3 ms·

Uncle Sam wants DEF CON hackers to pwn this Moonlighter satellite in space

57 points by LinuxBender 3y ago

controversial97 3y ago
It is expected to be at an altitude of between 465 km and 500 km. That means that from where you happen to be on the earths surface it will be above the horizon and in radio range once or twice a day for 30 seconds to a couple of minutes depending on how close to you it gets, how high up you can get your antenna and the terrain around you blocking some of your view of the sky.
- wkat4242 3y ago
  It also depends mostly on how high the pass is in the sky. But yeah 5 mins or so max in best conditions
  - controversial97 3y ago
    There is a bit more information in mission statement. https://forum.nasaspaceflight.com/index.php?action=dlattach;topic=57030.0;attach=2131120;sess=0 https://forum.nasaspaceflight.com/index.php?action=dlattach;... A ground station at 10000 feet altitude on the mountain on the island of Maui, surrounded by ocean may have the satellite in range for eight minutes.
    - wkat4242 3y ago
      Ok yeah but I was talking best case for us mere mortals that have some of a horizon and aren't 10k feet up in the air :) As a ham operator I worked sats a lot and 5 mins is the best pass I'd get even if I'd go outside on a hill for it.
bigjimmyk3 3y ago
I have a friend who chases satellite contacts, and it's a fascinating hobby -- as noted the contact windows are pretty short, and you have to know how to adjust your freqs within the window to account for Doppler effect. The upside is that you can work most satellites with a standard handheld on frequencies available (in the US) to technician licensees, e.g. the base license class.
- Simulacra 3y ago
  In theory couldn't anyone try to hack it, then?
  - ganoushoreilly 3y ago
    Yes, if you have the time, knowledge, and appropriate equipment it's possible. There was even a time where if you had the right information you could steal bandwidth on some commercial sats in the early 2ks. We're not talking a lot of bandwidth but it was possible. Now there are a few people that use repurposed dishes to catch the downstream from various satellites but that's more collection than active hacking so to speak. There was also a huge market for dish / direcTv cards (i'm sure it still exists) as well. Here's a few presentations from BH/DC from around that time. https://www.blackhat.com/presentations/bh-dc-09/Laurie/BlackHat-DC-09-Laurie-Satellite-Hacking.pdf https://www.blackhat.com/presentations/bh-dc-09/Laurie/Black... https://www.blackhat.com/presentations/bh-dc-10/Nve_Leonardo/BlackHat-DC-2010-Nve-Playing-with-SAT-1.2-wp.pdf https://www.blackhat.com/presentations/bh-dc-10/Nve_Leonardo...
ackbar03 3y ago
I know networks like satnogs let you receive signals from different areas to account for the short transmission windows. I don't think the satellites on satnogs allow for uplink though? Can this only be done through something like aws groundstation?
deleted 3y ago
[deleted]
denton-scratch 3y ago
> "If you're doing a hacking competition, or any sort of cyber activity or exercise with a live vehicle, it's difficult because you're potentially putting that vehicle's mission at risk" You're potentially putting your webserver at risk whenever you put up a website. It's nothing to do with space missions or hacking contests. And I disapprove ot the use of the prefix "cyber" to refer to anything other than control systems. It's become a US military hype word.
- dmd 3y ago
  But it doesn't cost tens of millions of dollars to stand up a new server.
  - denton-scratch 3y ago
    How much does it cost to put up a 3U cubesat? I thought that was in the tens of thousands. [Edit] Ah: Wikipedia says a 1U cubesat cost $60,000 to launch in 2021. https://en.wikipedia.org/wiki/CubeSat#Costs https://en.wikipedia.org/wiki/CubeSat#Costs
- runlevel1 3y ago
  Satellites are a lot harder to replace than webservers. I remember the prefix "cyber-" already being seen as cringy in the late 90s. I'm a bit surprised it's stuck around as much as it has.
runlevel1 3y ago
It's good to see the USG actually investing some money into what, on balance, is mainly defensive security. Secrecy makes it hard to know what the ROI is from the massively larger investment in offensive security. However, seeing as how vulnerable much of our critical infrastructure is reported to be, the balance really needs to shift towards defense.
tester756 3y ago
As the article says It doesn't feel new since there's AirForce's https://hackasat.com/ https://hackasat.com/

57 points by LinuxBender 3y ago

It is expected to be at an altitude of between 465 km and 500 km. That means that from where you happen to be on the earths surface it will be above the horizon and in radio range once or twice a day for 30 seconds to a couple of minutes depending on how close to you it gets, how high up you can get your antenna and the terrain around you blocking some of your view of the sky.

wkat4242 3y ago
It also depends mostly on how high the pass is in the sky. But yeah 5 mins or so max in best conditions
- controversial97 3y ago
  There is a bit more information in mission statement. https://forum.nasaspaceflight.com/index.php?action=dlattach;topic=57030.0;attach=2131120;sess=0 https://forum.nasaspaceflight.com/index.php?action=dlattach;... A ground station at 10000 feet altitude on the mountain on the island of Maui, surrounded by ocean may have the satellite in range for eight minutes.
  - wkat4242 3y ago
    Ok yeah but I was talking best case for us mere mortals that have some of a horizon and aren't 10k feet up in the air :) As a ham operator I worked sats a lot and 5 mins is the best pass I'd get even if I'd go outside on a hill for it.

bigjimmyk3 3y ago

I have a friend who chases satellite contacts, and it's a fascinating hobby -- as noted the contact windows are pretty short, and you have to know how to adjust your freqs within the window to account for Doppler effect. The upside is that you can work most satellites with a standard handheld on frequencies available (in the US) to technician licensees, e.g. the base license class.

Simulacra 3y ago
In theory couldn't anyone try to hack it, then?
- ganoushoreilly 3y ago
  Yes, if you have the time, knowledge, and appropriate equipment it's possible. There was even a time where if you had the right information you could steal bandwidth on some commercial sats in the early 2ks. We're not talking a lot of bandwidth but it was possible. Now there are a few people that use repurposed dishes to catch the downstream from various satellites but that's more collection than active hacking so to speak. There was also a huge market for dish / direcTv cards (i'm sure it still exists) as well. Here's a few presentations from BH/DC from around that time. https://www.blackhat.com/presentations/bh-dc-09/Laurie/BlackHat-DC-09-Laurie-Satellite-Hacking.pdf https://www.blackhat.com/presentations/bh-dc-09/Laurie/Black... https://www.blackhat.com/presentations/bh-dc-10/Nve_Leonardo/BlackHat-DC-2010-Nve-Playing-with-SAT-1.2-wp.pdf https://www.blackhat.com/presentations/bh-dc-10/Nve_Leonardo...

ackbar03 3y ago

I know networks like satnogs let you receive signals from different areas to account for the short transmission windows. I don't think the satellites on satnogs allow for uplink though? Can this only be done through something like aws groundstation?

deleted 3y ago

[deleted]

denton-scratch 3y ago

> "If you're doing a hacking competition, or any sort of cyber activity or exercise with a live vehicle, it's difficult because you're potentially putting that vehicle's mission at risk" You're potentially putting your webserver at risk whenever you put up a website. It's nothing to do with space missions or hacking contests. And I disapprove ot the use of the prefix "cyber" to refer to anything other than control systems. It's become a US military hype word.

dmd 3y ago
But it doesn't cost tens of millions of dollars to stand up a new server.
- denton-scratch 3y ago
  How much does it cost to put up a 3U cubesat? I thought that was in the tens of thousands. [Edit] Ah: Wikipedia says a 1U cubesat cost $60,000 to launch in 2021. https://en.wikipedia.org/wiki/CubeSat#Costs https://en.wikipedia.org/wiki/CubeSat#Costs
runlevel1 3y ago
Satellites are a lot harder to replace than webservers. I remember the prefix "cyber-" already being seen as cringy in the late 90s. I'm a bit surprised it's stuck around as much as it has.

runlevel1 3y ago

It's good to see the USG actually investing some money into what, on balance, is mainly defensive security. Secrecy makes it hard to know what the ROI is from the massively larger investment in offensive security. However, seeing as how vulnerable much of our critical infrastructure is reported to be, the balance really needs to shift towards defense.

tester756 3y ago

As the article says It doesn't feel new since there's AirForce's https://hackasat.com/ https://hackasat.com/