I don't understand how this works. The article doesn't go into much depth.
They listen on data coming from a satellite for certain IPs, then connect to those IPs directly? How does that allow two-way communication?
They listen on data coming from a satellite for certain IPs, then connect to those IPs directly? How does that allow two-way communication?
1. Infected system sends packets to a decoy
2. The decoy ignores the fake packets (dropped by firewall)
3. The real command center which is located in the same region as the decoy accepts the packets [1]
4. Real command center can still send commands to infected system via landline, but receive data by satellite.
[1] Satellite downlink data is sent to a relatively large area.
As far as anyone can tell they are John, but when you go to John's house to shut down the C&C server you end up at a dead end.
2) How does the C&C server complete the request. Are the hanging ports on the victim's side?
3) If the C&C server completes the connection, how do they carry on talking? Just like spoofing IPs, you can't ever get a reply. Or do they do the John decoy thing for every packet?
2) The C&C just responds over regular land-line. (Since the satellite service is download-only, this isn't any different from the service's normal clients.)
3) The reply keeps coming back over satellite and they keep grabbing it?
I'm assuming that because the sat system broadcasts unencrypted, you can sniff all the packets for all hosts on that network just like you can on a wifi network with the proper promiscuous mode receiver. An unencrypted shared broadcast medium.
So packet flow is routed inbound from victim as such
(victim SYN to decoy IP) to (internet) to (sat broadcast to geographic area decoy and attacker C&C)
But packet flow outbound from C&C to victim is handled differently via landline
(spoofed decoy IP) to (landline/internet) to (victim)
So packets come in via sat link but go out via spoofed source on a landline.