The Great Brazilian Sat-Hack Crackdown (2009) | Hacker News Reader

The Great Brazilian Sat-Hack Crackdown (2009)

wired.com

104 pointswglb32 comments

So these satellites are no more complex than the amateur radio birds which function as simple FM repeaters?! Typically they'll have an uplink in the 2m band, and maybe a downlink in 70cm band, or the other way around. How can a military satellite be so casual in it's decision to relay audio? You'd think some authentication method would have been built in. I guess not?

Maybe the military prefers the simple over the complex. It's a lot simpler to change authentication methods in ground equipment than in orbital equipment.

Almost all comm sats are just bent pipes. Collisions are avoided via planning but that's just a gentleman's agreement at the end of the day. If you're watching with a spectrum analyzer and a decent dish it's pretty easy to see which transponders are currently idle.

The downside of course is that once you start hitting a satellite with a signal they know exactly where you are and the operators will call the cops on you. Your signal is not only potentially interfering with someone who paid for the transponder, but it also impacts their energy budget.

I've been told that if you rent a transponder it's important to put a signal up on it pretty quickly, otherwise pirates will attempt to "borrow" it from you, and they can be hard to evict.

How do I get more info on this? This sounds like a fantastic subject to learn about.

Seconded. The article and these comments leave me wanting more!

What I know about this comes from some training I took for my job. The training came from the equipment vendor, but the instructor was also an operator so he knew the ins and outs of the system.

There is a lot to cover, from calculating link budgets, scramble codes (related to anti-jam), waveforms, pointing a dish, calculating frequencies, reading channel allocation docs, tradeoffs of different frequency bands, etc... However, the basics are pretty basic. You modulate a series of bits onto a carrier at a specific frequency and radiate it at a specific point in the sky. The transponder on the satellite amplifies the signal, shifts it a fixed number of Mhz, and retransmits it back towards the Earth.

There are some satellites that act like flying routers and actually decode the packet back into bits before re-encoding it for transport, but generally the added complexity has made this approach unpopular. One constellation that does this is Iridium, because it then forwards packets between satellites until it can be downlinked to the ground.

Routing satellite to satellite sounds like a complex routing problem, no? Or are such routes computed before signal goes up?

Not particularly. They're all in fixed known orbits so each satellite would know at any given time where all the other satellites in it's constellation will be so it can know what satellites will have the best signal between it and the downlink. With that all you really need is for the phones to ping the satellites every couple minutes while on to update the what satellites are over head of phone X. (You could even be clever and cheat a little by figuring out the rough coordinates of each handset and then figure out roughly what satellites would be near overhead too since handsets generally don't move very quickly.)

Lyngsat has a comprehensive list of satellites and transponders etc

https://www.lyngsat.com/america.html

Newer ones have authentication right?

You could have a DSP kind of repeater where the satellite receives a signal, unencrypts it, reads the information inside the packet, encrypts it, and the routes it accordingly (maybe to a different antenna or to the avionics computer inside). The old designs were basically just two antennas with an amplifier in between them. If you wanted encryption, that was between you and the recipient. The satellite was pretty much agnostic to what was going through it. The benefit of even the simplest digital repeater is that your signal only has to be good enough for a one way trip. You can do higher data rates because you only need to worry about the space to ground link (ground to space usually isn't a problem since power is more available).

Think back to the state of the art in the 70s when these were thought up. You can cite SIGSALY[1] but it took a really long time for these concepts to be flyable. AT&T was doing digital telephony terrestrially in the 60s [2] but radio links make this more difficult. Of course things are different today.

[1] https://en.wikipedia.org/wiki/SIGSALY [2] https://en.wikipedia.org/wiki/T-carrier

The design life of the system was five years, according to https://space.skyrocket.de/doc_sdat/fltsatcom-2.htm

I'm sure the military has better ways to communicate these days. Perhaps the access should be allowed?

Why give up access bandwidth on a satellite meant for last resort kinds of communications? The satellite isn't self sufficient so someone in the military has to adjust it in space. There might be older pieces of equipment out there still using the satellite so having a bunch of random people taking up bandwidth and not following the channel allocation. It's better to just enforce the rules that already exist to make sure that the resources are always available.

This was 10 years ago. I hope that USMs are using better tools by now..

Probably not. Security is full of the "We're Compliant" types (don't we have insurance for that?) and very few real technologists who know how to hack/break/abuse systems. Target was PCI compliant when their CC data was breached and exposed. There are many more examples of this. Check the box, get owned and no really cares. That needs to change.

Those birds are probably still in the air. Few comm satellites are full processing anyway so there is no mechanism to enforce it up in the sky. Normal enforcement is via having the cops show up at your door and ask why you are stealing the US Government's power and interfering with military operations.

Like using open source software and not doing basic things like changing default passwords? https://www.wired.com/story/us-weapons-systems-easy-cyberatt...

> When the user's location is stable, the signal can be triangulated. That's how the Defense Department got the coordinates to feed Brazilian authorities in March's raids.

Of course. But specifically how? With satellites in space? Or antennas on ground? If on ground, where? And if on ground, for triangulating these specific people or for other purposes as well? And if sattelites space, the same sattelites that are relaying the signals, or separate sattelites?

The exact same way as mentioned in the next paragraph:

  "In February of last year, FCC investigators used a mobile direction-finding vehicle to trace rogue transmissions to a Brazilian immigrant in New Jersey."

The ground transmission antenna is sending a high gain signal towards the satellite. But that doesn't mean that all of the energy is directed there. Some gets scattered isotropically and a signal detection plane could triangulate off that.

this thread is amusing. so many people on HN should go get their amateur radio licenses and stop comparing a layer 1 radio connection to their layer 7+ they use in the browser.

I do indeed have my license. Only a Tech but even that level gets you access to the VHF/UHF birds.

Are you saying we shouldn't expect a military satellite to have some semblance of simple authentication?

It sounds like what they built was literally a simple repeater. If that's the case, they shouldn't have a problem with this "unauthorized use," because by design, there is no such thing.

(The preceding assumes the pirate is licensed to transmit in the 1.25m band that the article noted as the uplink.)

You got it. When these birds were thought up, that was state of the art. Two years ago a dude I'm elmering told me he heard brazilians when he was tuning around with his sdr toy, so maybe they are still doing it today.

The uplink freqs are not any that are licensed for any amateur use, these flights are operating between 250-350 MHz.

Edit: look what I found http://mt-milcom.blogspot.com/p/alphabravocharlie-frequency-...

Ahhh very interesting! It's so funny to think I could hit military comms just by tuning up a bit on my modded rig... Not that I will, because that's dumb. Makes sense given the age of the stuff!

Look, they're bent pipes because it's faster, cheaper and more scalable. If you do authentication, you need the satellite to process and validate each packet before repeating it. That means that suddenly you need a processor - a beefy one, to handle so many signals at once and understand the modulation, and you have a delay between receiving and sending. You also have new failure modes to worry about, new components that can fail, protocol lock-in, maintenance, etc.

Bent pipes are perfect. Not everything needs to be overengineered to hell. A handful of pirates aren't a big enough deal to boil the ocean with a DSP. And assuming that the signal is Manchester-coded, you can defeat the pirates in future models with a simple analog filter to remove their noise.

I now see what you're saying. I guess it's just funny that I could defeat military comms by simply leaving my mic open and bumping the dial to the right frequency...

It sounds like back in the day what I described above wasn't an issue.

Idk how the military ever expected to be able to use these satellites in wartime. First thing enemy will do is saturate them with fake signals from small and cheap battery-powered transmitters just left alone in random places (so targeting them with anti-radiation missiles would make little sense). Sounds like someone has been unbelievably dumb.

Anti-jamming is a thing. As you note jamming satellite comms is certainly possible, but it paints a great big target on your back. And the US military has no problem using a million dollar missile to blow up a $500 jammer.

I've been toying with the idea of getting into ham radio type stuff, so it's always been interesting to me.

After working with the local detectives / police, it isn't "very" difficult to find where a jammer is. /I never got the chance to work directly with them on that issue though, but they said it's happened once before.

Anyway, it took them one call to Verizon and less than a day later they found who was jamming one area. Did the police thing, and no more jamming. They had the pull because no one could call 911 with a cell phone in that area, and when the squads were out, they'd lose reception around that area too. Both big no nos if you want to stay hidden.

I can imagine if it's a country with adequate resources, it would not be much of an issue.

And if you think you're clever by using a jammer while mobile, you're in for some financial pain on top of any legal issues you create for yourself.

https://www.fcc.gov/document/fcc-fines-florida-driver-48k-ja...

Still, building some kind of authentication into a system would make a lot of sense IMO.

Reply on news.ycombinator.com