Hacker News Reader

From personal experience (I guess now that the statue of limitations has passed..) I was part of a large community of people in the not so distant past hacking into cable ISPs. Small ones were easy to bypass security mechanisms and spoof other customers devices or simply trick their servers into issuing valid configs, but obviously there was the one big one that I’m sure everyone has heard of. Anyway, before the community was shut down, in the quest to defeat the more stringent security mechanisms, a few folks figured out how to jump from modems to an internal VLAN, got access to privileged SNMP communities and eventually owned the entire network starting at the head ends and eventually made their way to the core routers (Of course, the provider used the same credentials for everything, in an industry that to this day doesn’t use 2FA). Eventually the community was shut down. However, said ISP never acknowledged the breach. If some hobbyists could figure it out, I guarantee that nation-states can do it.

rip www.sbhacker.net

Well yeah, kids on IRC (or xbox live) have been hacking big ISPs like comcast and verizon to dox each other since forever.

> (and the impossibility to obtain said equipment for the average Joe).

when I worked on similar problems some years ago, we found out that certain radios were used across sectors with basically the same ucLinux kernels and toolchains, bootloaders, and SoCs. I agree with the "internal VLAN" assessment to a point, as these networks tend to backhaul their admin channel / control plane messaging back to their vendor.

The hardcoded credentials issue was the easiest win, where the firmware signing was actually not bad, but injecting packets over the point to point radio connections depended on whether both encryption was enabled, and some primitives implementation issues that I have no doubt any serious cyber operations group would have also found.

With this (speculative) radio packet of death, you could fly a spyplane over the region at super sonic speeds and cause the terminals to go dark - which would explain the relatively simultaneous / sequential failures and the physical path of the outages, which would be detectable in the monitoring data.

Strategically, it's the perfect signal and warning to any country looking to interfere, and it doesn't cost very much. Maybe it's nothing, but with Russia it's never nothing.

> With this (speculative) radio packet of death, you could fly a spyplane over the region at super sonic speeds

That could work in Ukraine, but a spy plane above Germany would have made national news.

Fair assessment. I assumed spyplane because it also affected Italy and Greece, so there was a long arc of a flight path. It's possible it could have been the orbit of a russian electronic warfare satellite as well, as if you have a transmitter on it, encoding radio packets of death against poorly maintained linux kernel forks (hugely assuming that's what the terminals ran) is as trivial as loading a metasploit payload. I'm well into speculative fiction, but casting magic spells that stop machinery en masse isn't magic at all - and well within the capabilities of armchair admirals of electronic warfare who read and post on HN.

It would be interesting to see if there was any timestamp data about the order in which the terminals failed, as that would yield the flight path evidence, or indicate the presence of local transmitters in those regions, or if it were async, an internet based attack.

Reality is, the gear that runs critical infrastructure is still a joke, and I've said before that western exposure to cyber vulnerability will cause the US/NATO to hesitate in responding to Russian and Chinese aggression because they have to take on that domestic political risk of infrastructure failure, and in conflict, often hesitation is sufficient. Weakness invites predators, and here we are.

> "Cyberattack on satellite network" sounds so serious

yes agree -- third hand witness to actual ground station management of Small SATs here.. even internal engineers are locked out; multiple keys required to perform actions; closely monitored change-of-behavior networks, etc etc

beware of REALLY LARGE CLAIMS at this time -- peace out

A satellite data system used by the Ukrainian military was knocked out at the same time as the invasion, the outage started in Ukraine before spreading outward, and the damage is permanent - which would not happen in a botched firmware upgrade, where units would load a backup firmware image or get an image OTA, or be fixable via site visit.

Not exactly a 'really large claim' that this was an attack.

I think GP is saying that an attack that impacted the satellites flying around in space is a large claim, on account of their systems have better security. I imagine the idea of a many millions of $ satellite burning up because someone left a telnet server open is enough to make executives take sat security a little more seriously than say terminal security.

Don’t think anyone is really refuting the idea that satellite terminals being remotely bricked en-mass, just as two countries nearby go to war, is an attack.

My argument in my original post was that the fact that this is a satellite network is likely to be completely irrelevant to the actual attack and that the parts that were compromised exist just as well in a terrestrial-based network. However, "satellite network suffers cyber-attack" is a better headline than "local ISP was stupid and got their management network pwned" - the former implies extra complexity which works well for ass-covering and swaying public opinion, something they very much need if it turns out the vulnerability was very stupid & mundane.

I'm very skeptical of the "damage is permanent" claim. I wouldn't be surprised if it's used to hype up the event even more just like the hype around the fact that this is satellite terminals being hacked even though I believe the attack is very boring and would equally apply to any terrestrial-based ISP whose management network is compromised.

I would bet good money that what they claim "permanent damage" is just misconfiguration that prevents the terminal from connecting to the network but can be recovered via an on-site visit, and hyping up the entire event also works in the company's favour as an ass-covering technique as I suspect the actual vulnerability is very simple & boring (which would be very bad if it were go to public that they have such bad security).

> What I think happened is that they breached the control infrastructure which gives them access to an "internal" VLAN that the satellite terminals use to communicate with the mothership for ...

> ... whatever is the TR-069 equivalent for BGAN terminals ...

These VSAT terminals support TR-069 [0] and my first thought when I heard about this was a compromised ACS. It wouldn't be the first time.

---

[0]: https://en.m.wikipedia.org/wiki/TR-069

This sort of what virtual networking devices are trying to solve, no?

Going to a full on box also increases your attack surface by adding a lot of unnecessary stuff.

Plus even with something completely in software you still need the physical hardware in there at some point - and those individual pieces will be running their own firmware and microcontroller software.

> why waste that access on breaking everything in a highly-visible way when you're better off silently sitting there and using the access to eavesdrop on everything

The subtle approach takes more time.

Take the PoV of the hypothetical Russian decision maker.. you can either take all them down now with something quick & dirty while the tanks are rolling, or inject a stealthy targeted piece of malware you haven't finished yet next week after Kiev is already in the hands of a puppet government....

Yes, this was my point. I don’t believe they’ve attacked anything satellite-specific and instead just pushed an intentionally-bad configuration or firmware update to terminals in the field.