This is relying on the classical approach of the ground equipment operated by satellite operator or internet provider relying on satellite. The upstream and the

This is relying on the classical approach of the ground equipment operated by satellite operator or internet provider relying on satellite. The upstream and the downstream are independent from each other. Usually you have two independent channels for encapsulation : a DVB-S/DVB-S2 (with MPE encapsulation) on the downstream and a proprietary DVB-RCS (a strange concept for a standard ;-) on the upstream. By so, it was somehow difficult to keep track of active terminal as packet encapsulation and decapsulation as this is often independent infrastructure doing so. By so, an attacker could benefit from this lack of state tracking, by injecting packet in one direction to have a functional transmission channel. This allows collateral attacks on the downstream when the traffic is unauthenticated and in clear (like some explained in the slides at BlackHat). To limit such attacks, an authentication and encryption layer/scheme must be provided on the downstream (and a smaller scale, on the upstream). Some VSAT equipment suppliers implement such scheme (including protocol keys distribution scheme among terminals) but it's not regularly the case due to incompatibilities with existing terminals or other limitations.