentation.
- misterdata 10y ago
  The doppler shfit also supposedly provided a clue about the whereabouts of MH370 after it disappeared: https://theaviationist.com/2014/03/27/inmarsat-helps-finding-route/ https://theaviationist.com/2014/03/27/inmarsat-helps-finding...
  - jandrese 10y ago
    To be fair, that wasn't Iridium, that was INMARSAT. Completely different company with a very different satellite system.
nneonneo 10y ago
Direct link to the talk - https://www.youtube.com/watch?v=cvKaC4pNvck https://www.youtube.com/watch?v=cvKaC4pNvck CCC Munchen wiki pages on Iridium: https://wiki.muc.ccc.de/iridium:start https://wiki.muc.ccc.de/iridium:start GitHub for the Iridium decoder software: https://github.com/muccc/gr-iridium https://github.com/muccc/gr-iridium
- mintplant 10y ago
  Thanks for the direct link. rtl-sdr.com seems to be having some issues at the moment.
robszumski 10y ago
Can anyone share articles about how these satellites are _managed_ remotely by their administrators, and the security around those connections? I know newer entrants like Planet Labs run normal Linux on their satellites, and I assume use a normal SSH connection. What do the older platforms use? How do they move the key material around to the different ground stations?
- tonyarkles 10y ago
  I'm really hoping that the specific name of the software package comes to mind. There's a super old ground terminal command & data handling (C&DH) package that is very very common. It runs on Linux, and has a UI that looks like it's written using Motif. I haven't worked in the space industry for almost 10 years now, but that was everywhere when I was there. And I'm hoping that the name will come to mind over the next few hours and I can edit this post :) Edit: Success! ITOS: http://itos.gsfc.nasa.gov/index.php http://itos.gsfc.nasa.gov/index.php
neom 10y ago
this is so weird; http://john.je/hKnG http://john.je/hKnG
- rasz_pl 10y ago
  drug dealers or outsourced cia rendition/black ops
- nolanpro 10y ago
  At least those guys know it's not encrypted.
digi_owl 10y ago
That XML they found in the SDB channel seems like has to do with EU and fisheries. I guess it could be catch reports from trawlers. And the FTP upload seems to be for the Air Force Weather Agency. Also, a Mandrake 9.2 install doing a PPP dialup via iridium voice?! The world is indeed stranger than fiction.

168 points by yashinm92 10y ago

> Later in the presentation he shows some interesting examples such as an intercepted Iridium satellte phone call to a C-37 aircraft. So Iridium has been cracked, and no reactions so far? Am I missing something? This sounds like a Big Deal.

noselasd 10y ago
No. As with other satellite phones, security/encryption is an additional feature that you buy. For everyone else, there's no security/encryption - you just need to implement the system and protocols to tap into it - which is what has been done here. (And for the parts that have encryption, it's the data that's encrypted, while metadata (e.g. call setup) is still plain text)
- MrBuddyCasino 10y ago
  That puts it into perspective, thanks. Interesting that unprotected metadata is something that the US army is willing to accept.
- manarth 10y ago
  Here's a transcript of the intercepted call that they played: > You have reached the 310 airlift squadron C-37 aircraft, tail number 0028. > To call the CSL press 1. > To call secure telephone number one, press 2. > To call secure telephone number two, press <missing> > Satcom direct Inmarsat connection in progress, please hold while we attempt to connect your call. > The approximate global connect time is <missing> > <ringing> I suppose that selecting to connect to the secure phones could trigger an encryption layer on top of the call.
- rsync 10y ago
  Also ... correct me if I misremember ... but I think it is the case that with Iridium - encryption or no encryption - Eve can discern your physical location and get GPS coordinates for you. Am I remembering that correctly ? I believe that got some journalists killed in Syria a few years ago ...
  - pjc50 10y ago
    I remember hearing that as well, although I can't find a citation.
  - fisherjeff 10y ago
    They mention in the talk that the satellite will periodically downlink both its location as well as where it thinks the particular spot beam you're using hits the earth. So while at the very least I'm not sure you'd get GPS-quality data, if you monitored that data for awhile I'd think you could eventually get "good enough" accuracy.
  - netsharc 10y ago
    I've also read about the Syrian bombs targeting Iridium users. Maybe they used triangulation to locate the source of the signal that was being broadcast from earth. Does/did the Syrian govt have that tech? Would they need satellites, or would helicopters be enough? And which government/supplier did they buy it from?
    - ris 10y ago
      You can probably deduce quite a lot position-wise by observing the doppler shifts and doppler shift corrections.
- exabrial 10y ago
  Whats the timestamp in the youtube video for that
kejaed 10y ago
It sort of like how US drones used to broadcast video unencrypted. They didn't bother since they thought the barrier to entry for seeing the feed was too high, until it wasn't. https://www.wired.com/2012/10/hack-proof-drone/ https://www.wired.com/2012/10/hack-proof-drone/
- digi_owl 10y ago
  Nobody seems to have learned a thing since the phreakers poked and prodded the phone network...
- rasz_pl 10y ago
  same story with israeli drones https://theintercept.com/2016/01/28/israeli-drone-feeds-hacked-by-british-and-american-intelligence/ https://theintercept.com/2016/01/28/israeli-drone-feeds-hack...
revelation 10y ago
There was nothing to crack, the only security is in the availability of easy-to-use receivers. Assume that any intelligence agency in the world has an archive of Iridium transmissions going many years back.
- digi_owl 10y ago
  Was there not some talk about how Taliban or some such used open sat coms, and still "we" were unable to find them?

deleted 10y ago

[deleted]

finchisko 10y ago

It's not surprising considering age of Iridium. Also I believe they don't make lot of money, so any development (also security related) is pretty much ceased.

dasmoth 10y ago
They make enough money that they've been able to fund the construction of a new generation of satellites. The first batch is due to launch next month.
iheartmemcache 10y ago
Iridium is basically only still in business because of US armed forces (and maybe diplomatic services? though not sure how much field work they do..) operational dependencies. Editorial retraction, mea culpa: Wrong about the TACSAT statement here. See parent below for the http://www.airspacemag.com/space/the-rise-and-fall-and-rise-of-iridium-5615034/?no-ist http://www.airspacemag.com/space/the-rise-and-fall-and-rise-... Post chapter-11 (2000), investors got the whole Iridium infrastructure at sub-pennies on the dollar. (Literally. They got it for the price of the _single launch_ (i.e., not including materials, R&D, labor, etc) of their multitude (60ish) of sub-orbitals.). Which I'm sure they're selling at absurd prices thanks to Sept 11. Editorial retraction, mea culpa, #2 [conflated the hell out of ARSOF, again, see below. The economic analysis + usage of Iridium still holds.] C-37 is USAF aircraft - this dude seriously compromised his personal security by making this talk [and implicitly, his identity] public. He's going to have the pleasure of having SSSS scribbled onto every airline ticket he purchases from now on, I'd wager. Iridium was such a brilliant buy. ROI at must be absolute insanity. @Dasmoth - 64 billion dollars in grey-money was allocated for "Overseas Contingency Operations" by the Omnibus bill last December. I'm sure SAIC/Northrup/whoever gets the contract to 'fix this hole' is going to be enjoying the 800 million they secure from the Pentagon to basically modify transmissions/upgrade the firmware of the phones to use Diffie-Hellman handshakes and AES haha.
- nxzero 10y ago
  SSSS is meaningless, never heard of anyone that had meaningful issues as a result of having this flag. What is SSSS? See the Wikipedia page: https://en.m.wikipedia.org/wiki/Secondary_Security_Screening_Selection https://en.m.wikipedia.org/wiki/Secondary_Security_Screening...

wyldfire 10y ago

The doppler shift described at ~14:45 was a really interesting component of Iridium that I recall when I learned about it many years ago. These guys are great, this was an enjoyable presentation.

misterdata 10y ago
The doppler shfit also supposedly provided a clue about the whereabouts of MH370 after it disappeared: https://theaviationist.com/2014/03/27/inmarsat-helps-finding-route/ https://theaviationist.com/2014/03/27/inmarsat-helps-finding...
- jandrese 10y ago
  To be fair, that wasn't Iridium, that was INMARSAT. Completely different company with a very different satellite system.

nneonneo 10y ago

Direct link to the talk - https://www.youtube.com/watch?v=cvKaC4pNvck https://www.youtube.com/watch?v=cvKaC4pNvck CCC Munchen wiki pages on Iridium: https://wiki.muc.ccc.de/iridium:start https://wiki.muc.ccc.de/iridium:start GitHub for the Iridium decoder software: https://github.com/muccc/gr-iridium https://github.com/muccc/gr-iridium

mintplant 10y ago
Thanks for the direct link. rtl-sdr.com seems to be having some issues at the moment.

robszumski 10y ago

Can anyone share articles about how these satellites are _managed_ remotely by their administrators, and the security around those connections? I know newer entrants like Planet Labs run normal Linux on their satellites, and I assume use a normal SSH connection. What do the older platforms use? How do they move the key material around to the different ground stations?

tonyarkles 10y ago
I'm really hoping that the specific name of the software package comes to mind. There's a super old ground terminal command & data handling (C&DH) package that is very very common. It runs on Linux, and has a UI that looks like it's written using Motif. I haven't worked in the space industry for almost 10 years now, but that was everywhere when I was there. And I'm hoping that the name will come to mind over the next few hours and I can edit this post :) Edit: Success! ITOS: http://itos.gsfc.nasa.gov/index.php http://itos.gsfc.nasa.gov/index.php

neom 10y ago

this is so weird; http://john.je/hKnG http://john.je/hKnG

rasz_pl 10y ago
drug dealers or outsourced cia rendition/black ops
nolanpro 10y ago
At least those guys know it's not encrypted.

digi_owl 10y ago

That XML they found in the SDB channel seems like has to do with EU and fisheries. I guess it could be catch reports from trawlers. And the FTP upload seems to be for the Air Force Weather Agency. Also, a Mandrake 9.2 install doing a PPP dialup via iridium voice?! The world is indeed stranger than fiction.