SlideShare a Scribd company logo
1 of 89
SPREAD SPECTRUM SATCOM
HACKING
ATTACKINGTHE GLOBALSTAR SIMPLEX DATA SERVICE
Colby Moore
@colbymoore - colby@synack.com
WHO AM I?
Colby Moore
Synack R&D
KD7SCT
DEF CON 23: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex Data Service
INTRODUCTION
MOTIVATION
• Try something new
• Satellite hacking often too
theoretical
• Unexplored frontier
• Systems are hopelessly
broken
• Inspire and collaborate
WHAT ARE WE GOINGTO
LEARN?
• RF signals and modulation
• What is spread spectrum?
• Selecting a target and
reverse engineering
• Exploiting the target
PREREQUISITES
• High school mathematical
knowledge
• Lets keep things relatively
“understandable”
• Will provide resources
(see github)
TARGETING
SELECTING ATARGET
GovernmentCommercial
• SPOT - Consumer grade satellite tracking
• Aging satellite network: voice, data, messaging
• But wait… this tech is used everywhere. Jackpot.
WHERE IS IT USED?
Military / Classified
Trailers / Containers
Air Quality Monitoring
PersonnelTracking
Fire Detection and Prevention
Water Quality Monitoring
Tank Level Gauging
Perimeter / Border monitoring
Asset / Vehicle Tracking
Remote Meters
Buoys
Ship Movement
Fishing vessel monitoring
Power line monitoring
Dispersed sensors
and many more…
SIMPLEX DATA NETWORK
“Simplex works where infrequent, small packets of data are to be collected”
GPS Satellite
Asset
Globalstar Satellite
Globalstar Ground StationThe Internet
Globalstar Infrastructure
User Infrastructure
BENT PIPE
“A bent pipe satellite does not demodulate or decode
the signal.A gateway station on the ground is
necessary to control the satellite and route traffic to
and from the satellite and to the internet.”
REDUNDANCY
• Yes, the network only talks in one direction (simplex)
• How is this reliable?
GROUND STATIONS AND
COMMAND CENTERS
Hundreds of ground stations Two Operations Centers
COVERAGE
48 satellites - 5850 km diameter footprint - 1410 km orbit - In service since 2000
SECURITY POSTURE
“Error 100: Database query failed - retrieving
login information You have an error in your
SQL Syntax;…”
NOT SO MUCH…
–Globalstar
“The received data is then forwarded to a user defined
network interface that may be in the form of an FTP
host or HTTP host where the user will interpret the data
for further processing.”
INTELLIGENCE GATHERING
WHERETO LOOK
PRIOR RESEARCH
Travis Goodspeed
https://github.com/travisgoodspeed/pyspot
Natrium42
https://web.archive.org/web/20120202211125/
http://natrium42.com/projects/spot/
STX-3
“Worlds’ smallest and lowest power consuming industrial-
use satellite transmitter”
DSSS? BPSK? What the &^#% is that?…
FREQUENCIES
Globalstar L-Band Frequencies
Globalstar Simplex Data Frequencies
THE BREAKTHROUGH
Clues!
REVIEW OF WAVES AND
MODULATION
WAVES
Amplitude - A
Phase - φ (radians)
Time (t)
Wavelength
TIME DOMAINVS.
FREQUENCY DOMAIN
Frequency DomainTime Domain
Amplitude
Time
Frequency
ANALOG MODULATION
• Amplitude Modulation (AM)
• Frequency Modulation (FM)
AMPLITUDE MODULATION
Carrier
Modulating Signal (Data)
Modulated Signal
FREQUENCY MODULATION
Carrier
Modulating Signal (Data)
Modulated Signal
DIGITAL MODULATION
• Amplitude Shift Keying (ASK / OOK)
• Frequency Shift Keying (FSK)
• Phase Shift Keying (PSK)
PHASE SHIFT KEYING (PSK)
Modulated Signal
Modulating Signal (Data)
0 0 1 1 0 1 1 1
0˚ 180˚ 0˚ 180˚
BPSK - Two phases (0 and 180 degrees) are used to represent 1 and 0
SPREAD SPECTRUM
SPREAD SPECTRUM
MODULATION
• Why is Spread Spectrum special?
• WiFi, Bluetooth, GPS, and basically all modern RF
communications
• Processing Gain
• Jam Resistant
• CDMA
SPREAD SPECTRUM
MODULATION
• Frequency Hopping Spread Spectrum (FHSS)
• Direct Sequence Spread Spectrum (DSSS)
DIRECT SEQUENCE SPREAD
SPECTRUM (DSSS)
• Mixes a slow signal with fast pseudo-random signal
• Signal still contains original information but occupies much
more bandwidth.
BPSK Signal
Occupies ~100Hz
Spread BPSK Signal
Occupies ~1.25Mhz
DSSS CONTD.
Data Signal
Pseudo Random
Result
000000000000 111111111111
110001111001 010000101000
110001000110 010000010111
⊕
⊕
DSSS CONTD.
Data Signal
Pseudo Random
Result
000000000000 111111111111
110001111001 010000101000
110001000110 010000010111
⊕
⊕
M-SEQUENCES AS PN CODES
• Periodic binary codes that have strong
autocorrelation properties
• Commonly generated with LFSRs
M-SEQUENCES AND
CORRELATION
0001
0001
0001
0010
0001
0100
0001
1000
4 0 0 0
M-Sequence:
Shifted:
Correlation:
This makes looking for the m-sequence in a signal easy!
DECODINGTHEORY
• Simple in practice. More difficult in theory
• Mix incoming signal with PN sequence and the original
BPSK signal will emerge.
• Compensate for frequency differential between local and
remote oscillators
• Signal needs to be phase aligned with PN code
HARDWARE
TOOLS AND HARDWARE
USRP B200
$675
GSP-1620 LHCP Antenna
$65
MORE HARDWARE
Dimension Engineering AnyVolt 3
$55
12v AC/DC Adapter
$5SMA Cables
$20
MiniCircuits ZX60-1614LN-S
Low Noise Amplifier
$150
ASSEMBLED CAPABILITY
SAMPLING
Nyquist: Sample at least
twice as fast as the signal’s
fastest frequency.
The human ear can’t hear frequencies higher than 20Khz.
CD audio is sampled at 44.1Khz (twice the human range).
IQ MODULATION
• Makes generation of signals easy in software!
https://www.youtube.com/watch?v=h_7d-m1ehoY
Basics of IQ Signals and IQ modulation & demodulation - A tutorial
PN RECOVERY
WHATTO EXPECT
• Pseudo random sequence
(1s and 0s)
• Repeating
• 255 bits long
• 1.25 million “chips” per
second
Much like Bart in detention, the PN will
repeat over and over and over…
PN RECOVERY
• In order to decode the signal, we need to know the PN sequence
• DSSS BPSK == BPSK
BPSK DSSS
BPSK
LowFrequencyHighFrequency
SAMPLING REQUIREMENTS
32 Mhz
———— = 4 Mhz (> 1.25 x 2)
8 Mhz > 2x faster than 1.25 Mhz (Nyquist)
Even multiple of 32 Mhz (USRP)
4 Mhz 3.2 samples
—————— = —————— (not even)
1.25 Mcps 1 symbol
4 Mhz 5 4 samples
—————— x —— = —————
1.25 Mcps 4 symbol
Even samples / symbol
(Implementation Specific)
*We can resample the
signal from 4 to 5 Mhz.
*
PN RECOVERY
• PN Sequence is much shorter than bit length
• PN repeats 49 times for each bit
• PN ⊕ Data == PN (within a bit boundary)
1,250,000 chips 1 second 1 PN seq. 49 PN seq.
———————— x —————— x ————— = —————
1 second 100.04 bits 255 chips 1 bit
PN RECOVERY
PN RECOVERY
11111111001011010110111010101011
10010011011010011001101000111011
01100010001001111010010010000111
10001010011100011111010111100111
01000010101100101000101100000110
01000110000110111111011100001000
00100101010010111110000001110011
0001101010000000101110111101100
DESPREADING
WHATTO EXPECT
• Mix original signal with PN
• Narrow band signal will
emerge
• Shown as sharp spike on
FFT
REALTIME IS HARD
• Unfortunately doing this is very computational intensive
• Lots of room for optimizations
• Record now, process later
sh-­‐3.2#	
  time	
  python	
  sync.py	
  
real	
   0m58.326s	
  
user	
   0m48.754s	
  
sys	
  	
  	
  	
  0m0.909s
1.4 second capture (one packet)
4M samp/sec * 2 floats/samp * 4 bytes/float = 30.5 MB/sec
CORRELATION
Correlation
Time
Slide PN against data and correlate at each step.
CODETRACKING
Time (samples)
Correlation
Correlation Peak
If we don’t compensate for misalignment, we will drift and lose
correlation over time.
Search for
peaks, and track
themStrong Correlation (PN aligned)
No Correlation (PN unaligned)
Early
Late
Aligned
CODETRACKING
Time (samples)
Correlation
Early or late detection lets us keep track.
Positive and negative correlations
indicate bits!
Consistent Correlation (PN aligned)
DESPREAD SIGNAL
It works!
Mix the PN against the signal. Original signal appears.
DECODING
EXTRACTING DATA
Low Pass Filter
Rational Resampler
PSK Demodulator
Decoder
Signal
Time Domain
Frequency Domain
10100 0 0111 ……
PACKET FORMAT
000000101100101001101100011110100000010100000000010011110000000100000010000010000000000000000100000000000000000000000000000011001000001010010011
001 01001101100011110100000Manufacturer ID Unit ID
LOCATION DECODING
Latitude: bits 8:32
Longitude: bits 32:56 + -
Latitude
Northern
Hemisphere
Southern
Hemisphere
Longitude
Eastern
Hemisphere
Western
Hemisphere
Convert to decimal
(signed int MSB to LSB)
Multiply by degrees per
count
1.
2.
3.
CHECKSUM
Packet (without preamble and CRC)
110 bits
CRC
(Code Provided)
Compare
If we known how to reproduce the checksum, we can create our own
packets… no signing, no encryption, lets spoof!
000000101100101001101100011110100000010100000000010011110000000100000010000010000000000000000100000000000000000000000000000011001000001010010011
24 bits
INTERCEPTING ON
DOWNLINK
• Bigger antennas and better equipment
• RF downconversion
• Doppler Shift
• Multipath
Worst Case Doppler Shift
TRANSMITTING
DISCLAIMER
Transmitting on Globalstar’s frequencies may be illegal where you live and could
interfere with critical communications.
Donotdothis!
Seriously,don’t.
No one likes late night visits from the FCC.
TRANSMITTING
MGA-2000 0.5W RF Amplifier
$190.00
But if you like late night visits from the FCC…
• This is actually the easy part.
• ~.2 Watts power
• Simply mix data, PN, and carrier and correct rates
BUT WAIT… ITS EASIER
Spot Device Updater SPOT3FirmwareTool.jar
Currently $49.99
DOES IT WORK?
SpotTrace1 SpotTrace 2
Clone
IMPACT
EMERGENCY RESPONSE
Real Emergency
Fake Emergency
Overwhelm emergency
response center
anonymously?
WHERE ELSE?
BUT WAIT,THERE’S MORE
Lockheed Martin Flight Service (LMFS) Integration
CAPABILITY
Uplink Interception
RF Beam
Globalstar
Attacker
Attacker intercepts and
plots pattern of life
SPOOFING LOCATION
Planned Route
Hijack Route
Attacker hijacks truck, disables tracker,
transmits location as if delivery is on
track.
FalseLocationData
TESTINGTHE CAPABILITY
Reception
Window
DEMO
Video demo time. It’s better to not tempt the demo gods. ;)
CONCLUSIONS
"Like all companies and industries in the 21st century, including those that Wired
reported on this week to expose hacking vulnerabilities like Chrysler, GM, Brinks
and others, Globalstar monitors the technical landscape and its systems to protect
our customers. Our engineers would know quickly if any person or entity was
hacking our system in a material way, and this type of situation has never been an
issue to date.We are in the business of saving lives daily and will continue to
optimize our offerings for security concerns and immediately address any illegal
actions taken against our Company."
DISCLOSURE & RESPONSE
• ~180 days ago
• Friendly and concerned for user privacy, but no further
communication
NEXT STEPS
• Collaboration
• Code optimization - realtime
• Downlink interception
• Data aggregation
CONCLUSIONS
• Long lifecycle
• Unpatchable
• Security going forward
• DSSS != security
• Assume Insecure
• Act accordingly
• Higher standards
SPECIALTHANKS
Alex K., Chris W., Cyberspectrum Meetup, David C., Michael Ossmann,
Mom and Dad, Paul David,Tom Rondeau
The Interns
and
QUESTIONS / COMMENTS?
https://github.com/synack/globalstar
https://syn.ac/dc15satcom
@colbymoore
colby@synack.com
code
slides
twitter
email
IMAGE CREDITS
• http://images.google.com

More Related Content

What's hot

LTE KPI and PI Formula_NOKIA.pdf
LTE KPI and PI Formula_NOKIA.pdfLTE KPI and PI Formula_NOKIA.pdf
LTE KPI and PI Formula_NOKIA.pdfVahidZibakalam3
 
Nokia kpi and_core_optimization
Nokia kpi and_core_optimizationNokia kpi and_core_optimization
Nokia kpi and_core_optimizationdebasish goswami
 
UVM: Basic Sequences
UVM: Basic SequencesUVM: Basic Sequences
UVM: Basic SequencesArrow Devices
 
Ericsson documents.mx ericsson-field-guide-for-utran
Ericsson documents.mx ericsson-field-guide-for-utranEricsson documents.mx ericsson-field-guide-for-utran
Ericsson documents.mx ericsson-field-guide-for-utranThananan numatti
 
WCDMA Air Interface
WCDMA Air InterfaceWCDMA Air Interface
WCDMA Air InterfaceSujeet Kumar
 
Nokia gsm-kpi-analysis-based-on-daily-monitoring-basis-presentation
Nokia gsm-kpi-analysis-based-on-daily-monitoring-basis-presentationNokia gsm-kpi-analysis-based-on-daily-monitoring-basis-presentation
Nokia gsm-kpi-analysis-based-on-daily-monitoring-basis-presentationmohammed khairy
 
5G NR parameters
5G NR parameters5G NR parameters
5G NR parametersSasi Reddy
 
04 gsm bss network kpi (tch call drop rate) optimization manual
04 gsm bss network kpi (tch call drop rate) optimization manual04 gsm bss network kpi (tch call drop rate) optimization manual
04 gsm bss network kpi (tch call drop rate) optimization manualtharinduwije
 
Chap 4. call processing and handover.eng
Chap 4. call processing and handover.engChap 4. call processing and handover.eng
Chap 4. call processing and handover.engsivakumar D
 
VoLTE Flows and CS network
VoLTE Flows and CS networkVoLTE Flows and CS network
VoLTE Flows and CS networkKarel Berkovec
 
SRVCC (Single Radio Voice Call Continuity) in VoLTE & Comparison with CSFB
SRVCC (Single Radio Voice Call Continuity) in VoLTE & Comparison with CSFBSRVCC (Single Radio Voice Call Continuity) in VoLTE & Comparison with CSFB
SRVCC (Single Radio Voice Call Continuity) in VoLTE & Comparison with CSFBVikas Shokeen
 
Digital modulation techniques...
Digital modulation techniques...Digital modulation techniques...
Digital modulation techniques...Nidhi Baranwal
 
Basic dt gsm ok
Basic dt gsm okBasic dt gsm ok
Basic dt gsm okbonaruce
 

What's hot (20)

SSV Tool
SSV ToolSSV Tool
SSV Tool
 
LTE KPI and PI Formula_NOKIA.pdf
LTE KPI and PI Formula_NOKIA.pdfLTE KPI and PI Formula_NOKIA.pdf
LTE KPI and PI Formula_NOKIA.pdf
 
Nokia kpi and_core_optimization
Nokia kpi and_core_optimizationNokia kpi and_core_optimization
Nokia kpi and_core_optimization
 
UVM: Basic Sequences
UVM: Basic SequencesUVM: Basic Sequences
UVM: Basic Sequences
 
Ericsson documents.mx ericsson-field-guide-for-utran
Ericsson documents.mx ericsson-field-guide-for-utranEricsson documents.mx ericsson-field-guide-for-utran
Ericsson documents.mx ericsson-field-guide-for-utran
 
WCDMA Air Interface
WCDMA Air InterfaceWCDMA Air Interface
WCDMA Air Interface
 
Nokia gsm-kpi-analysis-based-on-daily-monitoring-basis-presentation
Nokia gsm-kpi-analysis-based-on-daily-monitoring-basis-presentationNokia gsm-kpi-analysis-based-on-daily-monitoring-basis-presentation
Nokia gsm-kpi-analysis-based-on-daily-monitoring-basis-presentation
 
Raptor codes
Raptor codesRaptor codes
Raptor codes
 
3 g call flow
3 g call flow3 g call flow
3 g call flow
 
Sdcch
SdcchSdcch
Sdcch
 
5G NR parameters
5G NR parameters5G NR parameters
5G NR parameters
 
04 gsm bss network kpi (tch call drop rate) optimization manual
04 gsm bss network kpi (tch call drop rate) optimization manual04 gsm bss network kpi (tch call drop rate) optimization manual
04 gsm bss network kpi (tch call drop rate) optimization manual
 
IMS + VoLTE Overview
IMS + VoLTE OverviewIMS + VoLTE Overview
IMS + VoLTE Overview
 
Chap 4. call processing and handover.eng
Chap 4. call processing and handover.engChap 4. call processing and handover.eng
Chap 4. call processing and handover.eng
 
Part 2 planning of 3G
Part 2  planning of 3GPart 2  planning of 3G
Part 2 planning of 3G
 
VoLTE Flows and CS network
VoLTE Flows and CS networkVoLTE Flows and CS network
VoLTE Flows and CS network
 
SRVCC (Single Radio Voice Call Continuity) in VoLTE & Comparison with CSFB
SRVCC (Single Radio Voice Call Continuity) in VoLTE & Comparison with CSFBSRVCC (Single Radio Voice Call Continuity) in VoLTE & Comparison with CSFB
SRVCC (Single Radio Voice Call Continuity) in VoLTE & Comparison with CSFB
 
Digital modulation techniques...
Digital modulation techniques...Digital modulation techniques...
Digital modulation techniques...
 
Basic dt gsm ok
Basic dt gsm okBasic dt gsm ok
Basic dt gsm ok
 
Mpls te
Mpls teMpls te
Mpls te
 

Viewers also liked

Hacking Wireless World, RFID hacking
Hacking Wireless World, RFID hackingHacking Wireless World, RFID hacking
Hacking Wireless World, RFID hackingE Hacking
 
iOS Automation Primitives
iOS Automation PrimitivesiOS Automation Primitives
iOS Automation PrimitivesSynack
 
Virus Bulletin 2015: Exposing Gatekeeper
Virus Bulletin 2015: Exposing GatekeeperVirus Bulletin 2015: Exposing Gatekeeper
Virus Bulletin 2015: Exposing GatekeeperSynack
 
RSA OSX Malware
RSA OSX MalwareRSA OSX Malware
RSA OSX MalwareSynack
 
DEF CON 23: Stick That In Your (root)Pipe & Smoke It
DEF CON 23: Stick That In Your (root)Pipe & Smoke ItDEF CON 23: Stick That In Your (root)Pipe & Smoke It
DEF CON 23: Stick That In Your (root)Pipe & Smoke ItSynack
 
DEF CON 23: 'DLL Hijacking' on OS X? #@%& Yeah!
DEF CON 23: 'DLL Hijacking' on OS X? #@%& Yeah!DEF CON 23: 'DLL Hijacking' on OS X? #@%& Yeah!
DEF CON 23: 'DLL Hijacking' on OS X? #@%& Yeah!Synack
 
DLL Hijacking on OS X
DLL Hijacking on OS XDLL Hijacking on OS X
DLL Hijacking on OS XSynack
 
Black Hat '15: Writing Bad @$$ Malware for OS X
Black Hat '15: Writing Bad @$$ Malware for OS XBlack Hat '15: Writing Bad @$$ Malware for OS X
Black Hat '15: Writing Bad @$$ Malware for OS XSynack
 
Gatekeeper Exposed
Gatekeeper ExposedGatekeeper Exposed
Gatekeeper ExposedSynack
 
Synack cirtical infrasructure webinar
Synack cirtical infrasructure webinarSynack cirtical infrasructure webinar
Synack cirtical infrasructure webinarSynack
 
[DefCon 2016] I got 99 Problems, but 
Little Snitch ain’t one!
[DefCon 2016] I got 99 Problems, but 
Little Snitch ain’t one![DefCon 2016] I got 99 Problems, but 
Little Snitch ain’t one!
[DefCon 2016] I got 99 Problems, but 
Little Snitch ain’t one!Synack
 
Zeronights 2016 - Automating iOS blackbox security scanning
Zeronights 2016 - Automating iOS blackbox security scanningZeronights 2016 - Automating iOS blackbox security scanning
Zeronights 2016 - Automating iOS blackbox security scanningSynack
 
Crack the Consumer Code
Crack the Consumer CodeCrack the Consumer Code
Crack the Consumer CodePlaceable
 
Leading in Local! Advance Auto Parts Discusses How To Win The Local Marketing...
Leading in Local! Advance Auto Parts Discusses How To Win The Local Marketing...Leading in Local! Advance Auto Parts Discusses How To Win The Local Marketing...
Leading in Local! Advance Auto Parts Discusses How To Win The Local Marketing...Placeable
 
Networkingtips 130213160947-phpapp02
Networkingtips 130213160947-phpapp02Networkingtips 130213160947-phpapp02
Networkingtips 130213160947-phpapp02Sonu Jena
 
The Multi-barrier Approach to Address Water Quality and Disease Prevention
The Multi-barrier Approach to Address Water Quality and Disease PreventionThe Multi-barrier Approach to Address Water Quality and Disease Prevention
The Multi-barrier Approach to Address Water Quality and Disease PreventionMadelyn Skinner
 

Viewers also liked (20)

Hacking Wireless World, RFID hacking
Hacking Wireless World, RFID hackingHacking Wireless World, RFID hacking
Hacking Wireless World, RFID hacking
 
iOS Automation Primitives
iOS Automation PrimitivesiOS Automation Primitives
iOS Automation Primitives
 
Virus Bulletin 2015: Exposing Gatekeeper
Virus Bulletin 2015: Exposing GatekeeperVirus Bulletin 2015: Exposing Gatekeeper
Virus Bulletin 2015: Exposing Gatekeeper
 
RSA OSX Malware
RSA OSX MalwareRSA OSX Malware
RSA OSX Malware
 
DEF CON 23: Stick That In Your (root)Pipe & Smoke It
DEF CON 23: Stick That In Your (root)Pipe & Smoke ItDEF CON 23: Stick That In Your (root)Pipe & Smoke It
DEF CON 23: Stick That In Your (root)Pipe & Smoke It
 
DEF CON 23: 'DLL Hijacking' on OS X? #@%& Yeah!
DEF CON 23: 'DLL Hijacking' on OS X? #@%& Yeah!DEF CON 23: 'DLL Hijacking' on OS X? #@%& Yeah!
DEF CON 23: 'DLL Hijacking' on OS X? #@%& Yeah!
 
DLL Hijacking on OS X
DLL Hijacking on OS XDLL Hijacking on OS X
DLL Hijacking on OS X
 
Black Hat '15: Writing Bad @$$ Malware for OS X
Black Hat '15: Writing Bad @$$ Malware for OS XBlack Hat '15: Writing Bad @$$ Malware for OS X
Black Hat '15: Writing Bad @$$ Malware for OS X
 
Gatekeeper Exposed
Gatekeeper ExposedGatekeeper Exposed
Gatekeeper Exposed
 
Synack cirtical infrasructure webinar
Synack cirtical infrasructure webinarSynack cirtical infrasructure webinar
Synack cirtical infrasructure webinar
 
[DefCon 2016] I got 99 Problems, but 
Little Snitch ain’t one!
[DefCon 2016] I got 99 Problems, but 
Little Snitch ain’t one![DefCon 2016] I got 99 Problems, but 
Little Snitch ain’t one!
[DefCon 2016] I got 99 Problems, but 
Little Snitch ain’t one!
 
Zeronights 2016 - Automating iOS blackbox security scanning
Zeronights 2016 - Automating iOS blackbox security scanningZeronights 2016 - Automating iOS blackbox security scanning
Zeronights 2016 - Automating iOS blackbox security scanning
 
Crack the Consumer Code
Crack the Consumer CodeCrack the Consumer Code
Crack the Consumer Code
 
Osb sips structrual insulated panels
Osb sips structrual insulated panelsOsb sips structrual insulated panels
Osb sips structrual insulated panels
 
TAPipedia User Tutorial
TAPipedia User TutorialTAPipedia User Tutorial
TAPipedia User Tutorial
 
Activity 1
Activity 1Activity 1
Activity 1
 
Leading in Local! Advance Auto Parts Discusses How To Win The Local Marketing...
Leading in Local! Advance Auto Parts Discusses How To Win The Local Marketing...Leading in Local! Advance Auto Parts Discusses How To Win The Local Marketing...
Leading in Local! Advance Auto Parts Discusses How To Win The Local Marketing...
 
Networkingtips 130213160947-phpapp02
Networkingtips 130213160947-phpapp02Networkingtips 130213160947-phpapp02
Networkingtips 130213160947-phpapp02
 
The Multi-barrier Approach to Address Water Quality and Disease Prevention
The Multi-barrier Approach to Address Water Quality and Disease PreventionThe Multi-barrier Approach to Address Water Quality and Disease Prevention
The Multi-barrier Approach to Address Water Quality and Disease Prevention
 
Mgo+eps+mgo structural insulated panels
Mgo+eps+mgo structural insulated panelsMgo+eps+mgo structural insulated panels
Mgo+eps+mgo structural insulated panels
 

Similar to DEF CON 23: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex Data Service

Lecture intro to_wcdma
Lecture intro to_wcdmaLecture intro to_wcdma
Lecture intro to_wcdmaGurpreet Singh
 
Behavioral modeling of Clock/Data Recovery
Behavioral modeling of Clock/Data RecoveryBehavioral modeling of Clock/Data Recovery
Behavioral modeling of Clock/Data RecoveryArrow Devices
 
Signal Integrity - A Crash Course [R Lott]
Signal Integrity - A Crash Course [R Lott]Signal Integrity - A Crash Course [R Lott]
Signal Integrity - A Crash Course [R Lott]Ryan Lott
 
802.11 technology overview
802.11 technology overview802.11 technology overview
802.11 technology overviewsureshkumarmss
 
Digital communication
Digital communicationDigital communication
Digital communicationmeashi
 
Orthogonal Frequency Division Multiplexing.ppt
Orthogonal Frequency Division Multiplexing.pptOrthogonal Frequency Division Multiplexing.ppt
Orthogonal Frequency Division Multiplexing.pptStefan Oprea
 
Screaming Channels: When Electromagnetic Side Channels Meet Radio Transceivers
Screaming Channels: When Electromagnetic Side Channels Meet Radio TransceiversScreaming Channels: When Electromagnetic Side Channels Meet Radio Transceivers
Screaming Channels: When Electromagnetic Side Channels Meet Radio TransceiversPriyanka Aash
 
1999 si pi_dws_training_course
1999 si pi_dws_training_course1999 si pi_dws_training_course
1999 si pi_dws_training_coursePiero Belforte
 
EC8395 COMMUNICATION ENGINEERING UNIT V
EC8395 COMMUNICATION ENGINEERING UNIT V EC8395 COMMUNICATION ENGINEERING UNIT V
EC8395 COMMUNICATION ENGINEERING UNIT V ManojKumar791621
 
Lecture_1 (1).pptx
Lecture_1 (1).pptxLecture_1 (1).pptx
Lecture_1 (1).pptxDavidHamxa
 
Introduction to spred spectrum and CDMA
Introduction to spred spectrum and CDMAIntroduction to spred spectrum and CDMA
Introduction to spred spectrum and CDMABidhan Ghimire
 
Webinar Keysight: Soluções de Teste para Tecnologias Emergentes 5G-NR e IoT-L...
Webinar Keysight: Soluções de Teste para Tecnologias Emergentes 5G-NR e IoT-L...Webinar Keysight: Soluções de Teste para Tecnologias Emergentes 5G-NR e IoT-L...
Webinar Keysight: Soluções de Teste para Tecnologias Emergentes 5G-NR e IoT-L...Embarcados
 
SPREAD SPECTRUM MODULATION.pptx
SPREAD SPECTRUM MODULATION.pptxSPREAD SPECTRUM MODULATION.pptx
SPREAD SPECTRUM MODULATION.pptxDeepakBaghel50
 
Radio Signal Classification with Deep Neural Networks
Radio Signal Classification with Deep Neural NetworksRadio Signal Classification with Deep Neural Networks
Radio Signal Classification with Deep Neural NetworksKachi Odoemene
 
Speaker Dependent WaveNet Vocoder
Speaker Dependent WaveNet VocoderSpeaker Dependent WaveNet Vocoder
Speaker Dependent WaveNet VocoderAkira Tamamori
 
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.pptLectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.pptShamsAli42
 
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.pptLectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.pptArnabChakraborty499766
 

Similar to DEF CON 23: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex Data Service (20)

Lecture intro to_wcdma
Lecture intro to_wcdmaLecture intro to_wcdma
Lecture intro to_wcdma
 
Behavioral modeling of Clock/Data Recovery
Behavioral modeling of Clock/Data RecoveryBehavioral modeling of Clock/Data Recovery
Behavioral modeling of Clock/Data Recovery
 
Signal Integrity - A Crash Course [R Lott]
Signal Integrity - A Crash Course [R Lott]Signal Integrity - A Crash Course [R Lott]
Signal Integrity - A Crash Course [R Lott]
 
802.11 technology overview
802.11 technology overview802.11 technology overview
802.11 technology overview
 
Digital communication
Digital communicationDigital communication
Digital communication
 
Orthogonal Frequency Division Multiplexing.ppt
Orthogonal Frequency Division Multiplexing.pptOrthogonal Frequency Division Multiplexing.ppt
Orthogonal Frequency Division Multiplexing.ppt
 
Screaming Channels: When Electromagnetic Side Channels Meet Radio Transceivers
Screaming Channels: When Electromagnetic Side Channels Meet Radio TransceiversScreaming Channels: When Electromagnetic Side Channels Meet Radio Transceivers
Screaming Channels: When Electromagnetic Side Channels Meet Radio Transceivers
 
1999 si pi_dws_training_course
1999 si pi_dws_training_course1999 si pi_dws_training_course
1999 si pi_dws_training_course
 
EC8395 COMMUNICATION ENGINEERING UNIT V
EC8395 COMMUNICATION ENGINEERING UNIT V EC8395 COMMUNICATION ENGINEERING UNIT V
EC8395 COMMUNICATION ENGINEERING UNIT V
 
Lecture_1 (1).pptx
Lecture_1 (1).pptxLecture_1 (1).pptx
Lecture_1 (1).pptx
 
cdma2000_Fundamentals.pdf
cdma2000_Fundamentals.pdfcdma2000_Fundamentals.pdf
cdma2000_Fundamentals.pdf
 
Introduction to spred spectrum and CDMA
Introduction to spred spectrum and CDMAIntroduction to spred spectrum and CDMA
Introduction to spred spectrum and CDMA
 
Pass band transmission
Pass band transmission Pass band transmission
Pass band transmission
 
Webinar Keysight: Soluções de Teste para Tecnologias Emergentes 5G-NR e IoT-L...
Webinar Keysight: Soluções de Teste para Tecnologias Emergentes 5G-NR e IoT-L...Webinar Keysight: Soluções de Teste para Tecnologias Emergentes 5G-NR e IoT-L...
Webinar Keysight: Soluções de Teste para Tecnologias Emergentes 5G-NR e IoT-L...
 
Gps signals
Gps signalsGps signals
Gps signals
 
SPREAD SPECTRUM MODULATION.pptx
SPREAD SPECTRUM MODULATION.pptxSPREAD SPECTRUM MODULATION.pptx
SPREAD SPECTRUM MODULATION.pptx
 
Radio Signal Classification with Deep Neural Networks
Radio Signal Classification with Deep Neural NetworksRadio Signal Classification with Deep Neural Networks
Radio Signal Classification with Deep Neural Networks
 
Speaker Dependent WaveNet Vocoder
Speaker Dependent WaveNet VocoderSpeaker Dependent WaveNet Vocoder
Speaker Dependent WaveNet Vocoder
 
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.pptLectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
 
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.pptLectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
 

More from Synack

OS X Malware: Let's Play Doctor
OS X Malware: Let's Play DoctorOS X Malware: Let's Play Doctor
OS X Malware: Let's Play DoctorSynack
 
DEF CON 23: Internet of Things: Hacking 14 Devices
DEF CON 23: Internet of Things: Hacking 14 DevicesDEF CON 23: Internet of Things: Hacking 14 Devices
DEF CON 23: Internet of Things: Hacking 14 DevicesSynack
 
Black Hat '15: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simpl...
Black Hat '15: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simpl...Black Hat '15: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simpl...
Black Hat '15: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simpl...Synack
 
Electromagnetic Hypersensitivity and You
Electromagnetic Hypersensitivity and YouElectromagnetic Hypersensitivity and You
Electromagnetic Hypersensitivity and YouSynack
 
Home Automation Benchmarking Report
Home Automation Benchmarking ReportHome Automation Benchmarking Report
Home Automation Benchmarking ReportSynack
 
Let's Hack a House
Let's Hack a HouseLet's Hack a House
Let's Hack a HouseSynack
 
Synack at AppSec California with Patrick Wardle
Synack at AppSec California with Patrick WardleSynack at AppSec California with Patrick Wardle
Synack at AppSec California with Patrick WardleSynack
 
Synack at AppSec California 2015 - Geolocation Vulnerabilities
Synack at AppSec California 2015 - Geolocation VulnerabilitiesSynack at AppSec California 2015 - Geolocation Vulnerabilities
Synack at AppSec California 2015 - Geolocation VulnerabilitiesSynack
 
Synack at ShmooCon 2015
Synack at ShmooCon 2015Synack at ShmooCon 2015
Synack at ShmooCon 2015Synack
 

More from Synack (9)

OS X Malware: Let's Play Doctor
OS X Malware: Let's Play DoctorOS X Malware: Let's Play Doctor
OS X Malware: Let's Play Doctor
 
DEF CON 23: Internet of Things: Hacking 14 Devices
DEF CON 23: Internet of Things: Hacking 14 DevicesDEF CON 23: Internet of Things: Hacking 14 Devices
DEF CON 23: Internet of Things: Hacking 14 Devices
 
Black Hat '15: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simpl...
Black Hat '15: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simpl...Black Hat '15: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simpl...
Black Hat '15: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simpl...
 
Electromagnetic Hypersensitivity and You
Electromagnetic Hypersensitivity and YouElectromagnetic Hypersensitivity and You
Electromagnetic Hypersensitivity and You
 
Home Automation Benchmarking Report
Home Automation Benchmarking ReportHome Automation Benchmarking Report
Home Automation Benchmarking Report
 
Let's Hack a House
Let's Hack a HouseLet's Hack a House
Let's Hack a House
 
Synack at AppSec California with Patrick Wardle
Synack at AppSec California with Patrick WardleSynack at AppSec California with Patrick Wardle
Synack at AppSec California with Patrick Wardle
 
Synack at AppSec California 2015 - Geolocation Vulnerabilities
Synack at AppSec California 2015 - Geolocation VulnerabilitiesSynack at AppSec California 2015 - Geolocation Vulnerabilities
Synack at AppSec California 2015 - Geolocation Vulnerabilities
 
Synack at ShmooCon 2015
Synack at ShmooCon 2015Synack at ShmooCon 2015
Synack at ShmooCon 2015
 

Recently uploaded

AI You Can Trust - Ensuring Success with Data Integrity Webinar
AI You Can Trust - Ensuring Success with Data Integrity WebinarAI You Can Trust - Ensuring Success with Data Integrity Webinar
AI You Can Trust - Ensuring Success with Data Integrity WebinarPrecisely
 
Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1DianaGray10
 
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...UbiTrack UK
 
Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.YounusS2
 
VoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBXVoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBXTarek Kalaji
 
9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding Team9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding TeamAdam Moalla
 
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfJamie (Taka) Wang
 
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDEADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDELiveplex
 
Bird eye's view on Camunda open source ecosystem
Bird eye's view on Camunda open source ecosystemBird eye's view on Camunda open source ecosystem
Bird eye's view on Camunda open source ecosystemAsko Soukka
 
Designing A Time bound resource download URL
Designing A Time bound resource download URLDesigning A Time bound resource download URL
Designing A Time bound resource download URLRuncy Oommen
 
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...Aggregage
 
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...Will Schroeder
 
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IES VE
 
Igniting Next Level Productivity with AI-Infused Data Integration Workflows
Igniting Next Level Productivity with AI-Infused Data Integration WorkflowsIgniting Next Level Productivity with AI-Infused Data Integration Workflows
Igniting Next Level Productivity with AI-Infused Data Integration WorkflowsSafe Software
 
Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024D Cloud Solutions
 
UiPath Solutions Management Preview - Northern CA Chapter - March 22.pdf
UiPath Solutions Management Preview - Northern CA Chapter - March 22.pdfUiPath Solutions Management Preview - Northern CA Chapter - March 22.pdf
UiPath Solutions Management Preview - Northern CA Chapter - March 22.pdfDianaGray10
 
Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Commit University
 
Building Your Own AI Instance (TBLC AI )
Building Your Own AI Instance (TBLC AI )Building Your Own AI Instance (TBLC AI )
Building Your Own AI Instance (TBLC AI )Brian Pichman
 

Recently uploaded (20)

AI You Can Trust - Ensuring Success with Data Integrity Webinar
AI You Can Trust - Ensuring Success with Data Integrity WebinarAI You Can Trust - Ensuring Success with Data Integrity Webinar
AI You Can Trust - Ensuring Success with Data Integrity Webinar
 
Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1
 
20230104 - machine vision
20230104 - machine vision20230104 - machine vision
20230104 - machine vision
 
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
 
Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.
 
VoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBXVoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBX
 
201610817 - edge part1
201610817 - edge part1201610817 - edge part1
201610817 - edge part1
 
9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding Team9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding Team
 
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
 
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDEADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
 
Bird eye's view on Camunda open source ecosystem
Bird eye's view on Camunda open source ecosystemBird eye's view on Camunda open source ecosystem
Bird eye's view on Camunda open source ecosystem
 
Designing A Time bound resource download URL
Designing A Time bound resource download URLDesigning A Time bound resource download URL
Designing A Time bound resource download URL
 
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
 
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
 
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
 
Igniting Next Level Productivity with AI-Infused Data Integration Workflows
Igniting Next Level Productivity with AI-Infused Data Integration WorkflowsIgniting Next Level Productivity with AI-Infused Data Integration Workflows
Igniting Next Level Productivity with AI-Infused Data Integration Workflows
 
Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024
 
UiPath Solutions Management Preview - Northern CA Chapter - March 22.pdf
UiPath Solutions Management Preview - Northern CA Chapter - March 22.pdfUiPath Solutions Management Preview - Northern CA Chapter - March 22.pdf
UiPath Solutions Management Preview - Northern CA Chapter - March 22.pdf
 
Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)
 
Building Your Own AI Instance (TBLC AI )
Building Your Own AI Instance (TBLC AI )Building Your Own AI Instance (TBLC AI )
Building Your Own AI Instance (TBLC AI )
 

DEF CON 23: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex Data Service