Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation •...

21
Spread Spectrum Satcom Hacking Attacking the Globalstar Simplex Data Service Colby Moore @colbymoore - [email protected]

Transcript of Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation •...

Page 1: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Spread Spectrum Satcom Hacking

Attacking the Globalstar Simplex Data Service

Colby Moore @colbymoore - [email protected]

mailto:[email protected]
Page 2: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Motivation

• Satellite hacking talks never deliver

• RF world largely neglected by hacker community

• So much legacy tech in critical systems

• Spark interest in satellite security research

Page 3: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

What are we going to learn?• Overview of basic RF signals and modulation

• What is spread spectrum - how does it work and how do we work with it

• Picking a target and reverse engineering it

• Exploiting that target

• Next steps

Page 4: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Analog RF Modulation

• Amplitude Modulation (AM)

• Frequency Modulation (FM)

Page 5: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Digital RF Modulation

• Amplitude Shift Keying (ASK / OOK)

• Frequency Shift Keying (FSK)

• Phase Shift Keying (PSK)

Page 6: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Spread Spectrum Modulation

• What is Spread Spectrum Special? WiFi, Bluetooth, Most modern RF Communication

Page 7: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Spread Spectrum Modulation

• Frequency Hopping Spread Spectrum (FHSS)

• Direct Sequence Spread Spectrum (DSSS)

Page 8: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Selecting a Target

• Consumer Accessible

• Cheap

• Popular

• High Impact

Page 9: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Introducing SPOT

• SPOT

• But wait… this tech is used… everywhere. Goldmine.

Page 10: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Who uses it?

• Flight Planning Services

• Consumers

• SCADA

• Big Gas and Oil

Page 11: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

How does it work?

• LEO non-geosynchronous Bend Pipe Architecture

Page 12: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Intel Gathering

• Google

• FCC Database

• Academic Papers

• Integrator Spec Sheets

Page 13: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Intel Gathering Continued

• What we know:

• PN = 255 Chip M-Sequence

• 1.6xx ghz

• 144 bit message

Page 14: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Hardware and Validation

• USRP B200

• GQRX

• GNURADIO

Page 15: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Decoding Theory

• Mix signal with PN sequence and the BPSK signal will drop out

Page 16: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Packet Format Contd.

• Wait a second… There is no signing… No encryption.

• We can create packets if we known how to reproduce the checksum.

• Reverse engineering the checksum

Page 17: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Transmitting

• Strictly Theoretical - Do not attempt

• This is the easy part

Page 18: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Impact of Transmission

• Spoof communications

• Disrupt critical services

Page 19: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Signal Interception Demo

• DEMO

Page 20: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Future Research

• Code optimization

• Custom hardware

• Widespread reception

Page 21: Spread Spectrum Satcom Hacking - DEF CON CON 23/DEF CON 23 presentations/DEFCON...Motivation • Satellite hacking talks never deliver • RF world largely neglected by hacker community

Slides and Code

• Updated slides, resources, and code to be posted online after the presentation.


DEF CON 23 Presentation CON 23/DEF CON 23... · DEF CON 23 Presentation Keywords: DEF CON Conference, DEF CON, DEFCON, Speeches, Hacking, Hackers, Hacker Conference, Computer Security,

DEF CON 23 Presentation CON 23/DEF CON 23... · DEF CON 23 Presentation Keywords: DEF CON Conference, DEF CON, DEFCON, Speeches, Hacking, Hackers, Hacker Conference, Computer Security,

Hacking Google AdWords - DEF CON® Hacking … · Hacking Google AdWords ... • Use general Google hacking techniques • Bust anyone who is “Google hacking”! Other Interesting

Hacking Google AdWords - DEF CON® Hacking … · Hacking Google AdWords ... • Use general Google hacking techniques • Bust anyone who is “Google hacking”! Other Interesting

Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Advanced Format String Attacks - DEF CON® Hacking Conference

Advanced Format String Attacks - DEF CON® Hacking Conference

Hacking Google AdWords - DEF CON CON 13/DEF CON 13... · – No Hacking or Cracking • They do not differentiate between H/C • Hypocrisy – Hacking is invalid yet “Define:Hacker”

Hacking Google AdWords - DEF CON CON 13/DEF CON 13... · – No Hacking or Cracking • They do not differentiate between H/C • Hypocrisy – Hacking is invalid yet “Define:Hacker”

Hacking the Cloud - DEF CON CON 25/DEF CON 25... · SalesForce (salesforce.com, pardot.com, & exacttarget.com) MailChimp (mcsv.net) Mandrill (MailChimp paid app) Q4Press (document

Hacking the Cloud - DEF CON CON 25/DEF CON 25... · SalesForce (salesforce.com, pardot.com, & exacttarget.com) MailChimp (mcsv.net) Mandrill (MailChimp paid app) Q4Press (document

Stealing Identity Management Systems - DEF CON® Hacking

Stealing Identity Management Systems - DEF CON® Hacking

DEF CON 26 Hacking Conference CON 26/DEF CON 26 presentations/DEF… · Summary Device external storage is a public area which can be observed/modified by a third-party application

DEF CON 26 Hacking Conference CON 26/DEF CON 26 presentations/DEF… · Summary Device external storage is a public area which can be observed/modified by a third-party application

DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27 presentations/DEF… · BPF • tcpdump -i any -n 'tcp[tcpflags] & (tcp-syn|tcp-ack) != 0' (000) ldh [14] (001) jeq #0x800

DEF CON 27 Hacking Conference Presentation CON 27/DEF CON 27 presentations/DEF… · BPF • tcpdump -i any -n 'tcp[tcpflags] & (tcp-syn|tcp-ack) != 0' (000) ldh [14] (001) jeq #0x800

DEF CON 21 - Hacking Driverless Vehicles

DEF CON 21 - Hacking Driverless Vehicles

DEF CON 26 Hacking Conference CON 26/DEF CON 26 workshops/DEF C… · Bryce Kunz - Stage 2 Security, Red Teaming & Splunk Security Services. CNO.io Kevin Lustic & Bryce Kunz (@TweekFawkes)

DEF CON 26 Hacking Conference CON 26/DEF CON 26 workshops/DEF C… · Bryce Kunz - Stage 2 Security, Red Teaming & Splunk Security Services. CNO.io Kevin Lustic & Bryce Kunz (@TweekFawkes)

Hacking travel routers like it’s 1999 - DEF CON Media Server CON 25/DEF CON 25 presentations/DEF… · Hacking travel routers like it’s 1999 Mikhail Sosonkin. Mikhail Sosonkin

Hacking travel routers like it’s 1999 - DEF CON Media Server CON 25/DEF CON 25 presentations/DEF… · Hacking travel routers like it’s 1999 Mikhail Sosonkin. Mikhail Sosonkin

DEF CON 24 Hacking Conference CON 24/DEF CON 24 presentations/DEF CON 24...RDS-1 or "Stalin's Jet Engine" Inside knowledge of the Manhattan Project combined with looting Germany's

DEF CON 24 Hacking Conference CON 24/DEF CON 24 presentations/DEF CON 24...RDS-1 or "Stalin's Jet Engine" Inside knowledge of the Manhattan Project combined with looting Germany's

Hacking and Securing DB2 LUW Databases - Def Con

Hacking and Securing DB2 LUW Databases - Def Con

Hacking With Monads - DEF CON CON 27/DEF CON 27... · • Deal with ideas and possibilities ... • Clojure From The Mathematics Tribe: Languages from the Mathematics tribe will let

Hacking With Monads - DEF CON CON 27/DEF CON 27... · • Deal with ideas and possibilities ... • Clojure From The Mathematics Tribe: Languages from the Mathematics tribe will let

DEF CON 24 Hacking Conference CON 24/DEF CON 24 presentations/DEF… · •Dummy frame injection •Delaying acknowledgments ECU CAN High CAN Low ... #wireshark -X lua_script:ethcan.lua

DEF CON 24 Hacking Conference CON 24/DEF CON 24 presentations/DEF… · •Dummy frame injection •Delaying acknowledgments ECU CAN High CAN Low ... #wireshark -X lua_script:ethcan.lua

Hardware Hacking for Software Geeks - DEF CON

Hardware Hacking for Software Geeks - DEF CON

HACKING HOTEL KEYS - DEF CON CON 24/DEF CON 24 presentations/DEF… · HACKING HOTEL KEYS Security Consultant ... Researcher. 9About 11 years pen-testing, Security Research, ... 912

HACKING HOTEL KEYS - DEF CON CON 24/DEF CON 24 presentations/DEF… · HACKING HOTEL KEYS Security Consultant ... Researcher. 9About 11 years pen-testing, Security Research, ... 912

Breaking Wind: Adventures in Hacking Wind Farm Control Networks - DEF CON Media Server CON 25/DEF CON 25... ·  · 2018-02-10Breaking Wind: Adventures in Hacking Wind Farm Control

Breaking Wind: Adventures in Hacking Wind Farm Control Networks - DEF CON Media Server CON 25/DEF CON 25... ·  · 2018-02-10Breaking Wind: Adventures in Hacking Wind Farm Control

From ROOT to SPECIAL - DEF CON CON 22/DEF CON 22 presentations... · – Python/JCL/FTP ... From root to SPECIAL - Hacking IBM ... Technology, Phreaking, Lockpicking, Hackers, Infosec,

From ROOT to SPECIAL - DEF CON CON 22/DEF CON 22 presentations... · – Python/JCL/FTP ... From root to SPECIAL - Hacking IBM ... Technology, Phreaking, Lockpicking, Hackers, Infosec,