9 ms·

Starlink's User Terminal Firmware

213 points by jandeboevrie 3y ago

h2odragon 3y ago
analyzing network hardware for academic credit? nifty! How long has this been going on? Anybody done a comb over OpenWRT similarly? There's numerous slightly customized versions of that in all sorts of hardware.
- timtom39 3y ago
  Yea, favorite place I found OpenWRT was in DJI phantom 2 Wi-Fi Extender module. Managed to SSH into it. Hardware was not particularly interesting just cool to see OpenWRT in a widely purchased product.
  - h2odragon 3y ago
    vacuum cleaners. I went "wait, what?" and then "well, that makes perfect sense actually"
- mydriasis 3y ago
  I was part of a project that did some analysis of OpenWRT firmware at scale. It was a lot of fun. The firmware is ( obviously ) publicly available. If you're interested in finding some cool results, you should try out FACT: https://github.com/fkie-cad/FACT_core https://github.com/fkie-cad/FACT_core It's a super neat tool that does lots of interesting things.
- deleted 3y ago
  [deleted]
toomuchtodo 3y ago
Related: https://hackaday.com/2022/11/28/a-modchip-to-root-starlink-user-terminal-through-voltage-glitching/ https://hackaday.com/2022/11/28/a-modchip-to-root-starlink-u... https://youtu.be/NXqLMmGwJm0 https://youtu.be/NXqLMmGwJm0
denysvitali 3y ago
> The first step was to dump the firmware of the device since it's not publicly available, and we did that thanks to a blog post by the COSIC research group at KU Leuven. And they contribute by not sharing the firmware :( I know it might have legal issues, but this is not helpful for other researchers if we keep things hidden
- deleted 3y ago
  [deleted]
- nicolodev 3y ago
  > Tim Ferrell, from SpaceX's security team, for sending us a testing dish with root access. They probably had a NDA or something that prohibits them to release the firmware publicy.
  - denysvitali 3y ago
    It (sadly) makes sense :(
notfish 3y ago
Its wild to see some of our internal code getting reverse engineered like this. What an incredibly cool read, thanks a ton for sharing!
- inemesitaffia 3y ago
  What do you think of the DOD refusing to pay for starlink in Ukraine until the middle of this year?
- pabs3 3y ago
  Are the Starlink devices GPL compliant?
  - jameshilliard 3y ago
    Nope, they do not comply with the GPL licenses for their User Terminal firmware. I've sent them GPL requests for the GPLv2 Buildroot based firmware build system they use but they have so far refused to provide the source code. They have posted some kernel/uboot sources. I am both a major Buildroot contributor and have Starlink internet service. Their router firmware is OpenWRT based and while they have posted some source code for that it is not the source code corresponding to the binary firmware builds they actually distribute. I have NAND dumps of both the User Terminal and router. Funny enough a few years back their internal firmware CI even accidentally sent me some emails about broken builds since they applied some of my buildroot patches from upstream.
TT-392 3y ago
[flagged]
- sleepybrett 3y ago
  I'm not sure why your petty personal problem, that is remedied very easily in every browser, requires a comment.
  - eddieroger 3y ago
    Oh, /that's/ why it's called cascading style sheets. :-)
bottlepalm 3y ago
It seems like the weak point was the frontend process that was written in Go which was decompiler friendly, allowing the author to unravel a lot of details about the other software processes and communication protocols.
- marcus_holmes 3y ago
  I love me some Go, but yeah, it wouldn't be my first choice if one of the requirements was "make it hard to reverse engineer". Which would suggest that that wasn't one of the requirements?
  - rewsiffer 3y ago
    Doesn’t the go compiler support stripping symbols and debug info from the binary?
keyme 3y ago
Good work! There's an immediate application to this research, and that's answering the following question: How does the implementation of their geo-fencing enforcement actually work? As you may know, you can't use starlink in India (or Iran etc.), even with a roaming plan. Sure, it is possible that the satellites just "go off" whenever passing over these territories. However, from experience, there's a good chance that this isn't how it works. Perhaps there is some cooperation from the client side (at the software level). Perhaps the terminal being hard-to-root had made it "trusted enough" for this purpose in their security design. If anyone is up to answering that question, I'm sure they'll get a bunch of karma on their HN post.
- weregiraffe 3y ago
  Huh? Why would the satellites go off? The Starlink satellites know they own location, so they most likely have a list of cells they are allowed to serve. It's a lot harder to hack a satellite in orbit than a terminal you have physical access to.
  - appplication 3y ago
    Well… no actually. Many satellites are “bent pipes”, and do no signal authentication. They just transpond and send the data back down. If you can get the uplink to hear you, you can use it. The problem is uplink may not always be listening in your direction. It’s actually really easy to jam or pirate many satellites for this reason. I’m unsure if spacex has more auth than the industry standard. Source: I used to geolocate jammers and pirates.
    - xoa 3y ago
      Starlink is unique in being a LEO massive constellation using phased arrays and thus afaik cannot work like that. The terminal and satellites must work in conjunction to steer the beam electronically at a pretty fast rate, they're only ~550km away at a relative velocity of 7-someodd km/s. Cells are quite small, beam spots even smaller, and terminals must both track a given sat and jump between multiple ones. Yes, all indications are that SpaceX auth is also very modern and very good, but the very nature of the system means they have to have quite precise location information on both sides. The satellites will simply not transmit where it's not permitted by regulators, and can do that with high resolution because they simply physically cannot usefully see very big circles. That's exactly why thousands and thousands of satellites are needed. In another comment you mentioned "if there's any beam shaping" which seems to indicate you really haven't ever taken any real look at Starlink? It's nothing like an old HEO sat system.
xoa 3y ago
It's definitely worth reading some of those earlier studies as well as this one, like that link 2 "Dumping and extracting the SpaceX Starlink User Terminal firmware" [0] also got some good discussion and insights [1]. There were a few tidbits in that I don't see here, like how root-enabled development hardware also was geofenced both to obvious SpaceX locations but also a few pretty random seeming ones that presumably were used for quiet off site testing in more challenging environmental conditions. It's cool to read the build up of knowledge, although one take home that shouldn't be unusual yet is was that SpaceX really seems to have done a pretty careful job in terms of security from the get-go, learning the lessons of those who came before for once. ---- 0: https://www.esat.kuleuven.be/cosic/blog/dumping-and-extracting-the-spacex-starlink-user-terminal-firmware/ https://www.esat.kuleuven.be/cosic/blog/dumping-and-extracti... 1: https://news.ycombinator.com/item?id=27751759 https://news.ycombinator.com/item?id=27751759
kklisura 3y ago
How along until someone patches/builds a firmware and makes a radar out of the dish?
- mlindner 3y ago
  That'd be fun to see but the transmit power probably isn’t strong enough to see things at any kind of range. It already maps out all the obstructions the dish sees and produces a map of them in the app though.
tomcam 3y ago
> The first step was to dump the firmware of the device since it's not publicly available Gotta love this
hoseja 3y ago
>Most of the binaries have been implemented in C++ and some of them are also statically linked. Due to this, it was challenging to reverse-engineer these binaries and due to time constraints, we were unable to fully comprehend all of them. Some work was done to identify statically linked library functions, using the binary diffing technique. It is also probable that these programs were implemented using the State Machine Design Pattern, which makes heavy use of features of Object Oriented Programming such as multiple inheritance, virtual methods and generic types. This made the reverse-engineering process even more difficult due to the complex structures that are produced by the compiler when using these features. W for overcomplicated C++ OOP patterns enjoyers.

213 points by jandeboevrie 3y ago

analyzing network hardware for academic credit? nifty! How long has this been going on? Anybody done a comb over OpenWRT similarly? There's numerous slightly customized versions of that in all sorts of hardware.

timtom39 3y ago
Yea, favorite place I found OpenWRT was in DJI phantom 2 Wi-Fi Extender module. Managed to SSH into it. Hardware was not particularly interesting just cool to see OpenWRT in a widely purchased product.
- h2odragon 3y ago
  vacuum cleaners. I went "wait, what?" and then "well, that makes perfect sense actually"
mydriasis 3y ago
I was part of a project that did some analysis of OpenWRT firmware at scale. It was a lot of fun. The firmware is ( obviously ) publicly available. If you're interested in finding some cool results, you should try out FACT: https://github.com/fkie-cad/FACT_core https://github.com/fkie-cad/FACT_core It's a super neat tool that does lots of interesting things.
deleted 3y ago
[deleted]

toomuchtodo 3y ago

Related: https://hackaday.com/2022/11/28/a-modchip-to-root-starlink-user-terminal-through-voltage-glitching/ https://hackaday.com/2022/11/28/a-modchip-to-root-starlink-u... https://youtu.be/NXqLMmGwJm0 https://youtu.be/NXqLMmGwJm0

denysvitali 3y ago

> The first step was to dump the firmware of the device since it's not publicly available, and we did that thanks to a blog post by the COSIC research group at KU Leuven. And they contribute by not sharing the firmware :( I know it might have legal issues, but this is not helpful for other researchers if we keep things hidden

deleted 3y ago
[deleted]
nicolodev 3y ago
> Tim Ferrell, from SpaceX's security team, for sending us a testing dish with root access. They probably had a NDA or something that prohibits them to release the firmware publicy.
- denysvitali 3y ago
  It (sadly) makes sense :(

notfish 3y ago

Its wild to see some of our internal code getting reverse engineered like this. What an incredibly cool read, thanks a ton for sharing!

inemesitaffia 3y ago
What do you think of the DOD refusing to pay for starlink in Ukraine until the middle of this year?
pabs3 3y ago
Are the Starlink devices GPL compliant?
- jameshilliard 3y ago
  Nope, they do not comply with the GPL licenses for their User Terminal firmware. I've sent them GPL requests for the GPLv2 Buildroot based firmware build system they use but they have so far refused to provide the source code. They have posted some kernel/uboot sources. I am both a major Buildroot contributor and have Starlink internet service. Their router firmware is OpenWRT based and while they have posted some source code for that it is not the source code corresponding to the binary firmware builds they actually distribute. I have NAND dumps of both the User Terminal and router. Funny enough a few years back their internal firmware CI even accidentally sent me some emails about broken builds since they applied some of my buildroot patches from upstream.

TT-392 3y ago

[flagged]

sleepybrett 3y ago
I'm not sure why your petty personal problem, that is remedied very easily in every browser, requires a comment.
- eddieroger 3y ago
  Oh, /that's/ why it's called cascading style sheets. :-)

bottlepalm 3y ago

It seems like the weak point was the frontend process that was written in Go which was decompiler friendly, allowing the author to unravel a lot of details about the other software processes and communication protocols.

marcus_holmes 3y ago
I love me some Go, but yeah, it wouldn't be my first choice if one of the requirements was "make it hard to reverse engineer". Which would suggest that that wasn't one of the requirements?
- rewsiffer 3y ago
  Doesn’t the go compiler support stripping symbols and debug info from the binary?

keyme 3y ago

Good work! There's an immediate application to this research, and that's answering the following question: How does the implementation of their geo-fencing enforcement actually work? As you may know, you can't use starlink in India (or Iran etc.), even with a roaming plan. Sure, it is possible that the satellites just "go off" whenever passing over these territories. However, from experience, there's a good chance that this isn't how it works. Perhaps there is some cooperation from the client side (at the software level). Perhaps the terminal being hard-to-root had made it "trusted enough" for this purpose in their security design. If anyone is up to answering that question, I'm sure they'll get a bunch of karma on their HN post.

weregiraffe 3y ago
Huh? Why would the satellites go off? The Starlink satellites know they own location, so they most likely have a list of cells they are allowed to serve. It's a lot harder to hack a satellite in orbit than a terminal you have physical access to.
- appplication 3y ago
  Well… no actually. Many satellites are “bent pipes”, and do no signal authentication. They just transpond and send the data back down. If you can get the uplink to hear you, you can use it. The problem is uplink may not always be listening in your direction. It’s actually really easy to jam or pirate many satellites for this reason. I’m unsure if spacex has more auth than the industry standard. Source: I used to geolocate jammers and pirates.
  - xoa 3y ago
    Starlink is unique in being a LEO massive constellation using phased arrays and thus afaik cannot work like that. The terminal and satellites must work in conjunction to steer the beam electronically at a pretty fast rate, they're only ~550km away at a relative velocity of 7-someodd km/s. Cells are quite small, beam spots even smaller, and terminals must both track a given sat and jump between multiple ones. Yes, all indications are that SpaceX auth is also very modern and very good, but the very nature of the system means they have to have quite precise location information on both sides. The satellites will simply not transmit where it's not permitted by regulators, and can do that with high resolution because they simply physically cannot usefully see very big circles. That's exactly why thousands and thousands of satellites are needed. In another comment you mentioned "if there's any beam shaping" which seems to indicate you really haven't ever taken any real look at Starlink? It's nothing like an old HEO sat system.

xoa 3y ago

It's definitely worth reading some of those earlier studies as well as this one, like that link 2 "Dumping and extracting the SpaceX Starlink User Terminal firmware" [0] also got some good discussion and insights [1]. There were a few tidbits in that I don't see here, like how root-enabled development hardware also was geofenced both to obvious SpaceX locations but also a few pretty random seeming ones that presumably were used for quiet off site testing in more challenging environmental conditions. It's cool to read the build up of knowledge, although one take home that shouldn't be unusual yet is was that SpaceX really seems to have done a pretty careful job in terms of security from the get-go, learning the lessons of those who came before for once. ---- 0: https://www.esat.kuleuven.be/cosic/blog/dumping-and-extracting-the-spacex-starlink-user-terminal-firmware/ https://www.esat.kuleuven.be/cosic/blog/dumping-and-extracti... 1: https://news.ycombinator.com/item?id=27751759 https://news.ycombinator.com/item?id=27751759

kklisura 3y ago

How along until someone patches/builds a firmware and makes a radar out of the dish?

mlindner 3y ago
That'd be fun to see but the transmit power probably isn’t strong enough to see things at any kind of range. It already maps out all the obstructions the dish sees and produces a map of them in the app though.

tomcam 3y ago

> The first step was to dump the firmware of the device since it's not publicly available Gotta love this

hoseja 3y ago

>Most of the binaries have been implemented in C++ and some of them are also statically linked. Due to this, it was challenging to reverse-engineer these binaries and due to time constraints, we were unable to fully comprehend all of them. Some work was done to identify statically linked library functions, using the binary diffing technique. It is also probable that these programs were implemented using the State Machine Design Pattern, which makes heavy use of features of Object Oriented Programming such as multiple inheritance, virtual methods and generic types. This made the reverse-engineering process even more difficult due to the complex structures that are produced by the compiler when using these features. W for overcomplicated C++ OOP patterns enjoyers.