20 ms·

The hacking of Starlink terminals has begun

2OEH8eoCRo0 4y ago
How narrow of a beam is attainable with this? What shape is the beam? How good is that clock chip? I wish I knew more about this stuff at the theory level. A cheap and hackable phased array sounds very cool to experiment with.
Eriks 4y ago
Relevant presentation on DEFCON Media server: https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Lennert%20Wouters%20-%20Glitched%20on%20Earth%20by%20humans%20A%20Black-Box%20Security%20Evaluation%20of%20the%20SpaceX%20Starlink%20User%20Terminal.pdf https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20pre... https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Lennert%20Wouters%20-%20Glitched%20on%20Earth%20by%20humans%20A%20Black-Box%20Security%20Evaluation%20of%20the%20SpaceX%20Starlink%20User%20Terminal.mkv https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20pre...
- upupandup 4y ago
  [flagged]
  - jchw 4y ago
    Realistically, I think it's funded in large parts by U.S. government grants to provide affordable internet to rural areas. https://www.cnbc.com/2020/12/07/spacex-starlink-wins-nearly-900-million-in-fcc-subsidies-auction.html https://www.cnbc.com/2020/12/07/spacex-starlink-wins-nearly-... Of course though, I'm not sure what the status on that is today. Looks like they may not be able to ride that train anymore: https://www.reuters.com/world/us/us-rejects-broadband-subsidies-spacexs-starlink-ltd-2022-08-10/ https://www.reuters.com/world/us/us-rejects-broadband-subsid...
    - panick21_ 4y ago
      That was never considered a large part of the funding. That would simply have been some additional income over the next decade. And its not happening now anyway. And given the limited capacity, they might as well use that capacity for other costumers.
  - Nextgrid 4y ago
    > On the bright side, this means free internet outdoors in many remote parts of the world will be possible and funded by loyal Elon Musk fans ;) I don’t believe they are that stupid as to delegate access control to the client.
  - debatem1 4y ago
    In the same way that me turning off secure boot on my desktop means free Netflix for everyone and we should shut down Comcast until there's a fix. This is a cool attack, but (so far) no more than that. I'd expect that the SpaceX security team is over there putting in some glitch resistant compares at the moment, assuming they haven't already.
    - femiagbabiaka 4y ago
      Yeah it's quite the opposite actually. Taken from the excellent preso linked above: """ • This is a well-designed product (from a security standpoint) • No obvious (to me) low-hanging fruit • In contrast to many other devices getting a root shell was challenging • And a root shell does not immediately lead to an attack that scales """
  - deepdriver 4y ago
    > meaning everyone of those floating satellites needs to be brought back down and modified Don’t they have a fairly short operational lifetime, thanks to increased drag from being in LEO? IIRC it’s around 5 years. I believe that’s part of the reason for the high launch cadence. Worst case they just limp along with what they’ve got until they’re all replaced with new satellites.
  - pelorat 4y ago
    What are you on about. This has nothing to do with the satellites, not can this hardware mod ever be used to affects the hardware in orbit.
    - walnutclosefarm 4y ago
      That's not necessarily true. Hacking the ground station means in all likelihood getting access to low level protocols between the ground station and satellite, which potentially means getting the ability to affect the satellites. Not a sure thing, but if I wanted to attack a StarLink satellite, this would be a solid first step in doing so.
      - sneak 4y ago
        The researcher mentions that in the article.
  - rockemsockem 4y ago
    Uh, why though? This demonstrates that a determined attacker can get access to the software running on their own personal terminal. That's like a determined attacker being able to get access to their own personal router. It sounds like strictly a good thing and with how many satellite internet companies are coming online we will hopefully see some common hardware devices that users have full access to along with some custom firmware that folks can run on them. This has almost nothing to do with the security of the satellite constellation itself.
    - AnotherGoodName 4y ago
      Where it would be problematic is if it's trivial to do this to someone else's terminal.
    - Aeolun 4y ago
      Like jailbreaking your iPhone
  - ajross 4y ago
    Do you write a comment like that every time someone roots a cable modem too? That seems a little over the top. This is an exploit of the base station device. It seems that it might be used to grant access for which the owner hadn't paid, but that's also something that can be trivially patched around at the routing level ("sure, it's a valid base station, but if it's not on the list of paying customers it doesn't get packets"). It doesn't seem like there's a broader exploit against the network at all, beyond allowing the thing to attempt a DoS attack (something that is also always possible with jamming hardware, but very difficult in practice given the number of satellits).
    - Scoundreller 4y ago
      Should be possible to DoS your area in the footprint, so everyone within a few hundred kilometers around you? A phased array helps but you could also have a heliostat-type setup that tracks the satellite.
- contingencies 4y ago
  Other relevant links from the presentation are https://exploitee.rs/index.php/Exploitee.rs_Low_Voltage_e-MMC_Adapter https://exploitee.rs/index.php/Exploitee.rs_Low_Voltage_e-MM... (recommended firmware extraction hardware) https://www.esat.kuleuven.be/cosic/blog/dumping-and-extracting-the-spacex-starlink-user-terminal-firmware/ https://www.esat.kuleuven.be/cosic/blog/dumping-and-extracti... (firmware extraction writeup) https://rtfm.newae.com/ https://rtfm.newae.com/ (glitching and side channel analysis hardware) and https://github.com/newaetech/chipwhisperer https://github.com/newaetech/chipwhisperer (associated open source toolchain)
GormHouj 4y ago
I see a lot of articles that quote the cost for hacking a product or service. I feel like these type of titles undermine the effort that took place. Surely the lab Wouters used had tools and processes that aren't cheap, nor would you consider his expertise inexpensive. I'm not impressed by a PCB board being cheap. Does anyone else feel this way about similar headlines?
- xen2xen1 4y ago
  Yes and no. Is the $25 increasingly irrelevant. Sure. Is it clickbait-y, yes. Does it matter because it might make it more widespread, it probably still does.
- mikeytown2 4y ago
  Price is a factor for how accessible the hack is. If it requires an expensive FGPA or a lot of AWS time to crack then that makes it less appealing.
  - wpietri 4y ago
    Exactly. For me it's about the replicability of the attack. Is it restricted to government-sized organizations? Or can anybody with the skills do it?
  - GormHouj 4y ago
    Interestingly, either H/N changed the submission title, or the article itself changed their title to reflect the content of the article better. Is there a way I can check which happened in the last few hours?
- tppiotrowski 4y ago
  I think the point is that anyone with $25 can hack Starlink once the script or instructions are published online. Information costs almost nothing to publish/ share so it's the cost of the hardware that matters.
  - samstave 4y ago
ThrowawayTestr 4y ago
Is there any mitigation against these kinds of power/timing attacks? I think the Switch was originally hacked this way.
- mikeytown2 4y ago
  New hardware revisions are required to fix usually. You can probably detect a compromised terminal on the network though.
- karmicthreat 4y ago
  I don’t think you can eliminate them, just make them harder to exploit. Require multiple glitches to succeed etc.
  - notfish 4y ago
    Agreed, usually if they have hardware access it’s gonna be cracked eventually. Hard to imagine a system that was truly unhackable with infinite unrestricted physical access.
- KMnO4 4y ago
  No, not without changing microprocessors. Essentially these chips are locked by setting certain flags in memory. Various flags control various peripherals, including a flag to disable read/write access to the firmware. Obviously once you disable access, it’s permanent because you don’t have access to reenable it. This side channel attack takes advantage of a flaw in the actual silicon, where branches can be skipped if the power is altered momentarily. So if you skip that first check, the attacker has low level firmware control. (This was also how the firmware was dumped on the Apple AirTags) The only mitigation is to use a chip that doesn’t suffer from this flaw or change the software to prevent “root” access even if an adversary has access to the entire firmware (ie do things server side)
  - 14 4y ago
    Xbox 360 had the reset glitch hack where if you powered cycled the chip at the exact right timing you could run unsigned code. It required a small mod chip soldered to some of the smallest points on the motherboard that I have ever soldered. Different versions of the 360 worked better but most worked even if it took a minute or so before the glitched worked and booted into custom firmware. Mine worked really well and booted first try almost every time. I was very proud to successfully install it and watch my 360 boot into fsd a custom OS that allowed me to play all my games from a HDD.
AYBABTME 4y ago
This reads to me like the (more complicated but ultimately) equivalent of "a user reverse engineers the website's javascript!". As in, this allows the user to mod their client but it doesn't change anything for anyone else, and wasn't meant as a real secure element. I'd assume that getting root access to the user terminal gives them no additional privileges to access the actual Starlink data & control planes.
- jandrese 4y ago
  It might allow them to do things like connect to the Starlink network outside of their geofence. Or hacking a stationary antenna to work on a moving vehicle.
  - olalonde 4y ago
    > connect to the Starlink network outside of their geofence I was wondering about that but can't they determine the location "server side" by triangulation? Or maybe they could in theory but they don't in practice?
    - colechristensen 4y ago
      Knowing the positions of all the clients and satellites is a basic requirement for operating the network.
      - jandrese 4y ago
        For the satellites this is true, but it's not necessary for the clients to be geolocated when the satellite is operating as a bent pipe. Starlink will know which clients are in which footprint and can locate anybody if they want to, but it's not fundamental to the functionality of the system.
        colechristensen 4y ago
        Both the client and the satellite use beam forming. The signal is pointed at you in a relatively narrow beam not broadcast spherically. They have to know where you are to point at you (phased array antennas so electronic not physical pointing)
elteto 4y ago
Great response by SpaceX: https://api.starlink.com/public-files/StarlinkWelcomesSecurityResearchersBringOnTheBugs.pdf https://api.starlink.com/public-files/StarlinkWelcomesSecuri... “Bring on the bugs”. This is how you properly engage the security community. In times where journalists are taken to court for looking at a webpage’s HTML source it’s really great seeing a company that “gets it”. Kudos.
- deleted 4y ago
  [deleted]
- zbird 4y ago
  I will never understand why bug-bounty hunters work for such a low pay. They are doing the hard work for peanuts and absolutely no benefits or long-term incentives. $25k per bug, while the CEO and friends are going to make billions from this. At least if you find a bug, go and exploit it and bring the satellite down. This way we can all have some fun, not just the VPs sitting on the company board. And then they call their conferences with menacing names such as 'Black Hat' or 'DEFCON'. Sounds more like pony-con to me.
drewg123 4y ago
The response from Starlink[0] was pretty amazing. I love this quote: "we want to congratulate Lennert Wouters on his security research into the Starlink user terminal – his findings are likely why you're reading this, and help us create the best product possible." A lot better than companies that would try to prosecute him.. [0]: https://api.starlink.com/public-files/StarlinkWelcomesSecurityResearchersBringOnTheBugs.pdf https://api.starlink.com/public-files/StarlinkWelcomesSecuri...
- LeifCarrotson 4y ago
  Full of good sense. They do try to control the terminal to do a secure boot: > We want our devices to only run software that we wrote. This isn't like a personal computer where the user can install apps or save files – the only software we want to run on our devices is software that we've explicitly built, tested, and signed off on. > The same concepts that go into secure boot on our satellites are also useful on the Starlink user terminals. Even though we know that an attacker with persistent and invasive physical access will eventually be able to defeat secure boot on their own device, the protections of secure boot are still valuable for protecting against remote attacks over the Internet (or over wifi). There is a big difference between being able to take your own device off your roof and attack it, vs. someone else being able to compromise your device without you noticing. But recognize that it's not foolproof: > We expect attackers with invasive physical access to be able to take malicious actions on behalf of a single Starlink kit using its identity, so we rely on the design principle of "least privilege" to constrain the effects in the broader system. We treat Starlink user terminals as inherently untrusted and only expose the minimal necessary information and capabilities to each specific client. The article talks about the researcher "exploring the Starlink network" as if there's a screen on the satellites that will suddenly display "Access Granted" with a blinking cursor now that he's achieved root on his own dish. Getting access to the dish is an important step if the former is to be achieved, but it's by far the easier of the two steps.
- unsupp0rted 4y ago
  > Wouters revealed the vulnerability to SpaceX in a responsible way through its bug bounty program before publicly presenting on the issue.
game-of-throws 4y ago
This attack sounds very similar to how the Super Game Boy boot ROM was dumped. https://gbdev.gg8.se/wiki/articles/Gameboy_Bootstrap_ROM https://gbdev.gg8.se/wiki/articles/Gameboy_Bootstrap_ROM Some things never change.
jerryjerryjerry 4y ago
- deleted 4y ago
  [deleted]
tg180 4y ago
The article compares the Russian jamming of Viasat with the compromise of a Starlink UT. No, no, no... This is really wrong! > As is typically the case with any technology, the increase in use and deployment of Starlink and other satellite constellations also means that threat actors have a greater interest in finding their security holes to attack them. > Indeed, Russia saw an advantage in taking out a satellite providing internet communications across Europe by attacking its technology on the ground as Russian troops entered Ukraine on Feb. 24. Viasat orbits at 22,000 miles, Starlink is in LEO. Precisely for this reason Starlink is naturally more resistant to jamming, and is used in Ukraine because of this. Locally compromising a UT is a hack of an endpoint connection device, which has nothing to do with ELINT and electronic warfare activities (which is an entirely different kind of attacks for satellite networks).
- detaro 4y ago
  Viasat attack was by hacking ground terminals, not jamming satellites.
  - tg180 4y ago
    The Russian approach is hybrid: in addition to the use of jamming (they use Divnomorye, Leer, Moskva, Krasukha, ...), traditional hacking is used to extend the damage range beyond what can be obtained through pure electronic warfare. In the case of Viasat they had access to a badly configured VPN appliance and used it to deploy on the terminals. Which is a classical case of network compromise, not a direct hack of the user devices. Also considering this aspect the comparison is not there: it's a local access to the hardware vs an "I own your infrastructure and I'm able to deploy my firmware".
    - mlyle 4y ago
      > Also considering this aspect the comparison is not there: it's a local access to the hardware vs an "I own your infrastructure and I'm able to deploy my firmware". Yes, performing this reverse engineering requires physical access. But it potentially enables one to find further vulnerabilities and systems knowledge necessary to build attacks that brick network terminals or otherwise disrupt the network. Russia's action proves these attacks are viable and useful (even if an authenticated management vector was used). Your original comment about the constellation height was a non-sequitur: we're talking about threat actors' attacks on end-user terminals. The article makes clear ("on the ground") that this is what it was referring to. Yes, jamming, etc, are also useful attacks that threat actors use but not what we're talking about.
vajenetehais 4y ago
This is quite impressive and congratulation are well deserved. Now the fun part can start. This work opens a door to the user segment, i can't wait to see what's behind and hope for starlink that their C2 and user segments are well isolated. Let the fuzzing begin.
josephcsible 4y ago
It shouldn't count as a vulnerability that you can get root of a device that you have physical possession of. If there's any real vulnerability here, it's that having root of your terminal gives you any extra privileges to the rest of the network.
- bilekas 4y ago
  I have to agree to be fair. Physical access is obviously incredibly different than exploiting a vulnerable even a particularly egregious design flaw. Wouters has to literally short the board. That said it is a clever approach and it’s good it was discovered by someone without nefarious intentions.
- bdcravens 4y ago
  If a system is designed to not allow that access, and you can compromise that design, it is most definitely a vulnerability.
  - nine_k 4y ago
    If a system is not resilient against rooting a terminal which is in user's physical possession, it's a design flaw. Or, rather, the more resilient the system as a whole is to compromises of individual terminals, the better the design is. Assuming such compromise never happens would be outright incompetent.
    - mlyle 4y ago
      You might very well want both E.g. You may want to protect end users against implants and other attacks from physical tampering with their terminals. You might not want hostile parties to have an easy time reverse engineering terminals so they can more easily search for remote vulnerabilities in the terminals. You may not want to hand hostile parties a phased array optimized to transmit to Starlink running arbitrary software of their choice, along with keys identifying the terminal, because even though you think the satellites and authentication mechanisms are robust, making it hard to get this information adds defense in depth.
roastedpeacock 4y ago
This WIRED article[1] references a release of tools and information about the research on GitHub[2] however it 404s. Hope that is not being censored. [1] https://www.wired.com/story/starlink-internet-dish-hack/ https://www.wired.com/story/starlink-internet-dish-hack/ [2] https://github.com/KULeuven-COSIC/Starlink-FI https://github.com/KULeuven-COSIC/Starlink-FI
- gorkish 4y ago
  This bothered me yesterday when news broke. I'm surprised that more people are not discussing the lack of follow-on information here.
- upupandup 4y ago
  - samstave 4y ago
  - roastedpeacock 4y ago
    > looks like Starlinks legal dept got to the github repo first :( If true than it was not through the normal DMCA process of GitHub that would result in a public[1] take-down notice being filed for transparency. [1] https://github.com/github/dmca https://github.com/github/dmca
- jacooper 4y ago
  Should've uploaded the repo to IPFS or Radicle.
- colinsane 4y ago
  archive.org only ever captured 404s for that page. i wonder if it was a typo in the article. does Starlink use TI’s SimpleLink? because there’s a very similarly-named repo doing similar fault injection here: https://github.com/KULeuven-COSIC/SimpleLink-FI https://github.com/KULeuven-COSIC/SimpleLink-FI
rkagerer 4y ago
I'd love to see what can be done with this access. Mobile Starlink?
- savrajsingh 4y ago
  They already support RVs
29athrowaway 4y ago
Certainly it did not cost $25 to develop the modchip. If you put in the labor and software related cost it's not $25.
- nine_k 4y ago
  It may cost $25 to deploy the hack after it has been developed. It's mere $25k to deploy 1000 instances of it, or even cheaper due to the economies of scale.
  - hunterb123 4y ago
    Since you need physical access, it's plus the cost of the dish and one month of service, either by stealing or buying them. The former would be quite illegal and difficult to scale, the latter would be quite expensive.
- unixbane 4y ago
  I have quit the software industry and now get paid what people _should_ get paid for software which is a small fraction of what I was being paid before. By choosing to work on actual real problems, instead of partaking in the pseudo-intellectual clout chasing contest that is the tech industry, I have discovered the real value of software which was never much to begin with as I assumed it was when I was a kid. tl;dr yep, he could have been shoveling CRUD shit and making more money, or implementing high end algorithms within broken operating systems, or implementing high end algorithms with insufficient education or time to prove them, while getting dumber scratch that he got a bug bounty for his work so his net gain is equal. check mate
- TheDong 4y ago
  I'm confused what you're even arguing against. The article specifically uses the phrasing "uses off-the-shelf parts that cost around $25". It doesn't say anything about the cost to develop, it doesn't say anything even slightly misleading or ambiguous about this. Like, what should the article have done instead? How could it possibly be clearer and more explicit about what $25 referred to here?
ck2 4y ago
Pretty sure Russia has physical satellite killer missiles just like US does? Would a nuke in space even work to take out a group of them, maybe even via an EMP surge or are they hardened? Sometimes I wonder if the world would be more peaceful if cellphone networks couldn't work anymore but there would be so much other chaos so guess not.
- upupandup 4y ago
  - bpodgursky 4y ago
    > The PLA has literally robots that can obscure and destroy US satellites without launching missiles at it This is 100% speculation. The only thing that China has demonstrably done is blow up satellites. It would be unsurprising if this tech was in development, but nobody has any clue whether there are non-kinetic satellite neutralization weapons deployed.
    - Aeolun 4y ago
      I imagine a high powered laser would work pretty well against something the size of a Starlink sat? Not sure if we can focus them well enough to be worth the power expenditure though.
  - CyanBird 4y ago
    Don't spread useless misinformation on hackernews
    - upupandup 4y ago
      I don't think you understand what that word means.
- panick21_ 4y ago
  Russia does not have the capability of destroying Starlink because the amount of upmass required to destroy them is larger then what the Russians can actually do. SpaceX replacement rate would be higher then Russia destroy rate.
WD-42 4y ago
I never understand why the dollar amount is always included in these headlines. Like affording the $25 worth of hardware is really the most difficult obstacle to overcome here.
- HWR_14 4y ago
  It's a sign of the hackers skill that they can take the same difficult problem and make it so anyone with $25 can duplicate it. Making something accessible to the masses makes it a more impressive achievement.
- Hellion 4y ago
  It’s because it makes it accessible, which is important.
- twawaaay 4y ago
  The original hacker might have needed a lot of specialized, highly valuable knowledge, but what $25 means is that almost anybody can do the same with some instruction even if they couldn't come up with the instructions or even don't understand what they are doing.
- chucksta 4y ago
  Thats' the point, its a trivial amount. Implying it's super easy and people should be worried.
- deleted 4y ago
  [deleted]
politelemon 4y ago
I would like to point out the mildly appropriate and endearing name in this context, 'Wouters' (routers)
- Mo3 4y ago
  That's a pretty common name here in the Netherlands
jcims 4y ago
I'm sure it will never happen but it would be awesome if they would release an 'open' terminal under the same auspices of commercial SDR transceivers. I'm curious if these could be used for very localized doppler radar.
- debatem1 4y ago
  You can build a simple Doppler radar yourself today using a couple of SDRs, but sophisticated phased arrays are the kind of thing that makes for pretty good military equipment. I doubt an open one will come on the market (legally) soon.
  - zmgsabst 4y ago
    Just say you’re doing high resolution of metamaterials for science. Materials resonant at the target radar band, because that wavelength is easier to manufacture/economically useful/etc. I think you’re more likely to find a job than trouble — SBIR has a bunch of grants in that area. (Last I looked.)
bee_rider 4y ago
Hacking in the older "using a device in an unexpected/unsupported way," not "black-hat hacking" I guess. Typical over-dramatic Wired. Hats off to this guy, hardware hacks always impress.
- russdill 4y ago
  Locking down user terminals is one part of starlink security. Breaking that is a huge accomplishment. It appears that the other layers still prevent this from being a full blown attack, but that may just be a matter of time.
  - bpodgursky 4y ago
    What makes you think this is true? I'm not shocked they did lock it down, but why do you think it's important to the security?
    - russdill 4y ago
      They are using a layered model. Giving an attacker access to communicate directly with your satellites and send specially crafted packets is giving them a really useful tool.
  - pelorat 4y ago
    Sure, but an attack to do what? Even with full hardware access there's nothing that can be done with the network itself, nor can it be used to snoop on other users, nor does it give some access to the satellites themselves. It's akin to rooting your ISP provided modem.
    - TechBro8615 4y ago
      If you root your ISP provided modem, aren’t you one step closer to exploiting some bug in DOCSIS? Similarly here wouldn’t you be one step closer to exploiting the “network itself?” (Air-quotes because I’m not actually sure what that means in this context.)
keepquestioning 4y ago
Planet Labs really missed the boat here. Could've easily beat SpaceX
- philipwhiuk 4y ago
  To what? Planet Labs have a handful of LEO imaging sats, some of which SpaceX has launched. They can't afford to launch a LEO internet constellation.
- mlindner 4y ago
  Planet isn't an internet service provider company. Even if they wanted to become one, they'd need access to tremendous amounts of capital and low launch costs to re-create what Starlink is. It's an open question if Amazon will be able to compete with it's eventual system or not.
addisonl 4y ago
Anyone have a link to read without hitting the paywall?
- autarch 4y ago
  https://archive.ph/o1vnP https://archive.ph/o1vnP
bluedino 4y ago
Remember 20+ years ago when people did this with cable modems?
- hackernudes 4y ago
  And remember how the cable companies completely fixed it? Starlink already seems to do the right thing to prevent cloning and unauthorized access. Secure chip (STSAFE) and mTLS for talking to internal services. Maybe researchers will find some bugs in their services but they will be patched quickly.
- Scoundreller 4y ago
  Cable modems were easy: all you needed to do was JTAG them. I don't think any glitching was required. The approach used for the Starlink terminal is more like what was done to reprogram satellite TV smart cards. Get a copy of the ROM, count the processor cycles and find the operation you don't want happens and mess with the voltage or frequency at that point to let you send in unsigned/unauthorized updates.
colinsane 4y ago
don’t miss the link to the original article, especially if you prefer understanding the technical details: https://www.esat.kuleuven.be/cosic/blog/dumping-and-extracting-the-spacex-starlink-user-terminal-firmware/ https://www.esat.kuleuven.be/cosic/blog/dumping-and-extracti...
Uptrenda 4y ago
This is like saying if someone can get close to your house with a hammer they can mount a hammer attack on your windows and bypass your homes security. lmao, what a load of bullshit.
- deleted 4y ago
  [deleted]
greggman3 4y ago
I wonder when the first hacker will hack a satelite, fire it's retro-rockets to make it crash and cause the Kessler Syndrome, intentionally or not https://en.wikipedia.org/wiki/Kessler_syndrome https://en.wikipedia.org/wiki/Kessler_syndrome Of course that could also happen with random bugs and no hacking I guess?
- bayindirh 4y ago
  There are already people who talk with satellites, recover them or make older ones work again. It’s one google search away.
- j-wags 4y ago
  Hackers damaged/destroyed the ROSAT satellite in the late 90s https://en.wikipedia.org/wiki/ROSAT#End_of_operations https://en.wikipedia.org/wiki/ROSAT#End_of_operations
  - yencabulator 4y ago
    Your link contradicts that (or at least has NASA denying it): > However, NASA officials in charge of the day-to-day operations of the ROSAT mission at Goddard, including GSFC Rosat Project Scientist Rob Petre, say definitively that no such incident occurred. Talleur's information appears to have come from one of his interns who exaggerated a hacking incident on an office computer not related to flight operations.
    - j-wags 4y ago
      Ah, you're right - I'd vaguely remembered seeing this before and pasted the wikipedia section without reading it thoroughly. My mistake!
- ezoe 4y ago
  From what I've heard, there are many vulnerable old satelites orbiting around the earth. The attack hasn't happened simply because communication equipment is out of hand for an malicious individual and there is no way he can hide the act.
gtvwill 4y ago
Eh low threat hack. Requires physical access to dish and installs piece of easily identifiable hardware. Tbh give unfettered access to most hardware and you can hack it.
- yarg 4y ago
  The terminal is used to contact the constellation as well as Starlink's backend servers. If the remote machines have the assumption of trustworthy terminals baked in, then this isn't a low threat hack.
  - sneak 4y ago
    > If the remote machines have the assumption of trustworthy terminals baked in, Given the general competence level of the engineering at SpaceX, I would not put any money on this being true. Maybe if the system were designed by Sony...
    - yarg 4y ago
      I know it's somewhat unlikely, but I was replying to someone who couldn't even see the potential value of a hacked terminal as the entry point to an attack chain.
      - sebastialonso 4y ago
        You are completely right about the potential magnitude of the hack, but my first approach was purely as an individual consumer, this doesn't affect me. Seeing this as an engineer...yikes
    - GuB-42 4y ago
      Even Sony doesn't considers its terminals trustworthy. They really don't want you to root your PlayStation, but that's mostly because it allows you to hack offline games. Hacked consoles are usually banned pretty quickly from online services. It doesn't mean Sony has the best track record when it comes to security just that they are not completely clueless.
shadowtamperer 4y ago
Any1savr the repo b4 it got taken down and have a copy ro share? orionkanat@pm.me
roy9240356 4y ago
I read the article as well as the DEFCON presentation. I still don't know how they used voltage fault injection to bypass the secure boot. Anyone care to explain?
- sounds 4y ago
  This is what I found at the top of an internet search: Under voltage fault injection - "In general, single instruction skips are easily achievable, though skips of multiple nearby instructions are more difficult to induce and control." https://research.nccgroup.com/2021/07/07/an-introduction-to-fault-injection-part-1-3/ https://research.nccgroup.com/2021/07/07/an-introduction-to-...
bitcoinmoney 4y ago
Can you triangulate satellite locations with this attack? If yes one could shoot down starlink satellites one by one.
- GekkePrutser 4y ago
  Their position is not a secret. They're tracked by NORAD and their tracking parameters are public. You can track them with any satellite tracker app. The tracking elements are here: https://celestrak.org/NORAD/elements/gp.php?GROUP=starlink&FORMAT=tle https://celestrak.org/NORAD/elements/gp.php?GROUP=starlink&F... This info is enough to calculate their exact position and is constantly updated as their orbits change due to degradation or powered movements. But accurately hitting an object at 400km altitude moving at 10km/s is outside the capability of all but corporate and state actors and starlink is not great target because their sats are so small and there's so many of them. It would cost a fortune in missiles just to make a dent in the constellation.
Uptrenda 4y ago
notpushkin 4y ago
Previously, previously, previously, previously: https://hn.algolia.com/?query=The%20hacking%20of%20Starlink%20terminals%20has%20begun&type=story&dateRange=all&sort=byDate&storyText=false&prefix&page=0 https://hn.algolia.com/?query=The%20hacking%20of%20Starlink%...
- dang 4y ago
  Reposts are fine if a story hasn't had significant attention yet! In fact, if the story is a good one, they're helpful, because they mitigate the randomness of what gets noticed on /newest. https://news.ycombinator.com/newsfaq.html https://news.ycombinator.com/newsfaq.html
- deleted 4y ago
  [deleted]
- notpushkin 4y ago
  On a side note: wondering why the Starlink maritime coverage link [1] has made it to the homepage, but the hacking stuff never did. [1]: https://news.ycombinator.com/item?id=32426281 https://news.ycombinator.com/item?id=32426281
  - dang 4y ago
    Randomness.
- jerryjerryjerry 4y ago
  wow, lots happened in just one single day... thanks and voted

How narrow of a beam is attainable with this? What shape is the beam? How good is that clock chip? I wish I knew more about this stuff at the theory level. A cheap and hackable phased array sounds very cool to experiment with.

Eriks 4y ago

Relevant presentation on DEFCON Media server: https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Lennert%20Wouters%20-%20Glitched%20on%20Earth%20by%20humans%20A%20Black-Box%20Security%20Evaluation%20of%20the%20SpaceX%20Starlink%20User%20Terminal.pdf https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20pre... https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Lennert%20Wouters%20-%20Glitched%20on%20Earth%20by%20humans%20A%20Black-Box%20Security%20Evaluation%20of%20the%20SpaceX%20Starlink%20User%20Terminal.mkv https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20pre...

upupandup 4y ago
[flagged]
- jchw 4y ago
  Realistically, I think it's funded in large parts by U.S. government grants to provide affordable internet to rural areas. https://www.cnbc.com/2020/12/07/spacex-starlink-wins-nearly-900-million-in-fcc-subsidies-auction.html https://www.cnbc.com/2020/12/07/spacex-starlink-wins-nearly-... Of course though, I'm not sure what the status on that is today. Looks like they may not be able to ride that train anymore: https://www.reuters.com/world/us/us-rejects-broadband-subsidies-spacexs-starlink-ltd-2022-08-10/ https://www.reuters.com/world/us/us-rejects-broadband-subsid...
  - panick21_ 4y ago
    That was never considered a large part of the funding. That would simply have been some additional income over the next decade. And its not happening now anyway. And given the limited capacity, they might as well use that capacity for other costumers.
- Nextgrid 4y ago
  > On the bright side, this means free internet outdoors in many remote parts of the world will be possible and funded by loyal Elon Musk fans ;) I don’t believe they are that stupid as to delegate access control to the client.
- debatem1 4y ago
  In the same way that me turning off secure boot on my desktop means free Netflix for everyone and we should shut down Comcast until there's a fix. This is a cool attack, but (so far) no more than that. I'd expect that the SpaceX security team is over there putting in some glitch resistant compares at the moment, assuming they haven't already.
  - femiagbabiaka 4y ago
    Yeah it's quite the opposite actually. Taken from the excellent preso linked above: """ • This is a well-designed product (from a security standpoint) • No obvious (to me) low-hanging fruit • In contrast to many other devices getting a root shell was challenging • And a root shell does not immediately lead to an attack that scales """
- deepdriver 4y ago
  > meaning everyone of those floating satellites needs to be brought back down and modified Don’t they have a fairly short operational lifetime, thanks to increased drag from being in LEO? IIRC it’s around 5 years. I believe that’s part of the reason for the high launch cadence. Worst case they just limp along with what they’ve got until they’re all replaced with new satellites.
- pelorat 4y ago
  What are you on about. This has nothing to do with the satellites, not can this hardware mod ever be used to affects the hardware in orbit.
  - walnutclosefarm 4y ago
    That's not necessarily true. Hacking the ground station means in all likelihood getting access to low level protocols between the ground station and satellite, which potentially means getting the ability to affect the satellites. Not a sure thing, but if I wanted to attack a StarLink satellite, this would be a solid first step in doing so.
    - sneak 4y ago
      The researcher mentions that in the article.
- rockemsockem 4y ago
  Uh, why though? This demonstrates that a determined attacker can get access to the software running on their own personal terminal. That's like a determined attacker being able to get access to their own personal router. It sounds like strictly a good thing and with how many satellite internet companies are coming online we will hopefully see some common hardware devices that users have full access to along with some custom firmware that folks can run on them. This has almost nothing to do with the security of the satellite constellation itself.
  - AnotherGoodName 4y ago
    Where it would be problematic is if it's trivial to do this to someone else's terminal.
  - Aeolun 4y ago
    Like jailbreaking your iPhone
- ajross 4y ago
  Do you write a comment like that every time someone roots a cable modem too? That seems a little over the top. This is an exploit of the base station device. It seems that it might be used to grant access for which the owner hadn't paid, but that's also something that can be trivially patched around at the routing level ("sure, it's a valid base station, but if it's not on the list of paying customers it doesn't get packets"). It doesn't seem like there's a broader exploit against the network at all, beyond allowing the thing to attempt a DoS attack (something that is also always possible with jamming hardware, but very difficult in practice given the number of satellits).
  - Scoundreller 4y ago
    Should be possible to DoS your area in the footprint, so everyone within a few hundred kilometers around you? A phased array helps but you could also have a heliostat-type setup that tracks the satellite.
contingencies 4y ago
Other relevant links from the presentation are https://exploitee.rs/index.php/Exploitee.rs_Low_Voltage_e-MMC_Adapter https://exploitee.rs/index.php/Exploitee.rs_Low_Voltage_e-MM... (recommended firmware extraction hardware) https://www.esat.kuleuven.be/cosic/blog/dumping-and-extracting-the-spacex-starlink-user-terminal-firmware/ https://www.esat.kuleuven.be/cosic/blog/dumping-and-extracti... (firmware extraction writeup) https://rtfm.newae.com/ https://rtfm.newae.com/ (glitching and side channel analysis hardware) and https://github.com/newaetech/chipwhisperer https://github.com/newaetech/chipwhisperer (associated open source toolchain)

GormHouj 4y ago

I see a lot of articles that quote the cost for hacking a product or service. I feel like these type of titles undermine the effort that took place. Surely the lab Wouters used had tools and processes that aren't cheap, nor would you consider his expertise inexpensive. I'm not impressed by a PCB board being cheap. Does anyone else feel this way about similar headlines?

xen2xen1 4y ago
Yes and no. Is the $25 increasingly irrelevant. Sure. Is it clickbait-y, yes. Does it matter because it might make it more widespread, it probably still does.
mikeytown2 4y ago
Price is a factor for how accessible the hack is. If it requires an expensive FGPA or a lot of AWS time to crack then that makes it less appealing.
- wpietri 4y ago
  Exactly. For me it's about the replicability of the attack. Is it restricted to government-sized organizations? Or can anybody with the skills do it?
- GormHouj 4y ago
  Interestingly, either H/N changed the submission title, or the article itself changed their title to reflect the content of the article better. Is there a way I can check which happened in the last few hours?
tppiotrowski 4y ago
I think the point is that anyone with $25 can hack Starlink once the script or instructions are published online. Information costs almost nothing to publish/ share so it's the cost of the hardware that matters.
- samstave 4y ago

ThrowawayTestr 4y ago

Is there any mitigation against these kinds of power/timing attacks? I think the Switch was originally hacked this way.

mikeytown2 4y ago
New hardware revisions are required to fix usually. You can probably detect a compromised terminal on the network though.
karmicthreat 4y ago
I don’t think you can eliminate them, just make them harder to exploit. Require multiple glitches to succeed etc.
- notfish 4y ago
  Agreed, usually if they have hardware access it’s gonna be cracked eventually. Hard to imagine a system that was truly unhackable with infinite unrestricted physical access.
KMnO4 4y ago
No, not without changing microprocessors. Essentially these chips are locked by setting certain flags in memory. Various flags control various peripherals, including a flag to disable read/write access to the firmware. Obviously once you disable access, it’s permanent because you don’t have access to reenable it. This side channel attack takes advantage of a flaw in the actual silicon, where branches can be skipped if the power is altered momentarily. So if you skip that first check, the attacker has low level firmware control. (This was also how the firmware was dumped on the Apple AirTags) The only mitigation is to use a chip that doesn’t suffer from this flaw or change the software to prevent “root” access even if an adversary has access to the entire firmware (ie do things server side)
- 14 4y ago
  Xbox 360 had the reset glitch hack where if you powered cycled the chip at the exact right timing you could run unsigned code. It required a small mod chip soldered to some of the smallest points on the motherboard that I have ever soldered. Different versions of the 360 worked better but most worked even if it took a minute or so before the glitched worked and booted into custom firmware. Mine worked really well and booted first try almost every time. I was very proud to successfully install it and watch my 360 boot into fsd a custom OS that allowed me to play all my games from a HDD.

AYBABTME 4y ago

This reads to me like the (more complicated but ultimately) equivalent of "a user reverse engineers the website's javascript!". As in, this allows the user to mod their client but it doesn't change anything for anyone else, and wasn't meant as a real secure element. I'd assume that getting root access to the user terminal gives them no additional privileges to access the actual Starlink data & control planes.

jandrese 4y ago
It might allow them to do things like connect to the Starlink network outside of their geofence. Or hacking a stationary antenna to work on a moving vehicle.
- olalonde 4y ago
  > connect to the Starlink network outside of their geofence I was wondering about that but can't they determine the location "server side" by triangulation? Or maybe they could in theory but they don't in practice?
  - colechristensen 4y ago
    Knowing the positions of all the clients and satellites is a basic requirement for operating the network.
    - jandrese 4y ago
      For the satellites this is true, but it's not necessary for the clients to be geolocated when the satellite is operating as a bent pipe. Starlink will know which clients are in which footprint and can locate anybody if they want to, but it's not fundamental to the functionality of the system.
      - colechristensen 4y ago
        Both the client and the satellite use beam forming. The signal is pointed at you in a relatively narrow beam not broadcast spherically. They have to know where you are to point at you (phased array antennas so electronic not physical pointing)

elteto 4y ago

Great response by SpaceX: https://api.starlink.com/public-files/StarlinkWelcomesSecurityResearchersBringOnTheBugs.pdf https://api.starlink.com/public-files/StarlinkWelcomesSecuri... “Bring on the bugs”. This is how you properly engage the security community. In times where journalists are taken to court for looking at a webpage’s HTML source it’s really great seeing a company that “gets it”. Kudos.

deleted 4y ago
[deleted]
zbird 4y ago
I will never understand why bug-bounty hunters work for such a low pay. They are doing the hard work for peanuts and absolutely no benefits or long-term incentives. $25k per bug, while the CEO and friends are going to make billions from this. At least if you find a bug, go and exploit it and bring the satellite down. This way we can all have some fun, not just the VPs sitting on the company board. And then they call their conferences with menacing names such as 'Black Hat' or 'DEFCON'. Sounds more like pony-con to me.

drewg123 4y ago

The response from Starlink[0] was pretty amazing. I love this quote: "we want to congratulate Lennert Wouters on his security research into the Starlink user terminal – his findings are likely why you're reading this, and help us create the best product possible." A lot better than companies that would try to prosecute him.. [0]: https://api.starlink.com/public-files/StarlinkWelcomesSecurityResearchersBringOnTheBugs.pdf https://api.starlink.com/public-files/StarlinkWelcomesSecuri...

LeifCarrotson 4y ago
Full of good sense. They do try to control the terminal to do a secure boot: > We want our devices to only run software that we wrote. This isn't like a personal computer where the user can install apps or save files – the only software we want to run on our devices is software that we've explicitly built, tested, and signed off on. > The same concepts that go into secure boot on our satellites are also useful on the Starlink user terminals. Even though we know that an attacker with persistent and invasive physical access will eventually be able to defeat secure boot on their own device, the protections of secure boot are still valuable for protecting against remote attacks over the Internet (or over wifi). There is a big difference between being able to take your own device off your roof and attack it, vs. someone else being able to compromise your device without you noticing. But recognize that it's not foolproof: > We expect attackers with invasive physical access to be able to take malicious actions on behalf of a single Starlink kit using its identity, so we rely on the design principle of "least privilege" to constrain the effects in the broader system. We treat Starlink user terminals as inherently untrusted and only expose the minimal necessary information and capabilities to each specific client. The article talks about the researcher "exploring the Starlink network" as if there's a screen on the satellites that will suddenly display "Access Granted" with a blinking cursor now that he's achieved root on his own dish. Getting access to the dish is an important step if the former is to be achieved, but it's by far the easier of the two steps.
unsupp0rted 4y ago
> Wouters revealed the vulnerability to SpaceX in a responsible way through its bug bounty program before publicly presenting on the issue.

game-of-throws 4y ago

This attack sounds very similar to how the Super Game Boy boot ROM was dumped. https://gbdev.gg8.se/wiki/articles/Gameboy_Bootstrap_ROM https://gbdev.gg8.se/wiki/articles/Gameboy_Bootstrap_ROM Some things never change.

jerryjerryjerry 4y ago

deleted 4y ago
[deleted]

tg180 4y ago

The article compares the Russian jamming of Viasat with the compromise of a Starlink UT. No, no, no... This is really wrong! > As is typically the case with any technology, the increase in use and deployment of Starlink and other satellite constellations also means that threat actors have a greater interest in finding their security holes to attack them. > Indeed, Russia saw an advantage in taking out a satellite providing internet communications across Europe by attacking its technology on the ground as Russian troops entered Ukraine on Feb. 24. Viasat orbits at 22,000 miles, Starlink is in LEO. Precisely for this reason Starlink is naturally more resistant to jamming, and is used in Ukraine because of this. Locally compromising a UT is a hack of an endpoint connection device, which has nothing to do with ELINT and electronic warfare activities (which is an entirely different kind of attacks for satellite networks).

detaro 4y ago
Viasat attack was by hacking ground terminals, not jamming satellites.
- tg180 4y ago
  The Russian approach is hybrid: in addition to the use of jamming (they use Divnomorye, Leer, Moskva, Krasukha, ...), traditional hacking is used to extend the damage range beyond what can be obtained through pure electronic warfare. In the case of Viasat they had access to a badly configured VPN appliance and used it to deploy on the terminals. Which is a classical case of network compromise, not a direct hack of the user devices. Also considering this aspect the comparison is not there: it's a local access to the hardware vs an "I own your infrastructure and I'm able to deploy my firmware".
  - mlyle 4y ago
    > Also considering this aspect the comparison is not there: it's a local access to the hardware vs an "I own your infrastructure and I'm able to deploy my firmware". Yes, performing this reverse engineering requires physical access. But it potentially enables one to find further vulnerabilities and systems knowledge necessary to build attacks that brick network terminals or otherwise disrupt the network. Russia's action proves these attacks are viable and useful (even if an authenticated management vector was used). Your original comment about the constellation height was a non-sequitur: we're talking about threat actors' attacks on end-user terminals. The article makes clear ("on the ground") that this is what it was referring to. Yes, jamming, etc, are also useful attacks that threat actors use but not what we're talking about.

vajenetehais 4y ago

This is quite impressive and congratulation are well deserved. Now the fun part can start. This work opens a door to the user segment, i can't wait to see what's behind and hope for starlink that their C2 and user segments are well isolated. Let the fuzzing begin.

josephcsible 4y ago

It shouldn't count as a vulnerability that you can get root of a device that you have physical possession of. If there's any real vulnerability here, it's that having root of your terminal gives you any extra privileges to the rest of the network.

bilekas 4y ago
I have to agree to be fair. Physical access is obviously incredibly different than exploiting a vulnerable even a particularly egregious design flaw. Wouters has to literally short the board. That said it is a clever approach and it’s good it was discovered by someone without nefarious intentions.
bdcravens 4y ago
If a system is designed to not allow that access, and you can compromise that design, it is most definitely a vulnerability.
- nine_k 4y ago
  If a system is not resilient against rooting a terminal which is in user's physical possession, it's a design flaw. Or, rather, the more resilient the system as a whole is to compromises of individual terminals, the better the design is. Assuming such compromise never happens would be outright incompetent.
  - mlyle 4y ago
    You might very well want both E.g. You may want to protect end users against implants and other attacks from physical tampering with their terminals. You might not want hostile parties to have an easy time reverse engineering terminals so they can more easily search for remote vulnerabilities in the terminals. You may not want to hand hostile parties a phased array optimized to transmit to Starlink running arbitrary software of their choice, along with keys identifying the terminal, because even though you think the satellites and authentication mechanisms are robust, making it hard to get this information adds defense in depth.

roastedpeacock 4y ago

This WIRED article[1] references a release of tools and information about the research on GitHub[2] however it 404s. Hope that is not being censored. [1] https://www.wired.com/story/starlink-internet-dish-hack/ https://www.wired.com/story/starlink-internet-dish-hack/ [2] https://github.com/KULeuven-COSIC/Starlink-FI https://github.com/KULeuven-COSIC/Starlink-FI

gorkish 4y ago
This bothered me yesterday when news broke. I'm surprised that more people are not discussing the lack of follow-on information here.
upupandup 4y ago
- samstave 4y ago
- roastedpeacock 4y ago
  > looks like Starlinks legal dept got to the github repo first :( If true than it was not through the normal DMCA process of GitHub that would result in a public[1] take-down notice being filed for transparency. [1] https://github.com/github/dmca https://github.com/github/dmca
jacooper 4y ago
Should've uploaded the repo to IPFS or Radicle.
colinsane 4y ago
archive.org only ever captured 404s for that page. i wonder if it was a typo in the article. does Starlink use TI’s SimpleLink? because there’s a very similarly-named repo doing similar fault injection here: https://github.com/KULeuven-COSIC/SimpleLink-FI https://github.com/KULeuven-COSIC/SimpleLink-FI

rkagerer 4y ago

I'd love to see what can be done with this access. Mobile Starlink?

savrajsingh 4y ago
They already support RVs

29athrowaway 4y ago

Certainly it did not cost $25 to develop the modchip. If you put in the labor and software related cost it's not $25.

nine_k 4y ago
It may cost $25 to deploy the hack after it has been developed. It's mere $25k to deploy 1000 instances of it, or even cheaper due to the economies of scale.
- hunterb123 4y ago
  Since you need physical access, it's plus the cost of the dish and one month of service, either by stealing or buying them. The former would be quite illegal and difficult to scale, the latter would be quite expensive.
unixbane 4y ago
I have quit the software industry and now get paid what people _should_ get paid for software which is a small fraction of what I was being paid before. By choosing to work on actual real problems, instead of partaking in the pseudo-intellectual clout chasing contest that is the tech industry, I have discovered the real value of software which was never much to begin with as I assumed it was when I was a kid. tl;dr yep, he could have been shoveling CRUD shit and making more money, or implementing high end algorithms within broken operating systems, or implementing high end algorithms with insufficient education or time to prove them, while getting dumber scratch that he got a bug bounty for his work so his net gain is equal. check mate
TheDong 4y ago
I'm confused what you're even arguing against. The article specifically uses the phrasing "uses off-the-shelf parts that cost around $25". It doesn't say anything about the cost to develop, it doesn't say anything even slightly misleading or ambiguous about this. Like, what should the article have done instead? How could it possibly be clearer and more explicit about what $25 referred to here?

ck2 4y ago

Pretty sure Russia has physical satellite killer missiles just like US does? Would a nuke in space even work to take out a group of them, maybe even via an EMP surge or are they hardened? Sometimes I wonder if the world would be more peaceful if cellphone networks couldn't work anymore but there would be so much other chaos so guess not.

upupandup 4y ago
- bpodgursky 4y ago
  > The PLA has literally robots that can obscure and destroy US satellites without launching missiles at it This is 100% speculation. The only thing that China has demonstrably done is blow up satellites. It would be unsurprising if this tech was in development, but nobody has any clue whether there are non-kinetic satellite neutralization weapons deployed.
  - Aeolun 4y ago
    I imagine a high powered laser would work pretty well against something the size of a Starlink sat? Not sure if we can focus them well enough to be worth the power expenditure though.
- CyanBird 4y ago
  Don't spread useless misinformation on hackernews
  - upupandup 4y ago
    I don't think you understand what that word means.
panick21_ 4y ago
Russia does not have the capability of destroying Starlink because the amount of upmass required to destroy them is larger then what the Russians can actually do. SpaceX replacement rate would be higher then Russia destroy rate.

WD-42 4y ago

I never understand why the dollar amount is always included in these headlines. Like affording the $25 worth of hardware is really the most difficult obstacle to overcome here.

HWR_14 4y ago
It's a sign of the hackers skill that they can take the same difficult problem and make it so anyone with $25 can duplicate it. Making something accessible to the masses makes it a more impressive achievement.
Hellion 4y ago
It’s because it makes it accessible, which is important.
twawaaay 4y ago
The original hacker might have needed a lot of specialized, highly valuable knowledge, but what $25 means is that almost anybody can do the same with some instruction even if they couldn't come up with the instructions or even don't understand what they are doing.
chucksta 4y ago
Thats' the point, its a trivial amount. Implying it's super easy and people should be worried.
deleted 4y ago
[deleted]

politelemon 4y ago

I would like to point out the mildly appropriate and endearing name in this context, 'Wouters' (routers)

Mo3 4y ago
That's a pretty common name here in the Netherlands

jcims 4y ago

I'm sure it will never happen but it would be awesome if they would release an 'open' terminal under the same auspices of commercial SDR transceivers. I'm curious if these could be used for very localized doppler radar.

debatem1 4y ago
You can build a simple Doppler radar yourself today using a couple of SDRs, but sophisticated phased arrays are the kind of thing that makes for pretty good military equipment. I doubt an open one will come on the market (legally) soon.
- zmgsabst 4y ago
  Just say you’re doing high resolution of metamaterials for science. Materials resonant at the target radar band, because that wavelength is easier to manufacture/economically useful/etc. I think you’re more likely to find a job than trouble — SBIR has a bunch of grants in that area. (Last I looked.)

bee_rider 4y ago

Hacking in the older "using a device in an unexpected/unsupported way," not "black-hat hacking" I guess. Typical over-dramatic Wired. Hats off to this guy, hardware hacks always impress.

russdill 4y ago
Locking down user terminals is one part of starlink security. Breaking that is a huge accomplishment. It appears that the other layers still prevent this from being a full blown attack, but that may just be a matter of time.
- bpodgursky 4y ago
  What makes you think this is true? I'm not shocked they did lock it down, but why do you think it's important to the security?
  - russdill 4y ago
    They are using a layered model. Giving an attacker access to communicate directly with your satellites and send specially crafted packets is giving them a really useful tool.
- pelorat 4y ago
  Sure, but an attack to do what? Even with full hardware access there's nothing that can be done with the network itself, nor can it be used to snoop on other users, nor does it give some access to the satellites themselves. It's akin to rooting your ISP provided modem.
  - TechBro8615 4y ago
    If you root your ISP provided modem, aren’t you one step closer to exploiting some bug in DOCSIS? Similarly here wouldn’t you be one step closer to exploiting the “network itself?” (Air-quotes because I’m not actually sure what that means in this context.)

keepquestioning 4y ago

Planet Labs really missed the boat here. Could've easily beat SpaceX

philipwhiuk 4y ago
To what? Planet Labs have a handful of LEO imaging sats, some of which SpaceX has launched. They can't afford to launch a LEO internet constellation.
mlindner 4y ago
Planet isn't an internet service provider company. Even if they wanted to become one, they'd need access to tremendous amounts of capital and low launch costs to re-create what Starlink is. It's an open question if Amazon will be able to compete with it's eventual system or not.

addisonl 4y ago

Anyone have a link to read without hitting the paywall?

autarch 4y ago
https://archive.ph/o1vnP https://archive.ph/o1vnP

bluedino 4y ago

Remember 20+ years ago when people did this with cable modems?

hackernudes 4y ago
And remember how the cable companies completely fixed it? Starlink already seems to do the right thing to prevent cloning and unauthorized access. Secure chip (STSAFE) and mTLS for talking to internal services. Maybe researchers will find some bugs in their services but they will be patched quickly.
Scoundreller 4y ago
Cable modems were easy: all you needed to do was JTAG them. I don't think any glitching was required. The approach used for the Starlink terminal is more like what was done to reprogram satellite TV smart cards. Get a copy of the ROM, count the processor cycles and find the operation you don't want happens and mess with the voltage or frequency at that point to let you send in unsigned/unauthorized updates.

colinsane 4y ago

don’t miss the link to the original article, especially if you prefer understanding the technical details: https://www.esat.kuleuven.be/cosic/blog/dumping-and-extracting-the-spacex-starlink-user-terminal-firmware/ https://www.esat.kuleuven.be/cosic/blog/dumping-and-extracti...

Uptrenda 4y ago

This is like saying if someone can get close to your house with a hammer they can mount a hammer attack on your windows and bypass your homes security. lmao, what a load of bullshit.

deleted 4y ago
[deleted]

greggman3 4y ago

I wonder when the first hacker will hack a satelite, fire it's retro-rockets to make it crash and cause the Kessler Syndrome, intentionally or not https://en.wikipedia.org/wiki/Kessler_syndrome https://en.wikipedia.org/wiki/Kessler_syndrome Of course that could also happen with random bugs and no hacking I guess?

bayindirh 4y ago
There are already people who talk with satellites, recover them or make older ones work again. It’s one google search away.
j-wags 4y ago
Hackers damaged/destroyed the ROSAT satellite in the late 90s https://en.wikipedia.org/wiki/ROSAT#End_of_operations https://en.wikipedia.org/wiki/ROSAT#End_of_operations
- yencabulator 4y ago
  Your link contradicts that (or at least has NASA denying it): > However, NASA officials in charge of the day-to-day operations of the ROSAT mission at Goddard, including GSFC Rosat Project Scientist Rob Petre, say definitively that no such incident occurred. Talleur's information appears to have come from one of his interns who exaggerated a hacking incident on an office computer not related to flight operations.
  - j-wags 4y ago
    Ah, you're right - I'd vaguely remembered seeing this before and pasted the wikipedia section without reading it thoroughly. My mistake!
ezoe 4y ago
From what I've heard, there are many vulnerable old satelites orbiting around the earth. The attack hasn't happened simply because communication equipment is out of hand for an malicious individual and there is no way he can hide the act.

gtvwill 4y ago

Eh low threat hack. Requires physical access to dish and installs piece of easily identifiable hardware. Tbh give unfettered access to most hardware and you can hack it.

yarg 4y ago
The terminal is used to contact the constellation as well as Starlink's backend servers. If the remote machines have the assumption of trustworthy terminals baked in, then this isn't a low threat hack.
- sneak 4y ago
  > If the remote machines have the assumption of trustworthy terminals baked in, Given the general competence level of the engineering at SpaceX, I would not put any money on this being true. Maybe if the system were designed by Sony...
  - yarg 4y ago
    I know it's somewhat unlikely, but I was replying to someone who couldn't even see the potential value of a hacked terminal as the entry point to an attack chain.
    - sebastialonso 4y ago
      You are completely right about the potential magnitude of the hack, but my first approach was purely as an individual consumer, this doesn't affect me. Seeing this as an engineer...yikes
  - GuB-42 4y ago
    Even Sony doesn't considers its terminals trustworthy. They really don't want you to root your PlayStation, but that's mostly because it allows you to hack offline games. Hacked consoles are usually banned pretty quickly from online services. It doesn't mean Sony has the best track record when it comes to security just that they are not completely clueless.

shadowtamperer 4y ago

Any1savr the repo b4 it got taken down and have a copy ro share? orionkanat@pm.me

roy9240356 4y ago

I read the article as well as the DEFCON presentation. I still don't know how they used voltage fault injection to bypass the secure boot. Anyone care to explain?

sounds 4y ago
This is what I found at the top of an internet search: Under voltage fault injection - "In general, single instruction skips are easily achievable, though skips of multiple nearby instructions are more difficult to induce and control." https://research.nccgroup.com/2021/07/07/an-introduction-to-fault-injection-part-1-3/ https://research.nccgroup.com/2021/07/07/an-introduction-to-...

bitcoinmoney 4y ago

Can you triangulate satellite locations with this attack? If yes one could shoot down starlink satellites one by one.

GekkePrutser 4y ago
Their position is not a secret. They're tracked by NORAD and their tracking parameters are public. You can track them with any satellite tracker app. The tracking elements are here: https://celestrak.org/NORAD/elements/gp.php?GROUP=starlink&FORMAT=tle https://celestrak.org/NORAD/elements/gp.php?GROUP=starlink&F... This info is enough to calculate their exact position and is constantly updated as their orbits change due to degradation or powered movements. But accurately hitting an object at 400km altitude moving at 10km/s is outside the capability of all but corporate and state actors and starlink is not great target because their sats are so small and there's so many of them. It would cost a fortune in missiles just to make a dent in the constellation.

Uptrenda 4y ago

notpushkin 4y ago

Previously, previously, previously, previously: https://hn.algolia.com/?query=The%20hacking%20of%20Starlink%20terminals%20has%20begun&type=story&dateRange=all&sort=byDate&storyText=false&prefix&page=0 https://hn.algolia.com/?query=The%20hacking%20of%20Starlink%...

dang 4y ago
Reposts are fine if a story hasn't had significant attention yet! In fact, if the story is a good one, they're helpful, because they mitigate the randomness of what gets noticed on /newest. https://news.ycombinator.com/newsfaq.html https://news.ycombinator.com/newsfaq.html
deleted 4y ago
[deleted]
notpushkin 4y ago
On a side note: wondering why the Starlink maritime coverage link [1] has made it to the homepage, but the hacking stuff never did. [1]: https://news.ycombinator.com/item?id=32426281 https://news.ycombinator.com/item?id=32426281
- dang 4y ago
  Randomness.
jerryjerryjerry 4y ago
wow, lots happened in just one single day... thanks and voted