20 ms·

How hackers abused satellites to stay under the radar (2015)

232 points by nwrk 9y ago

throwanem 9y ago
Dan Goodin has been writing articles about technology for many years now. How does he manage to keep doing so in such utterly incomprehensible fashion? I mean, I get that it's not intended for an audience of seasoned network engineers, but I don't see how it would leave a layman with a useful impression, either...
ryanmarsh 9y ago
So then how was this discovered?
- cowholio4 9y ago
  I assume by looking at the command and control ips and looking for what is common. (IE that they were from satellite ISPs) You can read the original post here: https://securelist.com/72081/satellite-turla-apt-command-and-control-in-the-sky/ https://securelist.com/72081/satellite-turla-apt-command-and...
ChuckMcM 9y ago
Ok, that is pretty interesting. I wonder if this will lead to an encrypted signal or deeper analysis of the uplink firewall logs. I would guess you would defeat this once you know the C&C is operating by doing traffic correlation on 'bad' connections (connections which should not exist given the failed TCP handshake). Presuming you have core router access at the ISPs then you would tell your sniffer to capture all traffic after a C&C sequence detect and then work it backward to correlate related traffic. It would require participation on the part of the ISPs.
- topranks 9y ago
  Proper reverse path filtering would also work. The C&C servers should not be able to spoof the IP of the legitimate satellite internet user to reply to the eavsdropped packets. One day. https://tools.ietf.org/html/rfc2827 https://tools.ietf.org/html/rfc2827
politician 9y ago
Are these satellites in geosynchronous orbit? If not, and you've got a copy of the malware, you ought to be able to narrow the location of the C&C server using its orbit and a correlation analysis of when the malware receives comms from the C&C. Depending on the orbit, I'll bet you could bracket it to a few degrees. Since the attackers can't stop answering C&C calls or their network collapses, merely publishing that you're doing such a search might be enough to disrupt their operations. Then again, maybe this blog post was just such an announcement. EDIT: I'm willing to bet that satellite downlink performance degrades in bad weather, so even if the sats are in geo-sync, you can just wait for inclement weather to mask a region of the cone.
- politician 9y ago
  Their best bet is to have multiple mobile C&C centers doing a random traverse around the cone and using some sort of scheme to decide who answers which calls - a consistent hashing scheme would work. Of course, those paths would probably follow major roads, reducing the solution space to find a mobile adversary -- they aren't going to be roaming over open fields / not all points are equally probable. It's an interesting cat-and-mouse problem, to be sure, but the blue team has far more computing power.
- plq 9y ago
  $DAYJOB is about deploying satellite equipment. > Are these satellites in geosynchronous orbit? Yes. Satellites in other orbits require tracking antennas. A typical one has a four-figure cost at the very least. And if you need uninterrupted connection, you need to have at least two of them, one for tracking the one that sets, and another for tracking the one that rises. > I'm willing to bet that satellite downlink performance degrades in bad weather Ku band, as deployed, is highly resilient to bad weather. The SNR will drop, sure, but it will be well above the threshold where it will be unintelligible to the receiver. These things are designed with worst weather conditions in mind. If ever you lost satellite tv during bad weather, that's due to your antenna shaking because of the wind, not rainfade. DVB-S2 in particular supports adaptive coding modulation (ACM). The standard supports between 4psk and 32psk which can be changed by the ground station when fade is detected in their reference terminals scattered around the footprint region. You can't really do that for TV links where the bandwidth allocation is more-or-less constant, but you can definitely change modulation for data links which are actually designed to handle such fluctuations in available bandwidth.
thefreeman 9y ago
So this has to be some sort of state sponsored hacking right? I can't think of a non government group who would have the knowledge, money, or motivation to research this just to mask their origin when there are far simpler ways of receiving transactions (ie. bitcoin)
- joe_the_user 9y ago
  It's supposedly part of the Turla malware system, which was already suspected of being a state sponsored system. However, I think there are many ways to mask origin. I wonder if this particular approach is intended so it becomes difficult to even shut down the botnet's C&C. [speculation]Using a fixed domain or ip-address for C&C let's authorities seize it and even a sequence you can predict might be predicted by someone else. This can broadcast its presence to an arbitrarily chosen IP address of the class of those going out to the satellite receivers and the C&C can filter all the traffic for this "I am here" message and can then conventionally communicate to the box - making blocking or spoof the C&C harder. [/speculation]
- sillysaurus3 9y ago
  Not necessarily. I briefly pretended to be a criminal, mostly for fun. (Most readers will go "Uh huh" at this, but it was just a game.) Say you're developing the next Silk Road. Say you have perfect opsec, and you never reveal any personal info. What are your risks? The #1 risk is discovery of your physical location. Before every action, you must ask yourself: Will the next keystroke get me caught? It takes immense discipline. I think rtm could probably do it if he put his mind to it. Maybe tlb. Few others seem to have the personality for this. Solving the location hiding problem is the first step toward doing anything untoward. It's not as simple as "just use Tails." Try to build a service and you'll discover all the reasons. Money is the other half. I guess I may as well tell the story. You need money in certain situations, and bitcoin isn't always good enough. You need untraceable cash that you can spend online. You also need burner phones that can't be tied to your physical location in order to sign up for all the normal services. If you use Tor, you'll quickly discover that ~every service prompts you for a phone number during account creation. I solved this in a simple way: I waited until the middle of winter, then went to goodwill and bought a bunch of clothes, old shoes, and a facemask. I stuffed all of this in a trashbag, then paid a taxi in cash to drop me a couple miles from a certain store that had both prepaid visa cards and burner phones. For the first half of the walk, I looked like a normal person walking along at night, carrying a trashbag. I ducked into a neighborhood whose streetlights were out, and went in between two houses. It was nearly pitch black as I put on the clothes from the trashbag. I left the bag plus my old shoes hidden there, then continued for the rest of the walk to the store. I bought $400 worth of $50 gift cards and two prepaid phones, then did the whole operation in reverse. Why? Because when your opponent is a nation-state, you have a risk of being found via any other method. You can't drive anywhere because of license plate trackers. You can't show your face at the store thanks to facial recognition. You can't wear the same outfit without being picked up on CCTV's near your home base in the same outfit that you were wearing at the store. The same care has to be taken when activating and using the burner phones. Every usage has to be treated as an operation, not an errand, or you're caught. You have to assume one mistake => caught. It was very satisfying having $400 in untraceable cash to set up an untraceable service, complete with an online persona with gmail, twitter, github, and every other normal service. The reason for this level of paranoia was that in addition to being a game, one of my main ambitions has been to fight against drug cartels. I wanted to use technology to do this. My hypothesis was that right now, the main reason cartels are so powerful is that nobody is in a position to talk. Say you're a peon in a cartel: someone who unloads the drug buses that run from Mexico to Chicago, for example. You have very valuable knowledge: what times the buses will arrive, where they're unloading, who's involved. But even if you wanted to snitch, you'd suffer a fate worse than death if you're caught. What are you going to do? Keep submitting this info as anonymous tips to the FBI's website? There's no organized resource for peons to report activities like this. That's why I wanted to build one. It's like SecureDrop for fighting cartels rather than governments. As you can tell from me posting this casually, nothing ever came of the experiment. But if it had, I would've slept quite soundly knowing my location was untraceable even with government-level resources aimed at tracking us down. All of this is to say that the "location problem" is very relevant to pretty much any serious activity, government or not.
Eun 9y ago
tldr: https://youtube.com/watch?v=Du3rBVZqKkk https://youtube.com/watch?v=Du3rBVZqKkk
deleted 9y ago
[deleted]
cm2187 9y ago
I don't get it. It is impossible to identify who receives the packets but TCP/IP requires an acknowledgement that the packets have been received before sending more packets. Surely the C&C could be tracked from this acknowledgement? Or were they using UDP?
- foota 9y ago
  It sounds like the c&c server can detect any signal sent to the decoy host. So a TCP handshake might look like: Victim to decoy: syn CNC to victim posing as decoy, after reading sequence number from message 1: syn ack Victim to decoy: ack
- qb45 9y ago
  I too wondered about it, unless the communication is 100% unidirectional they must have some means of disguising the source of outgoing packets, probably involving at least source IP spoofing.
- emj 9y ago
  For this to work you need: 1. satellite client decoy system that drops packages (not deny) 2. satellite client listening system 3. an other network connection that allowed source spoofing. If you are contacted on the decoy system you just send the syn+ack packet with the other network with a spoofed address. You will be able to receive all the responses on the satellite connection and send all the responses on the source spoofing network connection.
- zkms 9y ago
  UDP for everything would be workable and would remove the need for any sort of spoofing on the uplink.
  - VectorLock 9y ago
    That would work for exfiltration, but not for the whole "command and control" part of C&C.
zkms 9y ago
This beautiful exfiltration technique of actively sending packets to an IP address that will be routed on a link you can passively eavesdrop on -- in this case, a satellite link -- is one that appears in the leaked Snowden documents: (warning, classified document) https://snowdenarchive.cjfe.org/greenstone/collect/snowden1/index/assoc/HASHfae2.dir/doc.pdf https://snowdenarchive.cjfe.org/greenstone/collect/snowden1/...
- eddd 9y ago
  I love the last slide: - do "the right thing" (whatever you the analysts think that is) - Let me guess - you want everything, don't you?
diegoprzl 9y ago
The last time I had read about this technique was in 2010. [1] Those slides are a very good explanation. Back then I thought about it as a way to either sniff confidential data from the downlink or as a way to have an anonymous internet connection provided your ISP doesn't filter spoofed ips. Very interesting to see it used in the wild and for a C&C. [1] http://www.blackhat.com/presentations/bh-dc-10/Nve_Leonardo/BlackHat-DC-2010-Nve-Playing-with-SAT-1.2-slides.pdf http://www.blackhat.com/presentations/bh-dc-10/Nve_Leonardo/...
gnode 9y ago
I don't understand how this allowed them to conceal their location. Surely whatever connection was being used to send commands could be traced back to the attackers. Could someone explain why this isn't the case?
- forgottenpass 9y ago
  The spoofed traffic theoretically could be traced back, but at the level of internet routing it would impose a huge cooperation and monitoring requirements on a number of networks. (As we can presume the origin network that's letting spoofed traffic onto the internet isn't going to notice, and/or would be uncooperative to someone investigating the source of the traffic.) And that monitoring would have to have been active while the traffic spoofing was ongoing. If an ISP has confidence that incoming traffic is spoofed they'll just drop the packets instead of routing. So we're now talking about storing metadata on traffic for after-the-fact analysis, which could be prohibitively expensive considering the amount of traffic transiting networks, and has privacy implications.
libeclipse 9y ago
I don't understand how this works. The article doesn't go into much depth. They listen on data coming from a satellite for certain IPs, then connect to those IPs directly? How does that allow two-way communication?
- fireflash38 9y ago
  If I understand this correctly: 1. Infected system sends packets to a decoy 2. The decoy ignores the fake packets (dropped by firewall) 3. The real command center which is located in the same region as the decoy accepts the packets [1] 4. Real command center can still send commands to infected system via landline, but receive data by satellite. [1] Satellite downlink data is sent to a relatively large area.
  - deleted 9y ago
    [deleted]
  - libeclipse 9y ago
    Infected system sends packets to a decoy what? Satellite? And then the satellite forwards it.
    - rblatz 9y ago
      Lets say John lives near (200 miles away) the C&C server and that John's IP is 192.168.7.2. John is the decoy, so the malware sends requests to John's IP. John doesn't get the requests, due to his firewall blocking them, leaving these lingering open tcp connections. So the C&C server is free to finish the TCP handshake spoofing their IP to be 192.168.7.2 As far as anyone can tell they are John, but when you go to John's house to shut down the C&C server you end up at a dead end.
      - libeclipse 9y ago
        1) How does the satellite come into this. 2) How does the C&C server complete the request. Are the hanging ports on the victim's side? 3) If the C&C server completes the connection, how do they carry on talking? Just like spoofing IPs, you can't ever get a reply. Or do they do the John decoy thing for every packet?
Pigo 9y ago
Is this how /pol/ found Shia's flag?
VectorLock 9y ago
What satellite internet provider isn't doing egress filtering on their customers land-line connections? Asking for a friend...
kusmi 9y ago
why pharmacutical companies I wonder?
x0ner 9y ago
I've done a significant amount of research on these threat actors. Despite the high tech exfiltration method and nation state support, researchers were still able to easily find their infrastructure. Satellite communications were encrypted via self-signed ssl certificates. Using internet scanning, we could track their IP addresses and associated domains using the SHA-1 of their certificate (map certificate to hosting IP). Happy to answer questions, but you can also read more here. https://blog.passivetotal.org/snakes-in-the-satellites-on-going-turla-infrastructure/ https://blog.passivetotal.org/snakes-in-the-satellites-on-go...

232 points by nwrk 9y ago

Dan Goodin has been writing articles about technology for many years now. How does he manage to keep doing so in such utterly incomprehensible fashion? I mean, I get that it's not intended for an audience of seasoned network engineers, but I don't see how it would leave a layman with a useful impression, either...

ryanmarsh 9y ago

So then how was this discovered?

cowholio4 9y ago
I assume by looking at the command and control ips and looking for what is common. (IE that they were from satellite ISPs) You can read the original post here: https://securelist.com/72081/satellite-turla-apt-command-and-control-in-the-sky/ https://securelist.com/72081/satellite-turla-apt-command-and...

ChuckMcM 9y ago

Ok, that is pretty interesting. I wonder if this will lead to an encrypted signal or deeper analysis of the uplink firewall logs. I would guess you would defeat this once you know the C&C is operating by doing traffic correlation on 'bad' connections (connections which should not exist given the failed TCP handshake). Presuming you have core router access at the ISPs then you would tell your sniffer to capture all traffic after a C&C sequence detect and then work it backward to correlate related traffic. It would require participation on the part of the ISPs.

topranks 9y ago
Proper reverse path filtering would also work. The C&C servers should not be able to spoof the IP of the legitimate satellite internet user to reply to the eavsdropped packets. One day. https://tools.ietf.org/html/rfc2827 https://tools.ietf.org/html/rfc2827

politician 9y ago

Are these satellites in geosynchronous orbit? If not, and you've got a copy of the malware, you ought to be able to narrow the location of the C&C server using its orbit and a correlation analysis of when the malware receives comms from the C&C. Depending on the orbit, I'll bet you could bracket it to a few degrees. Since the attackers can't stop answering C&C calls or their network collapses, merely publishing that you're doing such a search might be enough to disrupt their operations. Then again, maybe this blog post was just such an announcement. EDIT: I'm willing to bet that satellite downlink performance degrades in bad weather, so even if the sats are in geo-sync, you can just wait for inclement weather to mask a region of the cone.

politician 9y ago
Their best bet is to have multiple mobile C&C centers doing a random traverse around the cone and using some sort of scheme to decide who answers which calls - a consistent hashing scheme would work. Of course, those paths would probably follow major roads, reducing the solution space to find a mobile adversary -- they aren't going to be roaming over open fields / not all points are equally probable. It's an interesting cat-and-mouse problem, to be sure, but the blue team has far more computing power.
plq 9y ago
$DAYJOB is about deploying satellite equipment. > Are these satellites in geosynchronous orbit? Yes. Satellites in other orbits require tracking antennas. A typical one has a four-figure cost at the very least. And if you need uninterrupted connection, you need to have at least two of them, one for tracking the one that sets, and another for tracking the one that rises. > I'm willing to bet that satellite downlink performance degrades in bad weather Ku band, as deployed, is highly resilient to bad weather. The SNR will drop, sure, but it will be well above the threshold where it will be unintelligible to the receiver. These things are designed with worst weather conditions in mind. If ever you lost satellite tv during bad weather, that's due to your antenna shaking because of the wind, not rainfade. DVB-S2 in particular supports adaptive coding modulation (ACM). The standard supports between 4psk and 32psk which can be changed by the ground station when fade is detected in their reference terminals scattered around the footprint region. You can't really do that for TV links where the bandwidth allocation is more-or-less constant, but you can definitely change modulation for data links which are actually designed to handle such fluctuations in available bandwidth.

thefreeman 9y ago

So this has to be some sort of state sponsored hacking right? I can't think of a non government group who would have the knowledge, money, or motivation to research this just to mask their origin when there are far simpler ways of receiving transactions (ie. bitcoin)

joe_the_user 9y ago
It's supposedly part of the Turla malware system, which was already suspected of being a state sponsored system. However, I think there are many ways to mask origin. I wonder if this particular approach is intended so it becomes difficult to even shut down the botnet's C&C. [speculation]Using a fixed domain or ip-address for C&C let's authorities seize it and even a sequence you can predict might be predicted by someone else. This can broadcast its presence to an arbitrarily chosen IP address of the class of those going out to the satellite receivers and the C&C can filter all the traffic for this "I am here" message and can then conventionally communicate to the box - making blocking or spoof the C&C harder. [/speculation]
sillysaurus3 9y ago
Not necessarily. I briefly pretended to be a criminal, mostly for fun. (Most readers will go "Uh huh" at this, but it was just a game.) Say you're developing the next Silk Road. Say you have perfect opsec, and you never reveal any personal info. What are your risks? The #1 risk is discovery of your physical location. Before every action, you must ask yourself: Will the next keystroke get me caught? It takes immense discipline. I think rtm could probably do it if he put his mind to it. Maybe tlb. Few others seem to have the personality for this. Solving the location hiding problem is the first step toward doing anything untoward. It's not as simple as "just use Tails." Try to build a service and you'll discover all the reasons. Money is the other half. I guess I may as well tell the story. You need money in certain situations, and bitcoin isn't always good enough. You need untraceable cash that you can spend online. You also need burner phones that can't be tied to your physical location in order to sign up for all the normal services. If you use Tor, you'll quickly discover that ~every service prompts you for a phone number during account creation. I solved this in a simple way: I waited until the middle of winter, then went to goodwill and bought a bunch of clothes, old shoes, and a facemask. I stuffed all of this in a trashbag, then paid a taxi in cash to drop me a couple miles from a certain store that had both prepaid visa cards and burner phones. For the first half of the walk, I looked like a normal person walking along at night, carrying a trashbag. I ducked into a neighborhood whose streetlights were out, and went in between two houses. It was nearly pitch black as I put on the clothes from the trashbag. I left the bag plus my old shoes hidden there, then continued for the rest of the walk to the store. I bought $400 worth of $50 gift cards and two prepaid phones, then did the whole operation in reverse. Why? Because when your opponent is a nation-state, you have a risk of being found via any other method. You can't drive anywhere because of license plate trackers. You can't show your face at the store thanks to facial recognition. You can't wear the same outfit without being picked up on CCTV's near your home base in the same outfit that you were wearing at the store. The same care has to be taken when activating and using the burner phones. Every usage has to be treated as an operation, not an errand, or you're caught. You have to assume one mistake => caught. It was very satisfying having $400 in untraceable cash to set up an untraceable service, complete with an online persona with gmail, twitter, github, and every other normal service. The reason for this level of paranoia was that in addition to being a game, one of my main ambitions has been to fight against drug cartels. I wanted to use technology to do this. My hypothesis was that right now, the main reason cartels are so powerful is that nobody is in a position to talk. Say you're a peon in a cartel: someone who unloads the drug buses that run from Mexico to Chicago, for example. You have very valuable knowledge: what times the buses will arrive, where they're unloading, who's involved. But even if you wanted to snitch, you'd suffer a fate worse than death if you're caught. What are you going to do? Keep submitting this info as anonymous tips to the FBI's website? There's no organized resource for peons to report activities like this. That's why I wanted to build one. It's like SecureDrop for fighting cartels rather than governments. As you can tell from me posting this casually, nothing ever came of the experiment. But if it had, I would've slept quite soundly knowing my location was untraceable even with government-level resources aimed at tracking us down. All of this is to say that the "location problem" is very relevant to pretty much any serious activity, government or not.

Eun 9y ago

tldr: https://youtube.com/watch?v=Du3rBVZqKkk https://youtube.com/watch?v=Du3rBVZqKkk

deleted 9y ago

[deleted]

cm2187 9y ago

I don't get it. It is impossible to identify who receives the packets but TCP/IP requires an acknowledgement that the packets have been received before sending more packets. Surely the C&C could be tracked from this acknowledgement? Or were they using UDP?

foota 9y ago
It sounds like the c&c server can detect any signal sent to the decoy host. So a TCP handshake might look like: Victim to decoy: syn CNC to victim posing as decoy, after reading sequence number from message 1: syn ack Victim to decoy: ack
qb45 9y ago
I too wondered about it, unless the communication is 100% unidirectional they must have some means of disguising the source of outgoing packets, probably involving at least source IP spoofing.
emj 9y ago
For this to work you need: 1. satellite client decoy system that drops packages (not deny) 2. satellite client listening system 3. an other network connection that allowed source spoofing. If you are contacted on the decoy system you just send the syn+ack packet with the other network with a spoofed address. You will be able to receive all the responses on the satellite connection and send all the responses on the source spoofing network connection.
zkms 9y ago
UDP for everything would be workable and would remove the need for any sort of spoofing on the uplink.
- VectorLock 9y ago
  That would work for exfiltration, but not for the whole "command and control" part of C&C.

zkms 9y ago

This beautiful exfiltration technique of actively sending packets to an IP address that will be routed on a link you can passively eavesdrop on -- in this case, a satellite link -- is one that appears in the leaked Snowden documents: (warning, classified document) https://snowdenarchive.cjfe.org/greenstone/collect/snowden1/index/assoc/HASHfae2.dir/doc.pdf https://snowdenarchive.cjfe.org/greenstone/collect/snowden1/...

eddd 9y ago
I love the last slide: - do "the right thing" (whatever you the analysts think that is) - Let me guess - you want everything, don't you?

diegoprzl 9y ago

The last time I had read about this technique was in 2010. [1] Those slides are a very good explanation. Back then I thought about it as a way to either sniff confidential data from the downlink or as a way to have an anonymous internet connection provided your ISP doesn't filter spoofed ips. Very interesting to see it used in the wild and for a C&C. [1] http://www.blackhat.com/presentations/bh-dc-10/Nve_Leonardo/BlackHat-DC-2010-Nve-Playing-with-SAT-1.2-slides.pdf http://www.blackhat.com/presentations/bh-dc-10/Nve_Leonardo/...

gnode 9y ago

I don't understand how this allowed them to conceal their location. Surely whatever connection was being used to send commands could be traced back to the attackers. Could someone explain why this isn't the case?

forgottenpass 9y ago
The spoofed traffic theoretically could be traced back, but at the level of internet routing it would impose a huge cooperation and monitoring requirements on a number of networks. (As we can presume the origin network that's letting spoofed traffic onto the internet isn't going to notice, and/or would be uncooperative to someone investigating the source of the traffic.) And that monitoring would have to have been active while the traffic spoofing was ongoing. If an ISP has confidence that incoming traffic is spoofed they'll just drop the packets instead of routing. So we're now talking about storing metadata on traffic for after-the-fact analysis, which could be prohibitively expensive considering the amount of traffic transiting networks, and has privacy implications.

libeclipse 9y ago

I don't understand how this works. The article doesn't go into much depth. They listen on data coming from a satellite for certain IPs, then connect to those IPs directly? How does that allow two-way communication?

fireflash38 9y ago
If I understand this correctly: 1. Infected system sends packets to a decoy 2. The decoy ignores the fake packets (dropped by firewall) 3. The real command center which is located in the same region as the decoy accepts the packets [1] 4. Real command center can still send commands to infected system via landline, but receive data by satellite. [1] Satellite downlink data is sent to a relatively large area.
- deleted 9y ago
  [deleted]
- libeclipse 9y ago
  Infected system sends packets to a decoy what? Satellite? And then the satellite forwards it.
  - rblatz 9y ago
    Lets say John lives near (200 miles away) the C&C server and that John's IP is 192.168.7.2. John is the decoy, so the malware sends requests to John's IP. John doesn't get the requests, due to his firewall blocking them, leaving these lingering open tcp connections. So the C&C server is free to finish the TCP handshake spoofing their IP to be 192.168.7.2 As far as anyone can tell they are John, but when you go to John's house to shut down the C&C server you end up at a dead end.
    - libeclipse 9y ago
      1) How does the satellite come into this. 2) How does the C&C server complete the request. Are the hanging ports on the victim's side? 3) If the C&C server completes the connection, how do they carry on talking? Just like spoofing IPs, you can't ever get a reply. Or do they do the John decoy thing for every packet?

Pigo 9y ago

Is this how /pol/ found Shia's flag?

VectorLock 9y ago

What satellite internet provider isn't doing egress filtering on their customers land-line connections? Asking for a friend...

kusmi 9y ago

why pharmacutical companies I wonder?

x0ner 9y ago

I've done a significant amount of research on these threat actors. Despite the high tech exfiltration method and nation state support, researchers were still able to easily find their infrastructure. Satellite communications were encrypted via self-signed ssl certificates. Using internet scanning, we could track their IP addresses and associated domains using the SHA-1 of their certificate (map certificate to hosting IP). Happy to answer questions, but you can also read more here. https://blog.passivetotal.org/snakes-in-the-satellites-on-going-turla-infrastructure/ https://blog.passivetotal.org/snakes-in-the-satellites-on-go...