Satellite Telephony Security
•
7 likes•10,107 views
This talk will provide an in-depth treatment of satellite telephony networks from a security perspective. The overall system seems secure, but in reality, it cannot be expected to be fully reliable. We will briefly cover the satellite mobile system architecture, then discuss GMR (GEO-Mobile Radio) system elements, e.g. GSS (Gateway Station Subsystem), MES (Mobile Earth Station), AOC (Advanced Operation Center), and TCS (Traffic Control Subsystem) for GMR-1 systems and NCC (Network Control Center), GW (Gateway), SCF (Satellite Control Facility) and CMIS (Customer Management Information System) for GMR-2 systems. From there, we will discuss the security issues of GMR system as it shares similar vulnerabilities with GSM–GMR is derived from the terrestrial digital cellular standard GSM and support access to GSM core networks, along with some interesting demos. Time permitting, a question and answer session at the end of the presentation will allow participants to cover any additional issues in satellite telephony system they’d like to discuss.
More Related Content
What's hot
What's hot (20)
Similar to Satellite Telephony Security
Similar to Satellite Telephony Security (20)
More from Jim Geovedi
More from Jim Geovedi (20)
Recently uploaded
Recently uploaded (20)
Satellite Telephony Security
- 2. DON’T PANIC
- 3. “ WHEN TERRESTRIAL COMMUNICATION FAIL, WE PREVAIL! ” Arthur C. Clarke 1917-2008
- 4. Satellite Communications Broadcast Video to Cable Headends Local ISPs Direct Broadcast TV Video Last-mile Broadband Contribution Corporate Data Networks Teleport PSTN (Interactive & Multicast) End Users Teleport Internet End Users
- 5. Dan Veeneman Low Earth Orbit Satellites Dan Veeneman Future & Existing Satellite Systems Warezzman DVB Satellite Hacking Jim Geovedi, Raditya Iryandi, Hacking a Bird in the Sky: Hijacking VSAT Connection Jim Geovedi, Raditya Iryandi, Anthony Zboralski Hacking a Bird in the Sky: Exploiting Satellite Trust Relationship Adam Laurie $atellite Hacking for Fun & Pr0fit! Leonardo Nve Egea, Christian Martorella Playing in a Satellite Environment 1.2 Jim Geovedi, Raditya Iryandi Hacking Satellite: A New Universe to Discover Jim Geovedi, Raditya Iryandi, Raoul Chiesa Hacking a Bird in the Sky: The Revenge of Angry Birds Jim Geovedi Satellite Telephony Security: What Is and What Will Never Be 1996 1998 2004 2006 2008 2009 2011
- 11. Satellite Orbits average distance to moon: 384,400 km Medium Earth Orbit Altitude: 8,000-20,000 km EARTH Low Earth Orbit Altitude: 500-2,000 km Geostationary Orbit Altitude: 35,786 km Highly Elliptical Orbit Altitude: >35,786 km
- 12. GEO (Geostationary Earth Orbit) Satellite Operators ACeS, ICO, Inmarsat, SkyTerra, TerreStar, Thuraya LEO (Low Earth Orbit) Satellite Operators Globalstar, Iridium
- 13. LEO Communication Satellite Constellation System Return Link Forward Link LEO LEO Satellite i Satellite i+1 Intersatellite Link (ISL) Orbital Altitude Feeder Feeder Terminal Terminal Downlink Uplink Downlink Uplink Gateway End User Terminal PSTN Cellular
- 15. TDMA (Time Division Multiple Access) f1 Transponder f1 f1 f1 f1
- 16. Timeframe Structure and Timeslots 1 hyperframe = 4,896 superframes = 19,584 multiframes = 313,344 TDMA frames (3h 28mn 53s 760ms) 0 1 2 3 4892 4893 4894 4895 1 superframe = 4 multiframes = 64 TDMA frames (2.56s) 0 1 2 3 1 multiframe = 16 TDMA frames (640 ms) 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 1 TDMA frame = 24 timeslots (40ms) 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 1 timeslot = 78 bit durations (5/3ms) 1 bit duration = 5/234ms
- 17. CDMA (Code Division Multiple Access) ++++++++++++++++++++++++++++++++++++++++++ xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx oooooooooooooooooooooooooooooooooooooooooo ------------------------------------------ Transponder f1 f1 f1 f1
- 21. Spotbeams: Regional Coverage E F D A L G C B K H J E E E E E I F D F D F D F D F D A L A L A L A L A L G C G C G C G C G C B K B K B K B K B K H J H J H J H J H J E I E I E I E I E I E F D F D F D F D F D F D E A L A L A L A L A L A L D G C G C G C G C G C G C A L B K B K B K B K B K B K C H J H J H J H J H H J J B K I E I E I E I E I E I J F D F D F D F D F D I E A L A L A L A L A L F D G C G C G C G C G C A L B K B K B K B K B K G C H J H J H J H J H J B K I I E I E I E I H J E F D F D F D I F D A L A L A L A L G C G C G C G C B K B K B K B K H J H J H J H J E I E I E E I E I F D F D F D F D F D A L A L A L A L A L E G C G C G C G C G C F D B K B K B K B K B K A L H J H J H J H J H J G C I I I E I E I B K E E F D F D F D F D H J A L A L A L A L I G C G C G C G C B K B K B K B K H J H J H J H J I I
- 22. GMR (GEO-Mobile Radio Interface)
- 23. GSM GMR Release 1 Extension to Satellite GPRS GMR Release 2 Evolution Path 3GPP GMR Release 3
- 24. GMR-1
- 25. GMR-1 System Elements Space segment Feeder links Gateway Station Spotbeam coverage at L-Band GS SOC PSTN Mobile Earth Stations Gateway Stations
- 26. GMR-1 Protocol Architecture Satellite MES GSC + GTS + GSM MSC TCS GMR-1 Um-Interface CM CM GSM SIM MM MM RR RR BSSMAP BSSMAP GPS RECEIVER DLL DLL SCCP SCCP PHYS PHYS MTP MTP PHYS PHYS Spotbeams Feeder Link GSM/A-Interface L-Band Ku or C-Band (CCS7)
- 27. GMR-1 Logical Channel Mapping onto Physical Channel DOWNLINK LOGICAL PHYSICAL PHYSICAL CONTROL ENTITIES CHANNELS CHANNELS RESOURCE USER CHANNELS MAPPING TCH Timeslot Frequency Traffic Number (RF Channels) TDMA Frame Sequence CCH Time Control and RF Channel (Timeslots) Signalling UPLINK MOBILE EARTH STATION SATELLITE
- 28. GMR-1 (GSM-based) Services • Standard GSM-based services (Phase 2) • Roaming • Single number routing • Numbers and addressing • Authentication and privacy
- 29. GMR-1 Extended Services • Single-hopped terminal-to-terminal calls • Optimal routing • High penetration alerting • Position based services
- 30. GMR-2
- 31. GMR-2 System Elements Traffic GEO Satellite Signalling C-Band L-Band Gateway 1 C-Band C-Band C-Band PSTN User Terminals PN Gateway 2 PLMN Satellite Control Facility PSTN Gateway 3 PN Network Control Centre PLMN PSTN PN Customer Management Information System PLMN
- 32. C-band Regional Coverage for Signalling & Communication C-Band Traffic Signalling
- 33. L-band Spotbeams for MSS Users E F D A L G C B K H J E E E E E I F D F D F D F D F D A L A L A L A L A L G C G C G C G C G C B K B K B K B K B K H J H J H J H J H J E I E I E I E I E I E F D F D F D F D F D F D E A L A L A L A L A L A L D G C G C G C G C G C G C A L B K B K B K B K B K B K C H J H J H J H J H H J J B K I E I E I E I E I E I J F D F D F D F D F D I E A L A L A L A L A L F D G C G C G C G C G C A L B K B K B K B K B K G C H J H J H J H J H J B K I I E I E I E I H J E F D F D F D I F D A L A L A L A L G C G C G C G C B K B K B K B K H J H J H J H J E I E I E E I E I F D F D F D F D F D A L A L A L A L A L E G C G C G C G C G C F D B K B K B K B K B K A L H J H J H J H J H J G C I I I E I E I B K E E F D F D F D F D H J Traffic A L A L A L A L I G C G C G C G C Signalling B K B K B K B K H J H J H J H J I I
- 34. GMR-2 Gateway Internal Structure Databases HLR & VLR GA RF/IF TCE GSC MSC PSTN GA Gateway Antenna TCE Traffic Channel Equipment PN GSC Gateway Station Controller MSC Mobile Switching Center GSM
- 35. GMR Satellite Monitoring System Intercept ing
- 36. Satellite Phone Interception • Law-enforcements require tapping • Test equipment • Limited use of encryption • Modifiable phone equipment
- 37. Tactical Interception Receives L-band from satellite and line-of- sight from handset Strategic Interception Receives L-band from satellite and C-band from satellite
- 38. Satellite Interception Operation 1.5 GHz DOWN 1.6 GHz UP 6 GHz UP 3.5 GHz MES DOWN Gateway
- 39. Tactical Satellite Interception Operation 1.5 GHz DOWN 1.6 GHz UP 6 GHz 1.5 GHz UP DOWN 3.5 GHz MES DOWN 1.6 GHz RADIO LINE-OF-SIGHT Gateway Monitoring Agent
- 40. Tactical Satellite Interception Operation Satellite antenna Downconverter IF Channel 1 Channel 2 Uplink antenna
- 41. Call Analysis • Spotbeam IDs, GPS co- • TMSI called by MES. ordinates, operating frequency. • Mobile or Fixed Originated Call (Voice, Fax, Data or SMS). • Date, time and duration of call. • Terminal type. • MES IMSI. • Ciphering key sequence • GPS co-ordinates of MES. number. • Random Reference Number • RAND and SRES. (CallerID). • Encryption Algorithm
- 42. Strategic Satellite Interception Operation 1.5 GHz DOWN 1.6 GHz UP 6 GHz 1.5 GHz UP DOWN 3.5 GHz MES DOWN 3.5 GHz DOWN Gateway Monitoring Centre
- 43. FAQ
- 44. What’s next?