5 ms·

The Great Brazilian Sat-Hack Crackdown (2009)

104 points by wglb 8y ago

Tepix 8y ago
The design life of the system was five years, according to https://space.skyrocket.de/doc_sdat/fltsatcom-2.htm https://space.skyrocket.de/doc_sdat/fltsatcom-2.htm I'm sure the military has better ways to communicate these days. Perhaps the access should be allowed?
- moftz 8y ago
  Why give up access bandwidth on a satellite meant for last resort kinds of communications? The satellite isn't self sufficient so someone in the military has to adjust it in space. There might be older pieces of equipment out there still using the satellite so having a bunch of random people taking up bandwidth and not following the channel allocation. It's better to just enforce the rules that already exist to make sure that the resources are always available.
danilocesar 8y ago
This was 10 years ago. I hope that USMs are using better tools by now..
- w8rbt 8y ago
  Probably not. Security is full of the "We're Compliant" types (don't we have insurance for that?) and very few real technologists who know how to hack/break/abuse systems. Target was PCI compliant when their CC data was breached and exposed. There are many more examples of this. Check the box, get owned and no really cares. That needs to change.
- jandrese 8y ago
  Those birds are probably still in the air. Few comm satellites are full processing anyway so there is no mechanism to enforce it up in the sky. Normal enforcement is via having the cops show up at your door and ask why you are stealing the US Government's power and interfering with military operations.
- cronix 8y ago
  Like using open source software and not doing basic things like changing default passwords? https://www.wired.com/story/us-weapons-systems-easy-cyberattack-targets/ https://www.wired.com/story/us-weapons-systems-easy-cyberatt...
b1r6 8y ago
So these satellites are no more complex than the amateur radio birds which function as simple FM repeaters?! Typically they'll have an uplink in the 2m band, and maybe a downlink in 70cm band, or the other way around. How can a military satellite be so casual in it's decision to relay audio? You'd think some authentication method would have been built in. I guess not?
- tivert 8y ago
  Maybe the military prefers the simple over the complex. It's a lot simpler to change authentication methods in ground equipment than in orbital equipment.
- jandrese 8y ago
  Almost all comm sats are just bent pipes. Collisions are avoided via planning but that's just a gentleman's agreement at the end of the day. If you're watching with a spectrum analyzer and a decent dish it's pretty easy to see which transponders are currently idle. The downside of course is that once you start hitting a satellite with a signal they know exactly where you are and the operators will call the cops on you. Your signal is not only potentially interfering with someone who paid for the transponder, but it also impacts their energy budget. I've been told that if you rent a transponder it's important to put a signal up on it pretty quickly, otherwise pirates will attempt to "borrow" it from you, and they can be hard to evict.
  - samstave 8y ago
    How do I get more info on this? This sounds like a fantastic subject to learn about.
    - ablation 8y ago
      Seconded. The article and these comments leave me wanting more!
      - jandrese 8y ago
anovikov 8y ago
Idk how the military ever expected to be able to use these satellites in wartime. First thing enemy will do is saturate them with fake signals from small and cheap battery-powered transmitters just left alone in random places (so targeting them with anti-radiation missiles would make little sense). Sounds like someone has been unbelievably dumb.
- jandrese 8y ago
  Anti-jamming is a thing. As you note jamming satellite comms is certainly possible, but it paints a great big target on your back. And the US military has no problem using a million dollar missile to blow up a $500 jammer.
  - LeftTurnSignal 8y ago
    I've been toying with the idea of getting into ham radio type stuff, so it's always been interesting to me. After working with the local detectives / police, it isn't "very" difficult to find where a jammer is. /I never got the chance to work directly with them on that issue though, but they said it's happened once before. Anyway, it took them one call to Verizon and less than a day later they found who was jamming one area. Did the police thing, and no more jamming. They had the pull because no one could call 911 with a cell phone in that area, and when the squads were out, they'd lose reception around that area too. Both big no nos if you want to stay hidden. I can imagine if it's a country with adequate resources, it would not be much of an issue.
    - velosol 8y ago
      And if you think you're clever by using a jammer while mobile, you're in for some financial pain on top of any legal issues you create for yourself. https://www.fcc.gov/document/fcc-fines-florida-driver-48k-jamming-communications https://www.fcc.gov/document/fcc-fines-florida-driver-48k-ja...
  - anovikov 8y ago
    Still, building some kind of authentication into a system would make a lot of sense IMO.
gcb0 8y ago
this thread is amusing. so many people on HN should go get their amateur radio licenses and stop comparing a layer 1 radio connection to their layer 7+ they use in the browser.
- b1r6 8y ago
  I do indeed have my license. Only a Tech but even that level gets you access to the VHF/UHF birds. Are you saying we shouldn't expect a military satellite to have some semblance of simple authentication? It sounds like what they built was literally a simple repeater. If that's the case, they shouldn't have a problem with this "unauthorized use," because by design, there is no such thing. (The preceding assumes the pirate is licensed to transmit in the 1.25m band that the article noted as the uplink.)
  - kw71 8y ago
    You got it. When these birds were thought up, that was state of the art. Two years ago a dude I'm elmering told me he heard brazilians when he was tuning around with his sdr toy, so maybe they are still doing it today. The uplink freqs are not any that are licensed for any amateur use, these flights are operating between 250-350 MHz. Edit: look what I found http://mt-milcom.blogspot.com/p/alphabravocharlie-frequency-bandplans.html http://mt-milcom.blogspot.com/p/alphabravocharlie-frequency-...
    - b1r6 8y ago
      Ahhh very interesting! It's so funny to think I could hit military comms just by tuning up a bit on my modded rig... Not that I will, because that's dumb. Makes sense given the age of the stuff!
  - sterlind 8y ago
    Look, they're bent pipes because it's faster, cheaper and more scalable. If you do authentication, you need the satellite to process and validate each packet before repeating it. That means that suddenly you need a processor - a beefy one, to handle so many signals at once and understand the modulation, and you have a delay between receiving and sending. You also have new failure modes to worry about, new components that can fail, protocol lock-in, maintenance, etc. Bent pipes are perfect. Not everything needs to be overengineered to hell. A handful of pirates aren't a big enough deal to boil the ocean with a DSP. And assuming that the signal is Manchester-coded, you can defeat the pirates in future models with a simple analog filter to remove their noise.
codetrotter 8y ago
> When the user's location is stable, the signal can be triangulated. That's how the Defense Department got the coordinates to feed Brazilian authorities in March's raids. Of course. But specifically how? With satellites in space? Or antennas on ground? If on ground, where? And if on ground, for triangulating these specific people or for other purposes as well? And if sattelites space, the same sattelites that are relaying the signals, or separate sattelites?
- moftz 8y ago
  The exact same way as mentioned in the next paragraph: "In February of last year, FCC investigators used a mobile direction-finding vehicle to trace rogue transmissions to a Brazilian immigrant in New Jersey."
- CalChris 8y ago
  The ground transmission antenna is sending a high gain signal towards the satellite. But that doesn't mean that all of the energy is directed there. Some gets scattered isotropically and a signal detection plane could triangulate off that.

104 points by wglb 8y ago

The design life of the system was five years, according to https://space.skyrocket.de/doc_sdat/fltsatcom-2.htm https://space.skyrocket.de/doc_sdat/fltsatcom-2.htm I'm sure the military has better ways to communicate these days. Perhaps the access should be allowed?

moftz 8y ago
Why give up access bandwidth on a satellite meant for last resort kinds of communications? The satellite isn't self sufficient so someone in the military has to adjust it in space. There might be older pieces of equipment out there still using the satellite so having a bunch of random people taking up bandwidth and not following the channel allocation. It's better to just enforce the rules that already exist to make sure that the resources are always available.

danilocesar 8y ago

This was 10 years ago. I hope that USMs are using better tools by now..

w8rbt 8y ago
Probably not. Security is full of the "We're Compliant" types (don't we have insurance for that?) and very few real technologists who know how to hack/break/abuse systems. Target was PCI compliant when their CC data was breached and exposed. There are many more examples of this. Check the box, get owned and no really cares. That needs to change.
jandrese 8y ago
Those birds are probably still in the air. Few comm satellites are full processing anyway so there is no mechanism to enforce it up in the sky. Normal enforcement is via having the cops show up at your door and ask why you are stealing the US Government's power and interfering with military operations.
cronix 8y ago
Like using open source software and not doing basic things like changing default passwords? https://www.wired.com/story/us-weapons-systems-easy-cyberattack-targets/ https://www.wired.com/story/us-weapons-systems-easy-cyberatt...

b1r6 8y ago

So these satellites are no more complex than the amateur radio birds which function as simple FM repeaters?! Typically they'll have an uplink in the 2m band, and maybe a downlink in 70cm band, or the other way around. How can a military satellite be so casual in it's decision to relay audio? You'd think some authentication method would have been built in. I guess not?

tivert 8y ago
Maybe the military prefers the simple over the complex. It's a lot simpler to change authentication methods in ground equipment than in orbital equipment.
jandrese 8y ago
Almost all comm sats are just bent pipes. Collisions are avoided via planning but that's just a gentleman's agreement at the end of the day. If you're watching with a spectrum analyzer and a decent dish it's pretty easy to see which transponders are currently idle. The downside of course is that once you start hitting a satellite with a signal they know exactly where you are and the operators will call the cops on you. Your signal is not only potentially interfering with someone who paid for the transponder, but it also impacts their energy budget. I've been told that if you rent a transponder it's important to put a signal up on it pretty quickly, otherwise pirates will attempt to "borrow" it from you, and they can be hard to evict.
- samstave 8y ago
  How do I get more info on this? This sounds like a fantastic subject to learn about.
  - ablation 8y ago
    Seconded. The article and these comments leave me wanting more!
    - jandrese 8y ago

anovikov 8y ago

Idk how the military ever expected to be able to use these satellites in wartime. First thing enemy will do is saturate them with fake signals from small and cheap battery-powered transmitters just left alone in random places (so targeting them with anti-radiation missiles would make little sense). Sounds like someone has been unbelievably dumb.

jandrese 8y ago
Anti-jamming is a thing. As you note jamming satellite comms is certainly possible, but it paints a great big target on your back. And the US military has no problem using a million dollar missile to blow up a $500 jammer.
- LeftTurnSignal 8y ago
  I've been toying with the idea of getting into ham radio type stuff, so it's always been interesting to me. After working with the local detectives / police, it isn't "very" difficult to find where a jammer is. /I never got the chance to work directly with them on that issue though, but they said it's happened once before. Anyway, it took them one call to Verizon and less than a day later they found who was jamming one area. Did the police thing, and no more jamming. They had the pull because no one could call 911 with a cell phone in that area, and when the squads were out, they'd lose reception around that area too. Both big no nos if you want to stay hidden. I can imagine if it's a country with adequate resources, it would not be much of an issue.
  - velosol 8y ago
    And if you think you're clever by using a jammer while mobile, you're in for some financial pain on top of any legal issues you create for yourself. https://www.fcc.gov/document/fcc-fines-florida-driver-48k-jamming-communications https://www.fcc.gov/document/fcc-fines-florida-driver-48k-ja...
- anovikov 8y ago
  Still, building some kind of authentication into a system would make a lot of sense IMO.

gcb0 8y ago

this thread is amusing. so many people on HN should go get their amateur radio licenses and stop comparing a layer 1 radio connection to their layer 7+ they use in the browser.

b1r6 8y ago
I do indeed have my license. Only a Tech but even that level gets you access to the VHF/UHF birds. Are you saying we shouldn't expect a military satellite to have some semblance of simple authentication? It sounds like what they built was literally a simple repeater. If that's the case, they shouldn't have a problem with this "unauthorized use," because by design, there is no such thing. (The preceding assumes the pirate is licensed to transmit in the 1.25m band that the article noted as the uplink.)
- kw71 8y ago
  You got it. When these birds were thought up, that was state of the art. Two years ago a dude I'm elmering told me he heard brazilians when he was tuning around with his sdr toy, so maybe they are still doing it today. The uplink freqs are not any that are licensed for any amateur use, these flights are operating between 250-350 MHz. Edit: look what I found http://mt-milcom.blogspot.com/p/alphabravocharlie-frequency-bandplans.html http://mt-milcom.blogspot.com/p/alphabravocharlie-frequency-...
  - b1r6 8y ago
    Ahhh very interesting! It's so funny to think I could hit military comms just by tuning up a bit on my modded rig... Not that I will, because that's dumb. Makes sense given the age of the stuff!
- sterlind 8y ago
  Look, they're bent pipes because it's faster, cheaper and more scalable. If you do authentication, you need the satellite to process and validate each packet before repeating it. That means that suddenly you need a processor - a beefy one, to handle so many signals at once and understand the modulation, and you have a delay between receiving and sending. You also have new failure modes to worry about, new components that can fail, protocol lock-in, maintenance, etc. Bent pipes are perfect. Not everything needs to be overengineered to hell. A handful of pirates aren't a big enough deal to boil the ocean with a DSP. And assuming that the signal is Manchester-coded, you can defeat the pirates in future models with a simple analog filter to remove their noise.

codetrotter 8y ago

> When the user's location is stable, the signal can be triangulated. That's how the Defense Department got the coordinates to feed Brazilian authorities in March's raids. Of course. But specifically how? With satellites in space? Or antennas on ground? If on ground, where? And if on ground, for triangulating these specific people or for other purposes as well? And if sattelites space, the same sattelites that are relaying the signals, or separate sattelites?

moftz 8y ago
The exact same way as mentioned in the next paragraph: "In February of last year, FCC investigators used a mobile direction-finding vehicle to trace rogue transmissions to a Brazilian immigrant in New Jersey."
CalChris 8y ago
The ground transmission antenna is sending a high gain signal towards the satellite. But that doesn't mean that all of the energy is directed there. Some gets scattered isotropically and a signal detection plane could triangulate off that.