Black Hat 2015
Recently, there have been several highly publicized talks about satellite hacking. However, most only touch on the theoretical rather than demonstrate actual vulnerabilities and real world attack scenarios. This talk will demystify some of the technologies behind satellite communications and do what no one has done before - take the audience step-by-step from reverse engineering to exploitation of the GlobalStar simplex satcom protocol and demonstrate a full blown signals intelligence collection and spoofing capability. I will also demonstrate how an attacker might simulate critical conditions in satellite connected SCADA systems.
In recent years, Globalstar has gained popularity with the introduction of its consumer focused SPOT asset-tracking solutions. During the session, I'll deconstruct the transmitters used in these (and commercial) solutions and reveal design and implementation flaws that result in the ability to intercept, spoof, falsify, and intelligently jam communications. Due to design tradeoffs these vulnerabilities are realistically unpatchable and put millions of devices, critical infrastructure, emergency services, and high value assets at risk.
5. MOTIVATION
• Try something new
• Satellite hacking often too
theoretical
• Unexplored frontier
• Systems are hopelessly
broken
• Inspire and collaborate
6. WHAT ARE WE GOINGTO
LEARN?
• RF signals and modulation
• What is spread spectrum?
• Selecting a target and
reverse engineering
• Exploiting the target
7. PREREQUISITES
• High school mathematical
knowledge
• Lets keep things relatively
“understandable”
• Will provide resources
(see github)
10. • SPOT - Consumer grade satellite tracking
• Aging satellite network: voice, data, messaging
• But wait… this tech is used everywhere. Jackpot.
11. WHERE IS IT USED?
Military / Classified
Trailers / Containers
Air Quality Monitoring
PersonnelTracking
Fire Detection and Prevention
Water Quality Monitoring
Tank Level Gauging
Perimeter / Border monitoring
Asset / Vehicle Tracking
Remote Meters
Buoys
Ship Movement
Fishing vessel monitoring
Power line monitoring
Dispersed sensors
and many more…
12. SIMPLEX DATA NETWORK
“Simplex works where infrequent, small packets of data are to be collected”
GPS Satellite
Asset
Globalstar Satellite
Globalstar Ground StationThe Internet
Globalstar Infrastructure
User Infrastructure
13. BENT PIPE
“A bent pipe satellite does not demodulate or decode
the signal.A gateway station on the ground is
necessary to control the satellite and route traffic to
and from the satellite and to the internet.”
14. REDUNDANCY
• Yes, the network only talks in one direction (simplex)
• How is this reliable?
18. “Error 100: Database query failed - retrieving
login information You have an error in your
SQL Syntax;…”
NOT SO MUCH…
19. –Globalstar
“The received data is then forwarded to a user defined
network interface that may be in the form of an FTP
host or HTTP host where the user will interpret the data
for further processing.”
33. PHASE SHIFT KEYING (PSK)
Modulated Signal
Modulating Signal (Data)
0 0 1 1 0 1 1 1
0˚ 180˚ 0˚ 180˚
BPSK - Two phases (0 and 180 degrees) are used to represent 1 and 0
35. SPREAD SPECTRUM
MODULATION
• Why is Spread Spectrum special?
• WiFi, Bluetooth, GPS, and basically all modern RF
communications
• Processing Gain
• Jam Resistant
• CDMA
37. DIRECT SEQUENCE SPREAD
SPECTRUM (DSSS)
• Mixes a slow signal with fast pseudo-random signal
• Signal still contains original information but occupies much
more bandwidth.
BPSK Signal
Occupies ~100Hz
Spread BPSK Signal
Occupies ~1.25Mhz
38. DSSS CONTD.
Data Signal
Pseudo Random
Result
000000000000 111111111111
110001111001 010000101000
110001000110 010000010111
⊕
⊕
39. DSSS CONTD.
Data Signal
Pseudo Random
Result
000000000000 111111111111
110001111001 010000101000
110001000110 010000010111
⊕
⊕
40. M-SEQUENCES AS PN CODES
• Periodic binary codes that have strong
autocorrelation properties
• Commonly generated with LFSRs
42. DECODINGTHEORY
• Simple in practice. More difficult in theory
• Mix incoming signal with PN sequence and the original
BPSK signal will emerge.
• Compensate for frequency differential between local and
remote oscillators
• Signal needs to be phase aligned with PN code
47. SAMPLING
Nyquist: Sample at least
twice as fast as the signal’s
fastest frequency.
The human ear can’t hear frequencies higher than 20Khz.
CD audio is sampled at 44.1Khz (twice the human range).
48. IQ MODULATION
• Makes generation of signals easy in software!
https://www.youtube.com/watch?v=h_7d-m1ehoY
Basics of IQ Signals and IQ modulation & demodulation - A tutorial
50. WHATTO EXPECT
• Pseudo random sequence
(1s and 0s)
• Repeating
• 255 bits long
• 1.25 million “chips” per
second
Much like Bart in detention, the PN will
repeat over and over and over…
51. PN RECOVERY
• In order to decode the signal, we need to know the PN sequence
• DSSS BPSK == BPSK
BPSK DSSS
BPSK
LowFrequencyHighFrequency
52. SAMPLING REQUIREMENTS
32 Mhz
———— = 4 Mhz (> 1.25 x 2)
8 Mhz > 2x faster than 1.25 Mhz (Nyquist)
Even multiple of 32 Mhz (USRP)
4 Mhz 3.2 samples
—————— = —————— (not even)
1.25 Mcps 1 symbol
4 Mhz 5 4 samples
—————— x —— = —————
1.25 Mcps 4 symbol
Even samples / symbol
(Implementation Specific)
*We can resample the
signal from 4 to 5 Mhz.
*
53. PN RECOVERY
• PN Sequence is much shorter than bit length
• PN repeats 49 times for each bit
• PN ⊕ Data == PN (within a bit boundary)
1,250,000 chips 1 second 1 PN seq. 49 PN seq.
———————— x —————— x ————— = —————
1 second 100.04 bits 255 chips 1 bit
57. WHATTO EXPECT
• Mix original signal with PN
• Narrow band signal will
emerge
• Shown as sharp spike on
FFT
58. REALTIME IS HARD
• Unfortunately doing this is very computational intensive
• Lots of room for optimizations
• Record now, process later
sh-‐3.2#
time
python
sync.py
real
0m58.326s
user
0m48.754s
sys
0m0.909s
1.4 second capture (one packet)
4M samp/sec * 2 floats/samp * 4 bytes/float = 30.5 MB/sec
60. CODETRACKING
Time (samples)
Correlation
Correlation Peak
If we don’t compensate for misalignment, we will drift and lose
correlation over time.
Search for
peaks, and track
themStrong Correlation (PN aligned)
No Correlation (PN unaligned)
Early
Late
Aligned
66. LOCATION DECODING
Latitude: bits 8:32
Longitude: bits 32:56 + -
Latitude
Northern
Hemisphere
Southern
Hemisphere
Longitude
Eastern
Hemisphere
Western
Hemisphere
Convert to decimal
(signed int MSB to LSB)
Multiply by degrees per
count
1.
2.
3.
67. CHECKSUM
Packet (without preamble and CRC)
110 bits
CRC
(Code Provided)
Compare
If we known how to reproduce the checksum, we can create our own
packets… no signing, no encryption, lets spoof!
000000101100101001101100011110100000010100000000010011110000000100000010000010000000000000000100000000000000000000000000000011001000001010010011
24 bits
68. INTERCEPTING ON
DOWNLINK
• Bigger antennas and better equipment
• RF downconversion
• Doppler Shift
• Multipath
Worst Case Doppler Shift
70. DISCLAIMER
Transmitting on Globalstar’s frequencies may be illegal where you live and could
interfere with critical communications.
Donotdothis!
Seriously,don’t.
No one likes late night visits from the FCC.
71. TRANSMITTING
MGA-2000 0.5W RF Amplifier
$190.00
But if you like late night visits from the FCC…
• This is actually the easy part.
• ~.2 Watts power
• Simply mix data, PN, and carrier and correct rates
72. BUT WAIT… ITS EASIER
Spot Device Updater SPOT3FirmwareTool.jar
Currently $49.99
84. "Like all companies and industries in the 21st century, including those that Wired
reported on this week to expose hacking vulnerabilities like Chrysler, GM, Brinks
and others, Globalstar monitors the technical landscape and its systems to protect
our customers. Our engineers would know quickly if any person or entity was
hacking our system in a material way, and this type of situation has never been an
issue to date.We are in the business of saving lives daily and will continue to
optimize our offerings for security concerns and immediately address any illegal
actions taken against our Company."
DISCLOSURE & RESPONSE
• ~180 days ago
• Friendly and concerned for user privacy, but no further
communication