4 ms·

I've investigated network equipment before, my findings were that you shouldn't trust any of it and use a standard Linux box whenever possible. The worst was co

I've investigated network equipment before, my findings were that you shouldn't trust any of it and use a standard Linux box whenever possible. The worst was consumer-grade modems/routers with low-hanging fruits such as backdoors, "forgotten" telnet servers left enabled, shell command injection in the web UI, etc but even enterprise stuff had its problems (thankfully, at least on enterprise stuff you can disable the web UI and any services you don't use, considerably shrinking the attack surface to pretty much just the kernel). And don't get me started on mobile network equipment where untrusted data is parsed at the kernel level and the motto is still security by obscurity (and the impossibility to obtain said equipment for the average Joe). What I think happened is that they breached the control infrastructure which gives them access to an "internal" VLAN that the satellite terminals use to communicate with the mothership for firmware updates, configuration changes, etc, and from there were able to attack these as if they were locally connected (or worse - since that network segment is presumed "internal" and may expose services not normally available - think whatever is the TR-069 equivalent for BGAN terminals), either just pushing an incorrect configuration that prevents the terminal from connecting (essentially bricking it until you can get out-of-band access and reconfigure it properly) or obtaining root (via exploit or pushing a specially-crafted firmware update) and overwriting /dev/mtd* to completely kill the terminal. "Cyberattack on satellite network" sounds so serious but I very much doubt it's got anything to do with the satellite part of it. They've done the equivalent of breaching into the management network at a terrestrial, wired ISP and sent garbage configuration over TR-069 to brick the modems. Attacking the satellite layer would require much more effort for essentially the same gain (and if your objective was to get into the satellite layer, why waste that access on breaking everything in a highly-visible way when you're better off silently sitting there and using the access to eavesdrop on everything, especially when it's used for SCADA traffic of critical systems that's itself unencrypted and vulnerable to tampering?).

bewaretheirs 5y ago
> why waste that access on breaking everything in a highly-visible way when you're better off silently sitting there and using the access to eavesdrop on everything The subtle approach takes more time. Take the PoV of the hypothetical Russian decision maker.. you can either take all them down now with something quick & dirty while the tanks are rolling, or inject a stealthy targeted piece of malware you haven't finished yet next week after Kiev is already in the hands of a puppet government....
- Nextgrid 5y ago
  Yes, this was my point. I don’t believe they’ve attacked anything satellite-specific and instead just pushed an intentionally-bad configuration or firmware update to terminals in the field.
mistrial9 5y ago
> "Cyberattack on satellite network" sounds so serious yes agree -- third hand witness to actual ground station management of Small SATs here.. even internal engineers are locked out; multiple keys required to perform actions; closely monitored change-of-behavior networks, etc etc beware of REALLY LARGE CLAIMS at this time -- peace out
- KennyBlanken 5y ago
  A satellite data system used by the Ukrainian military was knocked out at the same time as the invasion, the outage started in Ukraine before spreading outward, and the damage is permanent - which would not happen in a botched firmware upgrade, where units would load a backup firmware image or get an image OTA, or be fixable via site visit. Not exactly a 'really large claim' that this was an attack.
  - avianlyric 5y ago
    I think GP is saying that an attack that impacted the satellites flying around in space is a large claim, on account of their systems have better security. I imagine the idea of a many millions of $ satellite burning up because someone left a telnet server open is enough to make executives take sat security a little more seriously than say terminal security. Don’t think anyone is really refuting the idea that satellite terminals being remotely bricked en-mass, just as two countries nearby go to war, is an attack.
    - Nextgrid 5y ago
      My argument in my original post was that the fact that this is a satellite network is likely to be completely irrelevant to the actual attack and that the parts that were compromised exist just as well in a terrestrial-based network. However, "satellite network suffers cyber-attack" is a better headline than "local ISP was stupid and got their management network pwned" - the former implies extra complexity which works well for ass-covering and swaying public opinion, something they very much need if it turns out the vulnerability was very stupid & mundane.
  - 5y ago
Melatonic 5y ago
This sort of what virtual networking devices are trying to solve, no? Going to a full on box also increases your attack surface by adding a lot of unnecessary stuff. Plus even with something completely in software you still need the physical hardware in there at some point - and those individual pieces will be running their own firmware and microcontroller software.
motohagiography 5y ago
> (and the impossibility to obtain said equipment for the average Joe). when I worked on similar problems some years ago, we found out that certain radios were used across sectors with basically the same ucLinux kernels and toolchains, bootloaders, and SoCs. I agree with the "internal VLAN" assessment to a point, as these networks tend to backhaul their admin channel / control plane messaging back to their vendor. The hardcoded credentials issue was the easiest win, where the firmware signing was actually not bad, but injecting packets over the point to point radio connections depended on whether both encryption was enabled, and some primitives implementation issues that I have no doubt any serious cyber operations group would have also found. With this (speculative) radio packet of death, you could fly a spyplane over the region at super sonic speeds and cause the terminals to go dark - which would explain the relatively simultaneous / sequential failures and the physical path of the outages, which would be detectable in the monitoring data. Strategically, it's the perfect signal and warning to any country looking to interfere, and it doesn't cost very much. Maybe it's nothing, but with Russia it's never nothing.
- mschuster91 5y ago
  > With this (speculative) radio packet of death, you could fly a spyplane over the region at super sonic speeds That could work in Ukraine, but a spy plane above Germany would have made national news.
  - motohagiography 5y ago
    Fair assessment. I assumed spyplane because it also affected Italy and Greece, so there was a long arc of a flight path. It's possible it could have been the orbit of a russian electronic warfare satellite as well, as if you have a transmitter on it, encoding radio packets of death against poorly maintained linux kernel forks (hugely assuming that's what the terminals ran) is as trivial as loading a metasploit payload. I'm well into speculative fiction, but casting magic spells that stop machinery en masse isn't magic at all - and well within the capabilities of armchair admirals of electronic warfare who read and post on HN. It would be interesting to see if there was any timestamp data about the order in which the terminals failed, as that would yield the flight path evidence, or indicate the presence of local transmitters in those regions, or if it were async, an internet based attack. Reality is, the gear that runs critical infrastructure is still a joke, and I've said before that western exposure to cyber vulnerability will cause the US/NATO to hesitate in responding to Russian and Chinese aggression because they have to take on that domestic political risk of infrastructure failure, and in conflict, often hesitation is sufficient. Weakness invites predators, and here we are.
oceanplexian 5y ago
From personal experience (I guess now that the statue of limitations has passed..) I was part of a large community of people in the not so distant past hacking into cable ISPs. Small ones were easy to bypass security mechanisms and spoof other customers devices or simply trick their servers into issuing valid configs, but obviously there was the one big one that I’m sure everyone has heard of. Anyway, before the community was shut down, in the quest to defeat the more stringent security mechanisms, a few folks figured out how to jump from modems to an internal VLAN, got access to privileged SNMP communities and eventually owned the entire network starting at the head ends and eventually made their way to the core routers (Of course, the provider used the same credentials for everything, in an industry that to this day doesn’t use 2FA). Eventually the community was shut down. However, said ISP never acknowledged the breach. If some hobbyists could figure it out, I guarantee that nation-states can do it.
- rasz 5y ago
  rip www.sbhacker.net
- FDSGSG 5y ago
  Well yeah, kids on IRC (or xbox live) have been hacking big ISPs like comcast and verizon to dox each other since forever.
jlgaddis 5y ago
> What I think happened is that they breached the control infrastructure which gives them access to an "internal" VLAN that the satellite terminals use to communicate with the mothership for ... > ... whatever is the TR-069 equivalent for BGAN terminals ... These VSAT terminals support TR-069 [0] and my first thought when I heard about this was a compromised ACS. It wouldn't be the first time. --- [0]: https://en.m.wikipedia.org/wiki/TR-069 https://en.m.wikipedia.org/wiki/TR-069

bewaretheirs 5y ago

> why waste that access on breaking everything in a highly-visible way when you're better off silently sitting there and using the access to eavesdrop on everything The subtle approach takes more time. Take the PoV of the hypothetical Russian decision maker.. you can either take all them down now with something quick & dirty while the tanks are rolling, or inject a stealthy targeted piece of malware you haven't finished yet next week after Kiev is already in the hands of a puppet government....

Nextgrid 5y ago
Yes, this was my point. I don’t believe they’ve attacked anything satellite-specific and instead just pushed an intentionally-bad configuration or firmware update to terminals in the field.

mistrial9 5y ago

> "Cyberattack on satellite network" sounds so serious yes agree -- third hand witness to actual ground station management of Small SATs here.. even internal engineers are locked out; multiple keys required to perform actions; closely monitored change-of-behavior networks, etc etc beware of REALLY LARGE CLAIMS at this time -- peace out

KennyBlanken 5y ago
A satellite data system used by the Ukrainian military was knocked out at the same time as the invasion, the outage started in Ukraine before spreading outward, and the damage is permanent - which would not happen in a botched firmware upgrade, where units would load a backup firmware image or get an image OTA, or be fixable via site visit. Not exactly a 'really large claim' that this was an attack.
- avianlyric 5y ago
  I think GP is saying that an attack that impacted the satellites flying around in space is a large claim, on account of their systems have better security. I imagine the idea of a many millions of $ satellite burning up because someone left a telnet server open is enough to make executives take sat security a little more seriously than say terminal security. Don’t think anyone is really refuting the idea that satellite terminals being remotely bricked en-mass, just as two countries nearby go to war, is an attack.
  - Nextgrid 5y ago
    My argument in my original post was that the fact that this is a satellite network is likely to be completely irrelevant to the actual attack and that the parts that were compromised exist just as well in a terrestrial-based network. However, "satellite network suffers cyber-attack" is a better headline than "local ISP was stupid and got their management network pwned" - the former implies extra complexity which works well for ass-covering and swaying public opinion, something they very much need if it turns out the vulnerability was very stupid & mundane.
- 5y ago

Melatonic 5y ago

This sort of what virtual networking devices are trying to solve, no? Going to a full on box also increases your attack surface by adding a lot of unnecessary stuff. Plus even with something completely in software you still need the physical hardware in there at some point - and those individual pieces will be running their own firmware and microcontroller software.

motohagiography 5y ago

> (and the impossibility to obtain said equipment for the average Joe). when I worked on similar problems some years ago, we found out that certain radios were used across sectors with basically the same ucLinux kernels and toolchains, bootloaders, and SoCs. I agree with the "internal VLAN" assessment to a point, as these networks tend to backhaul their admin channel / control plane messaging back to their vendor. The hardcoded credentials issue was the easiest win, where the firmware signing was actually not bad, but injecting packets over the point to point radio connections depended on whether both encryption was enabled, and some primitives implementation issues that I have no doubt any serious cyber operations group would have also found. With this (speculative) radio packet of death, you could fly a spyplane over the region at super sonic speeds and cause the terminals to go dark - which would explain the relatively simultaneous / sequential failures and the physical path of the outages, which would be detectable in the monitoring data. Strategically, it's the perfect signal and warning to any country looking to interfere, and it doesn't cost very much. Maybe it's nothing, but with Russia it's never nothing.

mschuster91 5y ago
> With this (speculative) radio packet of death, you could fly a spyplane over the region at super sonic speeds That could work in Ukraine, but a spy plane above Germany would have made national news.
- motohagiography 5y ago
  Fair assessment. I assumed spyplane because it also affected Italy and Greece, so there was a long arc of a flight path. It's possible it could have been the orbit of a russian electronic warfare satellite as well, as if you have a transmitter on it, encoding radio packets of death against poorly maintained linux kernel forks (hugely assuming that's what the terminals ran) is as trivial as loading a metasploit payload. I'm well into speculative fiction, but casting magic spells that stop machinery en masse isn't magic at all - and well within the capabilities of armchair admirals of electronic warfare who read and post on HN. It would be interesting to see if there was any timestamp data about the order in which the terminals failed, as that would yield the flight path evidence, or indicate the presence of local transmitters in those regions, or if it were async, an internet based attack. Reality is, the gear that runs critical infrastructure is still a joke, and I've said before that western exposure to cyber vulnerability will cause the US/NATO to hesitate in responding to Russian and Chinese aggression because they have to take on that domestic political risk of infrastructure failure, and in conflict, often hesitation is sufficient. Weakness invites predators, and here we are.

oceanplexian 5y ago

From personal experience (I guess now that the statue of limitations has passed..) I was part of a large community of people in the not so distant past hacking into cable ISPs. Small ones were easy to bypass security mechanisms and spoof other customers devices or simply trick their servers into issuing valid configs, but obviously there was the one big one that I’m sure everyone has heard of. Anyway, before the community was shut down, in the quest to defeat the more stringent security mechanisms, a few folks figured out how to jump from modems to an internal VLAN, got access to privileged SNMP communities and eventually owned the entire network starting at the head ends and eventually made their way to the core routers (Of course, the provider used the same credentials for everything, in an industry that to this day doesn’t use 2FA). Eventually the community was shut down. However, said ISP never acknowledged the breach. If some hobbyists could figure it out, I guarantee that nation-states can do it.

rasz 5y ago
rip www.sbhacker.net
FDSGSG 5y ago
Well yeah, kids on IRC (or xbox live) have been hacking big ISPs like comcast and verizon to dox each other since forever.

jlgaddis 5y ago

> What I think happened is that they breached the control infrastructure which gives them access to an "internal" VLAN that the satellite terminals use to communicate with the mothership for ... > ... whatever is the TR-069 equivalent for BGAN terminals ... These VSAT terminals support TR-069 [0] and my first thought when I heard about this was a compromised ACS. It wouldn't be the first time. --- [0]: https://en.m.wikipedia.org/wiki/TR-069 https://en.m.wikipedia.org/wiki/TR-069