Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/17/2014
02:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

Satellite Communications Wide Open To Hackers

Satellite terminals widely used in transportation, military, and industrial plants contain backdoors, hardcoded credentials, weak encryption algorithms, and other design flaws, a new report says.

Critical design flaws have been discovered in the firmware of popular satellite land equipment that could allow attackers to hijack and disrupt communications links to ships, airplanes, military operations, industrial facilities, and emergency services.

If just one of these thousands of devices were to be compromised, the entire satellite telecommunications infrastructure could be in danger, according to research published today.

In some cases, an attacker need only send an SMS text message to launch an attack. "You could attack one of these devices with SMS, and trigger features to install new firmware or to compromise it," says Ruben Santamarta, principal security consultant for IOActive, who discovered the security flaws last fall and published a report on his findings today. An SMS from one ship to another could compromise some satellite communications, the report says.

"Attackers who compromise the database of an Inmarsat SIM/Terminals reseller can use this information to remotely compromise all those terminals," he says.

Santamarta dug up numerous design flaws in satellite ground terminal equipment from Harris Corp., Hughes, Thuraya, Cobham, JRC, and Iridium. The flaws include hardcoded credentials, undocumented protocols, insecure protocols, backdoors, and weak password reset features. He reported his findings to the CERT Coordination Center, which in turn alerted the affected vendors in January. But to date, just one vendor -- Iridium -- has responded to the alerts and is working on fixes.

"In most cases, attackers can completely compromise" the system, Santamarta says. "They could run their own code, install malicious firmware... and do anything they want with that device."

An attacker could disrupt satellite communication to a ship or aircraft, he says, potentially wreaking catastrophic damages. "They can spoof messages and trick the ship to follow a certain path, or to rescue another ship. They can disrupt communications... if a vessel can't send a distress signal, that's the worst scenario, if a ship can't communicate."

The same would be true for an airplane, he says. And an attacker would not even need physical access to the satellite equipment to pull off a link hijack or spoof; in many cases, hackers could execute their attacks remotely.

Santamarta found the flaws after downloading and reverse engineering the firmware for the systems. "I wasn't looking for memory or buffer overflow or other typical vulnerabilities. But design flaws [found] like backdoors or [weak] protocols are in a way more dangerous because you can reach the device" by using them.

Attackers would have to have some knowledge of the inherent firmware weaknesses and how to exploit them, and some vulnerabilities are easier to exploit than others. "But if you can reach the device, you can compromise it. You can access it through HTTP or some other kind of documented interfaces. In most cases, you can remotely exploit these flaws."

The vulnerable products found by IOActive are Harris' RF-7800-VU024 and RF-7800-DU024 terminals for Broadband Global Area Network (BGAN) services; Hughes 9201/9202/9450/9502 for BGAN and BGAN M2M services, Thuraya IP for BGAN services, Cobham Explorer and SAILOR 900 VSAT for VSAT services, Cobham AVIATOR 700 (E/D) for SwiftBroadband Classic Aero services, Cobham SAILOR FB 150/250/500 for Inmarsat FB services, Cobham SAILOR 6000 Series for Inmarsat C services, JRC JUE-250/500 FB for Inmarsat FB services, and Iridium Pilot/OpenPort for Iridium services.

Vulnerable Satellite Equipment
(Source: IOActive)
(Source: IOActive)

Dan Kaminsky, co-founder and chief scientist at White Ops, says the IOActive findings demonstrate how hacking has evolved and satellite technologies have not kept up. "Historically, those who could attack satellites were bound by financial and diplomatic considerations -- it's expensive to talk to the birds, and those who can afford it are nation-states who need to be careful about acts of war," Kaminsky said in an email interview with Dark Reading. "This has the effect of insulating engineers from a lot of security fears, a convenient thing when the underlying technology is hard enough to build without making it secure.  Of course, time passes, tech gets cheaper, regular hackers get access...and you have, in 2014, an actual 'first contact' situation between a public researcher and a very private engineering community."

When asked if these device satellite equipment firmware weaknesses could be discovered via public Internet scans, Santamarta declined to comment.

IOActive recommends in the report that users of these satellite products move to mitigate any potential attacks using these vulnerabilities. "Owners and providers should evaluate the network exposure of these devices, implement secure policies, enforce network segmentation, and apply restrictive traffic flow templates (TFT) when possible. Until patches are available, vendors should provide official workarounds in addition to recommended configurations in order to minimize the risk these vulnerabilities pose."

The full report is available here.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
4/17/2014 | 3:18:11 PM
Oh, fabulous
Queue conspiracy theorists that this is what happened to the Malaysian Airlines flight in 3, 2, ...
securityaffairs
100%
0%
securityaffairs,
User Rank: Ninja
4/17/2014 | 5:01:21 PM
Re: Oh, fabulous
Very interesting post ... satellite components in many cases lack of proper defense measures. Many satellite architectures were designed many years ago, while their life cycle is very long the cyber threats evolution is a very rapid process. New malicious agents with efficient techniques are threatening satellite architectures and the only way to protect the infrastructures is approaching security by design. The flaw highlighted in the post are demonstration of a wrong approach to cyber security.
Kelly Jackson Higgins
100%
0%
Kelly Jackson Higgins,
User Rank: Strategist
4/21/2014 | 12:59:54 PM
Re: Oh, fabulous
These findings are reminiscent of vulnerabilities in ICS/SCADA products. It's a critical infrastructure problem. What's most disturbing is that the satellite equipment vendors are not even responding to CERT. At least many of the major ICS/SCADA vendors are becoming more responsive today.
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Tor Weaponized to Steal Bitcoin
Dark Reading Staff 10/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8369
PUBLISHED: 2019-10-21
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.
CVE-2019-18224
PUBLISHED: 2019-10-21
idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.
CVE-2019-16985
PUBLISHED: 2019-10-21
In FusionPBX up to v4.5.7, the file app\xml_cdr\xml_cdr_delete.php uses an unsanitized "rec" variable coming from the URL, which is base64 decoded and allows deletion of any file of the system.
CVE-2019-16986
PUBLISHED: 2019-10-21
In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. (resources\secure_download.php is also affected.)
CVE-2019-16987
PUBLISHED: 2019-10-21
In FusionPBX up to v4.5.7, the file app\contacts\contact_import.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leading to XSS.