Download to read offline
Uploaded byFelipe Prado
Defcon 23 - colby moore - spread spectrum satcom hacking
This document summarizes a presentation about hacking the Globalstar Simplex Data Service satellite communication system. The presentation covers spread spectrum modulation techniques, selecting the SPOT satellite messenger as a target, reverse engineering how it works, decoding and transmitting packets, and potential impacts. The goal is to spark interest in satellite security research and show how legacy satellite systems could be exploited. It concludes by noting a live demonstration of intercepting signals and outlines areas for future research.
More Related Content
Similar to Defcon 23 - colby moore - spread spectrum satcom hacking
Defcon 23 - colby moore - spread spectrum satcom hacking
- 1. Spread Spectrum Satcom Hacking Attackingthe Globalstar Simplex Data Service Colby Moore @colbymoore - colby@synack.com
- 2. Motivation • Satellite hackingtalks never deliver • RF world largely neglected by hacker community • So much legacy tech in critical systems • Spark interest in satellite security research
- 3. What are wegoing to learn? • Overview of basic RF signals and modulation • What is spread spectrum - how does it work and how do we work with it • Picking a target and reverse engineering it • Exploiting that target • Next steps
- 4. Analog RF Modulation •Amplitude Modulation (AM) • Frequency Modulation (FM)
- 5. Digital RF Modulation •Amplitude Shift Keying (ASK / OOK) • Frequency Shift Keying (FSK) • Phase Shift Keying (PSK)
- 6. Spread Spectrum Modulation • Whatis Spread Spectrum Special? WiFi, Bluetooth, Most modern RF Communication
- 7. Spread Spectrum Modulation • FrequencyHopping Spread Spectrum (FHSS) • Direct Sequence Spread Spectrum (DSSS)
- 8. Selecting a Target •Consumer Accessible • Cheap • Popular • High Impact
- 9. Introducing SPOT • SPOT •But wait… this tech is used… everywhere. Goldmine.
- 10. Who uses it? •Flight Planning Services • Consumers • SCADA • Big Gas and Oil
- 11. How does itwork? • LEO non-geosynchronous Bend Pipe Architecture
- 12. Intel Gathering • Google •FCC Database • Academic Papers • Integrator Spec Sheets
- 13. Intel Gathering Continued •What we know: • PN = 255 Chip M-Sequence • 1.6xx ghz • 144 bit message
- 14. Hardware and Validation •USRP B200 • GQRX • GNURADIO
- 15. Decoding Theory • Mixsignal with PN sequence and the BPSK signal will drop out
- 16. Packet Format Contd. •Wait a second… There is no signing… No encryption. • We can create packets if we known how to reproduce the checksum. • Reverse engineering the checksum
- 17. Transmitting • Strictly Theoretical- Do not attempt • This is the easy part
- 18. Impact of Transmission •Spoof communications • Disrupt critical services
- 19.
- 20. Future Research • Codeoptimization • Custom hardware • Widespread reception
- 21. Slides and Code •Updated slides, resources, and code to be posted online after the presentation.