SATCOM terminals below attack in Europe: a plausible diagnosis.
February 24th: at the same time Russia initiated a beefy-scale attack on Ukraine, tens of thousands of KA-SAT SATCOM terminals all today stopped working in quite loads of european nations: Germany, Ukraine, Greece, Hungary, Poland…Germany’s Enercon moved forward and acknowledged that approximately 5800 of its wind generators, presumably those remotely operated by project of a SATCOM link in central Europe, had lost contact with their SCADA server. Within the affected nations, a fundamental allotment of the prospects of Eutelsat’s domestic broadband carrier were additionally unable to access Web.
From the very foundation Eutelsat and its guardian firm Viasat, talked about that the topic became once being investigated as a cyberattack. Since then, well-known capabilities were scarcely supplied however few days previously I stumbled on a terribly intriguing video in the following tweet.
Featured Content Ads
add advertising hereWithin the video, the Commander Total Michel Friedling confirms that the incident became once originated by a cyberattack. Nonetheless, he additionally offers a key facet that has the functionality to flip a lunge of the mill DDoS scenario, as some in the muse identified, into one thing far more intriguing: “the terminals were damaged, made inoperable and with out doubt can no longer be repaired”
In step with the information publicly on hand and my experience researching into SATCOM terminals I will try and gift a plausible reason of this kind of damaging attack.
Introduction
Please demonstrate that right here’s merely a speculative exercise, even though backed by a sensible technical reasoning…anyway per chance I’m utterly infamous.
Featured Content Ads
add advertising hereRelieve in 2014 and then in 2018 I offered at BlackHat USA two varied papers mainly centered on evaluating the safety posture of more than one SATCOM terminals, by uncovering a plethora of vulnerabilities and accurate-world scenarios all over varied sectors. Within these papers the reader can obtain an introduction to the SATCOM architecture, threat scenarios and a few technical phrases that will be extinct throughout this blog put up.
2014 – A Wake-Up demand SATCOM Security
2018 – Final Demand SATCOM Security
Featured Content Ads
add advertising here
Within the ground section of the KA-SAT infrastructure we obtain 10 gateways disbursed all over Europe. Please demonstrate that the Berlin Gateway is the closest one to Ukraine. Coincidentally, Germany seems to be to beget suffered one the worst system of the attack.
These Gateway Earth Stations are interconnected utilizing a redundant fiber ring. This spine additionally maintains the connectivity with as much as 6 telco Positive aspects of Presence (POP).
The satellite protection is divided into the 82 do beams, every of them is approximately 300km of diameter. Because it could even be considered in the following describe, there are four kinds of do beams which allow approximately 240 MHz in both instructions (independently for the Forward and Return channels), thus allowing to re-exercise the slots of on hand frequencies (1.95 GHz in total, ~((240Mhz*2)*4)) below varied polarizations. This throughput requires utilizing more than one Gateway Earth Stations, geographically separated, for successfully providing the carrier.
A truly well-known facet is that the mappings between the do beams and the gateways are fixed: every gateway handles a job of 10 varied beams.
The user terminals are made from:
1.- The ODU (Outside Unit)
The transmit-earn assembly (TRIA).
2.- The IDU (Indoor Unit)
What is going to we no doubt know in regards to the attack?
From the information publicly on hand there are 5 facts that must force this diagnosis:
1.- It seems to be the attackers in the muse centered Eutelsat’s KA-SAT SATCOM terminals located in Ukraine however the attack propagated to varied nations much like Greece, Germany, Poland, Italy or Hungary.
2.- It seems to be, tens of thousands of terminals were completely damaged, rendering them inoperable.
3.- It came about at the same time the russian forces initiated the invasion of Ukraine.
4.- It centered the fixed broadband prospects of a civil satellite network, neither maritime nor aviation sectors were affected.
5.- In step with the video of the Commander Total Michel Friedling, it didn’t impact the home section.
Scenarios
We can in the muse assess the following scenarios:
1. DDoS
A centered DDoS attack can beget in the muse explained the non eternal disruption of the carrier, thus complying with the total previous facts. Nonetheless, it does no longer provide any reason of the eternal anguish (truth number 2)
2. RF/EM pulse
An attack requiring enough vitality to deep-fry tens of thousands of terminals at the same time, which might per chance per chance per chance perchance very smartly be located all over more than one nations conserving an heaps of home in the swear of thousands of Kms, is rarely any longer feasible. Moreover, it could beget impacted varied devices, additionally today triggering heaps of defense power alarms.
3. 0day in SATCOM terminals publicly exposed.
A remotely exploitable vulnerability in a SATCOM terminal, moreover to an corrupt network configuration of the satellite supplier, is a utterly feasible scenario that can even be exploited at a generous scale. In 2018 I documented how dozens of business airplane were publicly exposed to the come by through a vulnerable SATCOM infrastructure (glimpse ‘Final Call For SATCOM security’ – Aviation, Pages 3-19 ).
Please additionally demonstrate that Web is rarely any longer the favorable attack vector that can even be extinct, a malicious terminal linked to a explicit SATCOM network could also merely additionally leverage corrupt network configurations to attack varied terminals. Clearly, this scenario extremely is determined by the satellite carrier and operators.
It’s intriguing that after 4 years, a month previously the NSA launched an advisory “Conserving VSAT Communications” which specifically referenced my 2018 analysis.
A eternal anguish is additionally technically doubtless. In 2014, throughout the ‘Wake Up demand SATCOM security‘ analysis I reverse engineered a proprietary protocol (Zing) implemented in effective Inmarsat BGAN terminals from Hughes, which allowed more than one privileged operations over the network, including the flexibility to change the describe of the FPGA controlling the antenna pointing. A a success exploitation rendered the terminal inoperable, quite principal the same scenario we’re discussing. In actual fact, at that time, I efficiently tested this damaging attack against the Hughes 9201 terminal I sold for that analysis.
Despite all of those indications, I come by no longer concentrate on this scenario utterly represents what came about in Ukraine and the remainder of the affected nations. Absolutely, there might per chance be an opportunity that an undocumented feature/0day became once exploited however there are varied capabilities in the attack that carry out no longer match: the size of the attack, the roughly affected programs and its geographical space.
4. A compromised Gateway Earth Location / Community Operations Center.
Within the ‘Final Call For SATCOM Security’ analysis (Pages 20-44) I elaborated a put up-exploitation scenario for an airborne SATCOM terminal, intended to flip it into an intentional radiator.
This attack required modifying the firmware to omit effective explicit messages coming from the NOC.
For that analysis, I reverse engineered Hughes’ proprietary ICAP protocol, extinct to remotely serve an eye fixed on the SATCOM terminal from the NOC. The image below exhibits one of the fundamental most implemented messages, which might per chance per chance per chance perchance very smartly be self-explanatory in effective circumstances (i.e ‘Enable/Disable transmit’)
I became once controlling the SATCOM terminal, so my attain became once to forestall the NOC from forcing the compromised SATCOM terminal to ‘behave’ successfully (in the context of an intentional radiator payload, terminals are designed in such one design that if you happen to are no longer locked to the satellite, it’s good to no longer be transmitting). Nonetheless, if you happen to could also merely beget gotten purchased the NOC below your serve an eye fixed on, you are going to be in a local to attain the replacement scenario, thus today attacking the SATCOM terminals within your protection.
I concentrate on that, perchance, what came about in Ukraine is an identical to this scenario.
Conclusion
My theory is that attackers by some potential managed to compromise/spoof the ground dwelling/NOC accountable for those do beams conserving, no lower than, Ukraine. At a generous time they abused a marvelous serve an eye fixed on protocol to enviornment explicit commands to the centered SATCOM terminals, ensuing in the claimed eternal anguish. That question could also merely involve disabling the transmitter, corrupting the antenna pointing logic, demod, vitality params…
I come by no longer beget access to a Surfbeam2 modem, however I stumbled on a writeup of a researcher who dumped its firmware. After studying some of its contents, I’m now even more elated that there are more than one ways to completely anguish a KA-SAT SATCOM terminal…
At final, we must endure in tips that, because it has been explained, the KA-SAT infrastructure entails more than one interconnected gateways Earth Stations and a explicit number of mappings between beams and gateways. As a consequence, I’d swear that per chance the Enercon incident, and the disruption that occured in varied european nations, were generous a ‘collateral anguish’ derived from attacking the point of curiosity: Ukraine.