9 ms·
Don’t Look Up: Sensitive internal links in the clear on GEO satellites [pdf]
- fennec-posix 1y agoSection 6.3.2 is an eye-opener... good lord... Gets even worse at 6.4.2-3
- lambdaone 1y agoIt's absolutely jaw-dropping. Either no-one at these companies was capable of understanding the problem, or no-one cared enough to do something about it.
- throwing_away 1y agoLikely both.
- yujzgzc 1y agoFrom my time in similar companies, some people understand, and might care, but aren't empowered to do anything about it. They've got a job to do, and creatively auditing network security isn't it. Finding this kind of issue on the company clock won't get them promoted, on the contrary they'll look like they're slowing the team down with vulnerabilities to fix when they've got stuff to build and sell. Very poor security culture.
- Arrath 1y agoAm I offtrack in wondering if by reverse engineering the mentioned in-the-clear ATM communications you could (in theory) inject some malicious packets and in effect just dispense cash to yourself with a laptop and a dish? How very cyberpunk.
- dweekly 1y agoWebsite: https://satcom.sysnet.ucsd.edu/ https://satcom.sysnet.ucsd.edu/ Wired: https://www.wired.com/story/satellites-are-leaking-the-worlds-secrets-calls-texts-military-and-corporate-data/ https://www.wired.com/story/satellites-are-leaking-the-world...
- ROBLOX_MOMENTS 1y agoIs it correct to Assuming the amount of Mexican companies in this paper is because of their receiver being in the major city southwestmost corner of the country ?
- jf 1y agoThat’s my interpretation
- fennec-posix 1y agoYeah that's correct. The study was conducted in San Diego which falls under the satellite beam footprint required for services in Mexico. If you were in say, Alice Springs in Australia (wink wink) for example, you'd be able to see traffic for Indonesia, Philippines, most of South East Asia, and perhaps parts of China, South Korea and Japan if the beams are right.
- dylan604 1y ago> wink wink location location location is an apt phrase for more than just real estate
- bediger4000 1y agoI'm not so good at hints. Are you gesturing at the NSA facility at Pine Gap?
- mike_d 1y agoYes they are trying to be cheeky, but missing the mark. Pine Gap is a large facility for collecting data coming down from our own satellites. Foreign satellite collection in Australia happens at two other facilities: https://en.wikipedia.org/wiki/Shoal_Bay_Receiving_Station https://en.wikipedia.org/wiki/Shoal_Bay_Receiving_Station https://en.wikipedia.org/wiki/Australian_Defence_Satellite_Communications_Station https://en.wikipedia.org/wiki/Australian_Defence_Satellite_C...
- N19PEDL2 1y agoAnd if you were in Harrogate, UK (more winks), you’d be in the footprint of satellites servicing Europe.
- modeless 1y ago> remarkably, nearly all the end-user consumer Internet browsing and app traffic we observed used TLS or QUIC There was a surprising amount of resistance to the push to enable TLS everywhere on the public Internet. I'm glad it was ultimately successful.
- vasco 1y agoIt was only successful because Google said you'd rank higher if you did it.
- yujzgzc 1y agoIt was only successful because of Let's Encrypt removing any excuse for not having HTTPS on your website, HSTS becoming a thing, and Chrome moving from gentle inducements (that cute green padlock) to nasty looking warnings if you didn't use encryption.
- vasco 1y agoNo, that was after, and it made it easy, but before google many people said there was no point "because their site wasnt sensitive". Those people didn't care about let's encrypt or how easy it was, they just didn't find a reason to do it. Google gave them a monetary reason to do it.
- stephen_g 1y agoWhich in-turn was driven by the Snowden revelations of what the NSA was doing in terms of mass surveillance.
- GuB-42 1y agoI have a more cynical view of the reason. It is to protect commercial interests, I don't think that Google cares about the NSA looking at your personal data. Google cares a lot about protecting the personal data they get from you, so that they and no one else can get it, at least not for free. Because let's get real, 99% of the time, why do you need encryption? The reason is commercial activity. It is really important to protect your credit card number, otherwise no one would trust e-commerce. For paid service to work, you need to authenticate, and it means encryption, no paywall means no authentication and much less need for encryption. And even with "free" services, you need encryption to protect the account that shouldn't even be required in the first place. As for general communication, my guess is that hackers and governments alike are more interested in financial data than in casual conversation. So by pushing TLS everywhere, Google is actually pushing for a more commercial, less open web. That it helps with general privacy (except against Google itself) is just a happy accident.
- lambdaone 1y agoAbsolutely mind-boggling that this is a thing; not just that satellite links aren't per-user link-encrypted, but also that people are still using unencrypted protocols to exchange sensitive information on the public internet in 2025.
- protocolture 1y agoHad a vendor offer a customer of mine a huge discount if they purchased radios without the encryption license in the year of our lord 2024. Not even WPA or WEP. Just clear across the sky. And this is terrestrial. My bet is that in space there would be a noticable increase in heat/energy if they did encryption by default. But its still incredible to see them pretend like space is impossible to get to, ultimate obscurity.
- ryandrake 1y agoLikely no consequences to the decision-makers for data exfiltration or other shenanigans happening, so there's nothing motivating a behavior change. The reason security is so bad everywhere is that nobody gets fired when there's a breach. It's just blamed on the hackers and everyone just goes on with life singing "We take security very seriously--this happened because of someone else!"
- chii 1y ago> nobody gets fired when there's a breach this must mean the consequences of such a breach has either not produced any visible damage, or the entity being damaged is uncaring (or have no power to care).
- ryandrake 1y agoOr, the entity being damaged is not the decision maker and has no power to hold the decision maker responsible.
- josephg 1y agoEnd user license agreements are a huge part of the problem. Ideally users could sue if our data is leaked - and the threat of being sued would put pressure on companies to take security more seriously. Ie, it would become a business concern. Instead we're constantly asked to sign one-sided contracts ("EULAs") which forbid us from suing. If a company's incompetence results in my data being leaked on the internet, there's no consequences. And not a thing any of us can do about it.
- dylan604 1y agoAs with anything in life, when it's what you know and do on the regular, that simple thing can look like magic to others. I met an old timer in the satellite business that came out to help install our receiver for a new TV channel the company I was at was getting off the ground. He found out what bird we were using and what its slot was. Based on that, he knew how many satellites over from the satellite he knew and used as his base. It was a long time running TV channel that he could find very quickly. Once that bird was located, he just manually (literally pushed the dish with his hand) counting the number of satellites that came in/out of view until he landed on "our" bird. Once there, connected our receiver and baddaboom baddabing, there it was. Once the satellite was pointed at the proper angle to the south, it took less than five minutes from him connecting his receiver to verify his base signal to packing up and heading off the roof. His base satellite signal was unencrypted and a main reason he used it for this purpose. Our channel was scrambled, and only verifiable after our receiver with the decoder was connected. It was impressive seeing someone that good at their job make it look so easy, but after he explained the layman's version of orbital slots it became less magical. This is why magicians are meant to not tell you how the trick is done.
- stavros 1y agoEh I kind of feel like you can't say that. If something is magical before you learn how it's done, it should be magical after. The magical part isn't "it's actually impossible", but "it's so far from what I could come up on my own", which still holds after you know the secret.
- lxgr 1y agoYes, some excellent magic tricks work even better when you know how they work, especially if they’re the kind that’s based on putting in ridiculous amounts of work or skill/practice. Penn and Teller play a lot with that idea, for example.
- padjo 1y agoYou should hide the secret if it’s ugly, but you can expose if it’s beautiful (and it’s your trick!)
- wyager 1y agoI see no issue with the satellite backhaul itself being unencrypted; anyone using the satellite provider should assume they're hostile and encrypt+authenticate everything they send anyway. I don't trust my ISP's fiber to be snoop-resistant just because they nominally have some shitty ONT encryption. Obviously the specific examples of end-users failing to encrypt are bad, but that's not really a problem with the satellites.
- varenc 1y agoIf someone is browsing the internet on in-flight wifi, and their DNS requests get leaked this way, I don't really think its the casual airline user's fault for not encrypting their DNS traffic. Modern cell phone data traffic (4G/5G) is all encrypted, so the same unencrypted DNS requests can't just be passively sniffed. Something similar should happen here. I'd blame the airline or their ISP provider for sending unencrypted traffic through the air like this. Not the satellite, but its top level customer. There's a big difference, IMHO, between your ISP being able to sniff your fiber traffic, and your traffic being observable from ~30% of the globe.
- jeffrallen 1y agoIt is the fault of the end user software not protecting them. This is why we have encrypted SNI (promoted by Cloidflare, for example).
- mike_d 1y agoI don't know if you've ever tried to actually use in flight wifi, but any traffic not subject to inspection is heavily throttled to the point of being unusable. ESNI is also a technology in search of a problem. It does not provide any meaningful security benefits.
- jeffrallen 1y agoThis. Bytes on every medium can be snooped. Internetworking means that your bytes go on mediums you don't know about and don't control. There's no such thing as a link where encryption is not needed, except localhost.
- dsab 1y agoI was working in space industry and ECSS security guidelines are missleading grant seeking startups to try to reinvent TLS on orbit. There are to mamy bureaucracy. ECSS guidelines for software teams were created by people who never written a Hello World in their life, just look at specs of ECSS Packet Utilisation Service, it's a joke, that's why I prefer to work for VC funded companies than grant funded.
- deleted 1y ago[deleted]
- vayup 1y agoSome of the stuff that was extracted from the unencrypted traffic in the link: - T-Mobile backhaul: Users' SMS, voice call contents and internet traffic content in plain text. - AT&T Mexico cellular backhaul: Raw user internet traffic - TelMex VOIP on satellite backhaul: Plaintext voice calls - U.S. military: SIP traffic exposing ship names - Mexico government and military: Unencrypted intra-government traffic - Walmart Mexico: Unencrypted corporate emails, plaintext credentials to inventory management systems, inventory records transferred and updated using FTP This is insane! While it is important to work on futuristic threats such as Quantum cryptanalysis, backdoors in standardized cryptographic protocols, etc. - the unfortunate reality is that the vast majority of real-world attacks happen because basic protection is not enabled. Good reminder not take our eyes off the basics.
- CGMthrowaway 1y agoIs there a git repo that lets one read this stuff in real time yet?
- zelos 1y ago> Real-time military object telemetry with precise geolocation, identifiers, and live telemetry Oops
- NoiseBert69 1y agoPulls out the bamboo whip Another round of OpSec training
- atarvaneitor 1y agoDoes anyone remember the days when you pointed a 60cm antenna at the Hispasat 30W and connected your DVB-S2 tuner in Windows, Using Crazycat's BDADataEx, you tuned an IP data transponder. Using a technique called Satfish (with a software I don't remember), some files were reconstructed, usually vsat data from oil platforms... and porn. I'm going to dust off the TBS DVB-S2X card and try to find a data transponder to test the DontLookup app. https://github.com/ucsdsysnet/dontlookup https://github.com/ucsdsysnet/dontlookup Where I live, it's almost impossible to find any interest in FTA or pirated SAT TV. att: ham radio operator interested in satellite radio :D
- deleted 1y ago[deleted]
- myself248 1y agoMy understanding has been that the majority of FTA TV in the western hemisphere is religious in nature, and that's simply not a tempting onboarding bait for a lot of people to buy the gear and start exploring. The vast majority of satellite TV receivers in the US are propretary VSAT services, not equipped for exploring wild feeds and things. My understanding is that elsewhere, there's a lot more interesting stuff FTA so a lot more people have the hardware, and the hardware itself is more generic. So there's just more opportunity for someone to get bored and discover a new hobby a few degrees to the side of their usual watering hole.
- drsopp 1y agoI wonder why the DOI link on the bottom left of the first page does not work: https://doi.org/10.1145/3719027.3765198 https://doi.org/10.1145/3719027.3765198
- xucheng 1y agoIt’s quite common for a DOI to be assigned to a paper after it’s accepted during camera ready. However, the DOI won’t work until the conference or journal version is published on the official website (ACM in this case). The version you’re viewing now is simply a preprint directly from the authors.
- feraloink 1y agoExactly! It says this as one of the 3 reasons for DOIs not found on the error page: >The DOI has not been activated yet.
- jeff_lee 1y agoWho needs hackers when companies broadcast their secrets to half the planet?
- immibis 1y agoIntercepting non-obvious (in the sense that you can't just, like, open your wifi menu and see them) broadcasts is still hacking. Heck, even intercepting obvious (in the sense that it says "your data is not secure" on the screen of the people communicating) broadcasts is still hacking. Doing what Firesheep does, before Firesheep, was hacking. And then someone made Firesheep and it was still hacking, but now anyone could do it by clicking a few buttons, without any hacking skill whatsoever, not even using a command line, so it was finally patched.
- metalman 1y agoI think that the risk of anybody achiving a malicious outcome by accessingn these data streams is as spectacularly low as the effort required to get the signal and then figure out some context to the randomised transmissions and then weaponise that is high, very high. Presumably it is GB/sec by however many channels, 99% of it will dry your eyeballs out and quickly render even the most determined spook a quaking quivering mess huddled in the corner of an office screaming " make it stop" the researchers behind this are just showing off, but I will bet any money, nothing but nothing could keep them there going through the worlds slop, which a smart, counter spook would insure was a regular and tantilising portion of the signal to begin with. the issue is that these sattelites are just repeaters, and there is little ryme or reason to the content, and personel good enough to work it, can find much much more profitable things to do.
- BertoldVdb 1y agoA lot of low population density cellular backhaul runs over satellite. Two factor SMS or voice can be directly intercepted, assuming encryption is not used.
- OnACoffeeBreak 1y agoFrom the Introduction: "Each satellite may carry traffic for dozens of independent networks through an array of on-board transponders, each covering a diameter of thousands of kilometers (at most a third of Earth’s surface)". Can someone help me understand the use of "diameter" in this sentence. I am guessing it refers to the satellite's signal coverage of the Earth's surface. If that's the case, wouldn't something like arc degrees be a better measure? I just can't figure out how "diameter" can be used to describe a coverage arc or area.
- jnovacho 1y agoThey mean the intersection between the cone produced by the satellite and "illuminated" surface. If the antenna beam is normal to the sphere, it will produce a disk which has an diameter.
- slow_typist 1y agoThis, and 1/3 of earth’s surface is the maximum you can see from geostationary orbit.
- alterom 1y agoYeah, diameter is ambiguous (is it the diameter of the disk in space, or in the geometry/topology of the Earth's surface?). Either way, they point is, it's a lot of coverage.
- melvinchus 1y ago[dead]
- deleted 1y ago[deleted]
- BonusPlay 1y agoIf you're interested in the topic there's great YouTube channel that demonstrates such attacks IRL together with full tutorials. Below are 2 satellite related videos: 1) https://www.youtube.com/watch?v=2-mPaUwtqnE https://www.youtube.com/watch?v=2-mPaUwtqnE 2) https://www.youtube.com/watch?v=ka-smSSuLjY https://www.youtube.com/watch?v=ka-smSSuLjY
- bschne 1y agoTangential, but I was very surprised to learn recently that my country still has a more or less nationwide POCSAG pager network where only some users encrypt their traffic
- elevation 1y agoAs an aside, the PDF metadata says it's generated from LaTeX, but the layout and typesetting looks better than the LaTeX output I'm familiar with. Nicely done.
- bobbylarrybobby 1y agoThe body font appears to be Libertinus Serif (and I assume Libertinus Sans is the seldom-used sans font), which I agree look much nicer than the default Computer Modern
- vzaliva 1y agoIn view of this disclosure I am even more dissapointet T-mobile satellite service (via starlink) does not support Signal messenger.
- klaff 1y agoAh, this brings back memories of listening to long-distance phone calls using a C-band dish and a general coverage (aka shortwave) receiver. Voice channels were placed on single-sideband channels between roughly DC and 6 MHz, and that whole set of signals was transmitted to the particular satellite transponder just like a video signal would be. The dish receiver couldn't decode that but it had a subcarrier output intended for accessories (stereo decoders maybe?). By plumbing the subcarrier output to the antenna input of the shortwave radio you could dial around to individual voice channels. I could only hear one side of the calls, but it was still very enlightening. I heard a number of mundane conversations, one drug deal, and a woman cursing in ways I'd never heard before. This was pre-internet and I was an impressionable kid - maybe 13 or so. Fun times.