Nve isn't the first to show the vulnerability of supposedly secure satellite connections. "It's easier not to have encryption at the DVB layer." "Each can have its own law for crypto," says Nve. That lack of simple security, he says, stems from the logistical and legal complications of scrambling the signal, which might make it harder to share data among companies or agencies and-given that a satellite signal covers many countries-could run into red tape surrounding international use of cryptography. What makes his attacks possible, Nve says, is that DVB signals are usually left unencrypted. But he says there's little doubt that the same tricks would work on satellites facing North America or anywhere else. The Barcelona-based researcher tested his methods on geosynchronous satellites aimed at Europe, Africa and South America. In his tests on the client's network, Nve says he was also able to hijack signals using GRE or TCP protocols that enterprises use to communicate between PCs and servers or between offices, using the connections to gain access to a corporation or government agency's local area network. That allows him to replace a Web site that a user navigates to directly with a site of his choosing, creating the potential for undetectable cybercrime sites that steal passwords or installs malicious software. Nve also reversed the trick, impersonating Web sites that a satellite user is attempting to visit by intercepting a Domain Name System (DNS) request-a request for an Internet service provider (ISP) to convert a spelled out Web site name into the numerical IP address where it's stored-and sending back an answer faster than the ISP. In a penetration test on a client's network, Nve used a Skystar 2 PCI satellite receiver card, a piece of hardware that can be bought on eBay ( EBAY - news - people ) for $30 or less, along with open source Linux DVB software applications and the network data analysis or "sniffing" tool Wireshark.Įxploiting that signal, Nve says he was able to impersonate any user connecting to the Internet via satellite, effectively creating a high-speed, untraceable anonymous Internet connection that that can be used for nefarious online activities. "Anyone can do it: phishers or Chinese hackers … it's like a very big Wi-Fi network that's easy to access." "What's interesting about this is that it's very, very easy," says Nve. And while that's not a particularly new trick-hackers have long been able to intercept satellite TV or other sky-borne signals-Nve also went a step further, describing how he was able to use satellite signals to anonymize his Internet connection, gain access to private networks and even intercept satellite Internet users' requests for Web pages and replace them with spoofed sites. Using less than $75 in tools, Nve, a researcher with security firm S21Sec, says that he can intercept Digital Video Broadcast (DVB) signals to get free high-speed Internet. In a presentation at the Black Hat security conference in Arlington, Va., Tuesday, Spanish cybersecurity researcher Leonardo Nve presented a variety of tricks for gaining access to and exploiting satellite Internet connections. But in beaming data to and from the world's most remote places, satellite Internet may also offer its signal to a less benign recipient: any digital miscreant within thousands of miles. Satellites can bring a digital signal to places where the Internet seems like a miracle: off-the-grid desert solar farms, the Arctic or an aircraft carrier at sea. A Spanish researcher demos new satellite-hijacking tricks with cybercriminal potential.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |