Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Advanced Threats

8/7/2014
10:00 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

No Fixes In Sight For Satellite Terminal Flaws

At Black Hat USA, a researcher who in April revealed weaknesses in popular satellite ground terminal equipment found on air, land and sea, demonstrates possible attack scenarios.

BLACK HAT USA -- Las Vegas -- Back in April, when security researcher Ruben Santamarta first went public with serious security flaws in the firmware of satellite land equipment that could allow attackers to hijack and disrupt communications links to ships, airplanes, and military operations, only one of the affected vendors had responded to his findings.

Santamarta in a presentation on his research here Thursday at Black Hat USA said the satellite terminal vendors with gaping holes in their products have no plans to patch or fix the shortcomings, which include hardcoded passwords, backdoors, insecure protocols and undocumented protocols. Some contend that the issues are not flaws but acceptable features in their products. Santamarta reported his findings to the CERT Coordination Center, which then alerted the satellite vendors in January of this year.

Hughes, for example, stated that the digital backdoors are a "normal" and common practice in commercial products for retrieving lost or forgotten passwords, says Santamarta, principal security consultant with IOActive.

"I expected to find some security issues [with these devices] but the backdoors and ability to upload software without authentication, these things are very" serious, Santamarta told Dark Reading.

Specifically, he found that an attacker could completely compromise the systems, run malware, install malicious firmware and even send an SMS text to spoof the communication to a ship, for example. "They can spoof messages and trick the ship to follow a certain path, or to rescue another ship. They can disrupt communications... if a vessel can't send a distress signal, that's the worst scenario, if a ship can't communicate," Santamarta explained in an April interview after his initial findings were first published.

In the case of an airplane, the in-flight airline WiFi network is vulnerable to malicious behavior, he says, because the Cobham AVIATOR 700 satellite terminals sit on the WiFi network. The danger, he says, is an attacker gaining control over the Satellite Data Unit or the SwiftBroadband Unit interface by taking advantage of the weak password reset feature, hardcoded credentials or the insecure protocols in the AVIATOR 700.

"More specifically, a successful attack could compromise control of the satellite link channel used by the Future Air Navigation System (FANS), Controller Pilot Data Link Communications (CPDLC) or Aircraft Communications Addressing and Reporting System (ACARS). A malfunction of these subsystems could pose a safety threat for the entire aircraft," writes Santamarta in his white paper on the findings.

But "we're not crashing planes here," Santamarta says. Even so, disrupting ACARS messaging could pose a safety risk, he says.

Cobham said an attacker would need physical access, or the network would have to have been improperly installed, for the attack scenarios Santamarta presented. The company also said over-the-air communications requires user authentication, and hardcoded passwords cannot be used.

With any of the vulnerabilities in the various satellite terminals, the attackers would have to have some knowledge of the inherent firmware and its weaknesses, as well as how to exploit them.

Santamarta's findings mirror that of many other so-called embedded commercial systems. Billy Rios, director of threat intelligence at Qualys, here yesterday revealed his latest findings on Transportation Safety Administration (TSA) checkpoint systems, namely that the TSA's Kronos 4500 time clock system used by TSA agents to clock in and out with their fingerprints, contains two different hardcoded passwords that can only be changed by the vendor.

"A lot of embedded systems have lame vulnerabilities. Name your embedded system, it's going to have" some basic security weakness, says Marc Maiffret, CTO at BeyondTrust.

[From Google hacking to ATM "jackpotting" to the NSA -- Black Hat has had some memorable moments over the years. Read 10 Dramatic Moments In Black Hat History.]

Santamarta studied and reverse-engineered the firmware of satellite terminal equipment from Cobham, Hughes, Inmarsat, JRC, Iridium, and Thuraya. 

"If you have physical access to any of these devices, it's over," Santamarta says. "You can compromise all the devices" on that network, he says.

Security experts say hardcoded credentials in hardware is a recipe for disaster. "Using hard-coded username and passwords from hardware manufacturers without another layer of protection is security suicide," says Ken Balich, CISO at Authentify. "All of these vulnerabilities and breaches stem from two things:  failures in network security thinking to understand and counter emerging threats, and following the old adage 'I don't need more security until something happens.'  Unfortunately that's too late and many can pay a steep price."

Santamarta's full report is available here (PDF).

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/12/2014 | 12:29:38 PM
Re: distressing and depressing
Indeed! I do think, though, that this is a case where the good guys are trying to get ahead of the bad guys. Let's hope that the industry in question here gets the message and offers fixes before the bad guys start to figure this out.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
8/12/2014 | 12:19:58 PM
distressing and depressing
It's one thing when an organization is slow fixing vulnerabilities; it's another when they flat out say that they're not going to fix vulnerabilities. Or won't recognize that they're vulnerabilities.  Here's hoping that Ruben's findings really are worst case scenario and that they won't be manipulated by the bad guys.
Black Hat Q&A: Hacking a '90s Sports Car
Black Hat Staff, ,  11/7/2019
The Cold Truth about Cyber Insurance
Chris Kennedy, CISO & VP Customer Success, AttackIQ,  11/7/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: How do you like our new spear phishing email solution?
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18881
PUBLISHED: 2019-11-12
WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile.
CVE-2019-18882
PUBLISHED: 2019-11-12
WSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is mishandled.
CVE-2019-18873
PUBLISHED: 2019-11-12
FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to fully compromise the system via a GET request. When the admin visits user information under "User Manager" in the control panel, the pa...
CVE-2019-18874
PUBLISHED: 2019-11-12
psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.
CVE-2019-18862
PUBLISHED: 2019-11-11
maidag in GNU Mailutils before 3.8 is installed setuid and allows local privilege escalation in the url mode.