Hello, World!
StarLink terminals - those dishes that connect to StarLink satellites, have been hacked by
a white hat hacker.
Using just $25 dollars in off the shelf hardware he was able to gain root access to a terminal,
allowing him to explore the wider StarLink network - a capability which could enable
exploitation of StarLink satellites themselves.
So, StarLink terminals are pretty locked down bits of kit, there's no way to run custom
code on them in the form of plugins or apps - these things run firmware signed by StarLink,
and that's it.
This forced the Belgian security researcher behind the hack, one "Lennert Wouters" (hope
I got that right) - to be creative.
After disassembling his terminal, or as SpaceX calls them "Dishy McFlatface", he opted to
use a "voltage fault injection attack", otherwise known as "glitching", in an attempt to load
modified firmware, enabling full access to the dish.
This attack method, "glitching" - isn't new - it's the same technique that was used to
hack, airtags - turning them into, rickroll tags.
"Glitching" works by interrupting the power supply to the dish's CPU, for a very short
period of time in order to skip certain processor instructions - the aim here, is to skip the
"secure boot" code which verifies that the firmware stored on the memory chip is signed
by SpaceX and hasn't been tampered with.
"Glitching" isn't straight forward - it requires a lot of trial and error, but eventually our
security researcher was able to bypass this "secure boot" mechanism, loading modified
firmware - giving him complete root access to the dish.
So, whilst this level of access gives him complete control over the dish itself, it
doesn't necessarily allow him to attack the satellites that the dish connects to.
Though that's not to say this root access wouldn't be incredibly useful to someone wanting
to attack those StarLink satellites - in the words of our researcher, "As an attacker,
let’s say you wanted to attack the satellite itself,” - “You could try to build your
own system that allows you to talk to the satellite, but that’s quite difficult.
So if you want to attack the satellites, you would like to go through the user terminal
as that likely makes your life easier.”
And, attacking satellite communication is something to worry about... it's not confined
to the realms of science fiction, at least not anymore.
For example, in the early hours of Russia's invasion of Ukraine a cyber attack knocked
out thousands of modems used to connect to KA-SAT - a satellite which provides internet
access to much of Europe.
And StarLink has been a target too, albeit of a less sophisticated attack type.
Elon Musk confirmed that StarLink terminals in Ukraine have fallen victim to jamming.
Both, this jamming and the operation against KA-SAT modems have been attributed to Russia.
Though, back to "Dishy McFlatface" - our researcher wasn't satisfied with the hardware he used
to pull off the hack - as it is quite fiddly and expensive, so he went one step further
- ditching his pricey lab equipment and replicating the attack with a raspberry pi pico - before
going yet another step further and creating a custom PCB that can be directly soldered
to the dish.
Typically referred to as a modchip, this PCB contains all the electronics needed to pull
off the hack, and it cost less than $25 to put together - on top of that, it's all open
sourced.
So, the researcher here, did responsibly disclose the vulnerability to SpaceX last year, earning
him an undisclosed sum of money through their bug bounty program.
It's only now that this has all become public, after the researcher gave a talk and did a
live demonstration at BlackHat - an annual hacking conference in Vegas.
As for fixing the problem, well - the vulnerability here is a hardware issue, SpaceX simply can't
fix it with a software update, instead, new hardware would be needed.
However SpaceX can make exploiting the vulnerability more difficult - and they have, issuing a
firmware update which blows a fuse on the dish, permanently disabling serial output
- the modchip used this to trigger the hack.
Losing serial output, does make the hack harder to do, but it's not impossible.
There's a lot of details in this segment that I just didn't have time for, to be honest
this topic could've taken up a whole video, so I'll make sure to leave some links for
further reading below if you want to dive deeper into this.
Next up, 'Speaker of the US House of Representatives' Nancy Pelosi recently made a trip to Taiwan.
China wasn't too thrilled with the idea, claiming it violated their territorial integrity - and
so, besides the military drills that China launched in response to the visit, there was
also a lot of drama in cyber space.
I do realise this news is a week or so old, but it's still worth digging in to.
And, I'm well aware Nancy Pelosi is controversial and widely disliked, for various reasons...
but we're here for the cyber stuff - not the politics.
Besides, the fact that this drama between China and Taiwan was caused by Nancy Pelosi's
visit, is largely irrelevant, her trip made the news because it was the first visit a
high ranking US official has made to Taiwan since the 90s - so we would've gotten the
same drama whoever the Speaker was.
As for that drama in cyber space, during the Speaker's visit, Taiwan's Ministry of Defence
as well as the presidential website suffered a DDoS attack, the latter attack lasted only
20 minutes, though even after coming back online the site just displayed the message
'ok' for a day or two.
But even before Pelosi's visit, a number of government departments as well as Taiwan's
largest airport had their websites booted offline.
More interesting things other than just DDoSing went down - bad actors hacked into billboards
and TV screens in Taiwanese supermarkets and railways to display some very unwelcoming
messages, referring to Nancy Pelosi as an... old witch - the messages didn't say anything
more interesting than that, just the usual propaganda that Taiwan should reunite with
China, etcetera.
It's been suggested that the billboards had a backdoor programmed into them, given that
they were running Chinese software - but it's likely that the software being Chinese was
just a coincidence and miscreants got in some other way - as Taiwan does use a lot of Chinese
made tech.
Some people might jump to the conclusion that this must have all been perpetrated by the
Chinese government, but that's probably not the case.
Aside from the Chinese government having nothing to gain from vandalising a few billboards
and DDoSing some Taiwanese websites for 20 minutes, the much more likely perpetrators
are China's subculture of patriotic hackers.
Hacktivists - (if you can call them that) - these guys often target the systems of organisations
unfriendly to China.
Hence the small scale operations which have no real world impact other than to put smiles
on the faces of those doing them when they inevitably make headlines.
Nevertheless, the Chinese government themselves has been known to use blunt methods of attack
like DDoSing, but when they do it, it's a little more sophisticated, and much, more
effective.
For example, a couple of years back, a forum used by Hong Kong protestors was crippled
in a DDoS attack, by what's come to be known as "China's great cannon".
This "Great cannon" is ingenious, it takes advantage of the fact that all international
internet traffic destined for China has to go through Chinese government controlled routers.
When the government wants to initiate a DDoS, they start intercepting unencrypted traffic
destined for Chinese websites, they then inject malicious javascript into the responses sent
back to browsers.
Malicious javascript which then causes the browser to DoS a given website.
Using this technique China can very quickly build a temporary international botnet.
China's great cannon apparently runs on the same infrastructure and shares code with the
'Great firewall of China' - which led researchers to the assumption that it must be run by the
Chinese government.
The 'great cannon' isn't used often though, perhaps because of the awful press it generates.
This video was made possible by Linode, who are giving you a $100 60-day credit just for
signing up.
Linode is essentially your swiss army knife for cloud computing, if it runs on linux it'll
run on Linode.
One great feature of Linode is their app marketplace which makes it super easy to spin up servers
with preconfigured software.
Use Linode's Kali Linux app to quickly spin up a fresh instance of Kali, the installer
makes it easy to configure the basics, like VNC passwords, whether you want a desktop
environment, and so on.
Linode can run almost anything, by providing all the tools a developer really needs at
competitive prices.
Use the link in the description now to claim your free $100.
As always, thanks for watching, make sure to like the video if you liked it and I'll
see you in the next one, have a good one.