Hacker News Reader

Comment by AYBABTME | Hacker News Reader

This reads to me like the (more complicated but ultimately) equivalent of "a user reverse engineers the website's javascript!". As in, this allows the user to mod their client but it doesn't change anything for anyone else, and wasn't meant as a real secure element. I'd assume that getting root access to the user terminal gives them no additional privileges to access the actual Starlink data & control planes.

View on HN

It might allow them to do things like connect to the Starlink network outside of their geofence. Or hacking a stationary antenna to work on a moving vehicle.

> connect to the Starlink network outside of their geofence

I was wondering about that but can't they determine the location "server side" by triangulation? Or maybe they could in theory but they don't in practice?

Knowing the positions of all the clients and satellites is a basic requirement for operating the network.

For the satellites this is true, but it's not necessary for the clients to be geolocated when the satellite is operating as a bent pipe. Starlink will know which clients are in which footprint and can locate anybody if they want to, but it's not fundamental to the functionality of the system.

Both the client and the satellite use beam forming. The signal is pointed at you in a relatively narrow beam not broadcast spherically. They have to know where you are to point at you (phased array antennas so electronic not physical pointing)

I'm not too familar with the low-level details of the Starlink network, but in the slides of the talk it's shown that the dish contains a GPS receiver, so isn't it possible that the client tells the satellite its location on first contact?

GPS is the cheap, easy, and more accurate method of finding and determining location. Time sync is also an important part of satellite communication.

They could effectively reimplement GPS or an equivalent location tech with their network but why when a high quality positioning solution already exists.

They will be continually syncing time and position data for the orbits of satellites and positions of clients. (static clients obviously don't need this often outside of timekeeping, but you can set up a mobile plan for RVs, boats, etc which obviously move a lot)

There is a paper out there where someone demonstrates that it would take 1.6% of constellation downlink capacity for StarLink to serve as its own GNSS. As you mention, the GPS network is very high quality, and would only make sense in areas where GPS was undeserving or active denial was expected (and StarLink had the capability to avoid jamming).

Edit: I misrecalled. StarLink can provide 10x more precise positioning than GPS.

https://www.telecomstechnews.com/news/2020/sep/28/starlink-s...

https://arxiv.org/abs/2009.12334

You'd also have to do it, though.

Build it, maintain it, rely on it.

Alternatively you could just embed a cheap GNSS chip and let other people build and maintain it.

> I misrecalled. StarLink can provide 10x more precise positioning than GPS.

GPS can also provide much more precise positioning than it does for consumers. There are encrypted bands used for military, etc with significantly better specs.

I don't think that's true anymore. iirc, the accurate bands were made public in the 80s

You might be thinking of Selective Availability (which limited accuracy on purpose) being turned off in 2000.

The GPS is probably used to get the current time and location to orient the dish to the best satellite using ephemeris. Also the accurate time is needed in telecommunications for Time Division Multiple Access (TDMA) and maybe they have an internal GPS disciplined oscillator to transmit at precise frequencies.

If you trick the satellite into thinking you're somewhere you're not, then it won't point the beam at you and you won't get any service.

How accurate does the location have to be in terms of radius? A few centimeters? A few meters?

If you trick it into thinking you're a few metres away from your true location then you're not evading any geofence that you couldn't trivially evade simply by moving a few metres.

Would this negatively affect the network? My understanding is that it would make your device less reliable. This is simply a warranty voiding event.

It would in the same sense as illegally attaching a wire to the power cables and drawing electricity out of them does. You're stealing a limited resource (in this case radio bandwidth in an region for which you haven't purchased it, in the analogy power), but you're not doing so any more than a legitimate user would be assuming it's done "properly".

If too many people do this, things stop working, because you exhaust the limited resource.

If it gives you direct/raw access to the control plane, you then may be able to launch denial of service and other attacks that would negatively impact the network and other terminals. I don't know anything about the Starlink protocol, but a rough Ethernet analog might be an ARP attack/flood.

That’s like saying you can hack 5G because you can root your phone.

Not rooting your phone, but hacking the baseband. And since we're talking about disassembling devices and performing low voltage attacks to reveal secrets, I would draw the analog to baseband hacking.

https://resources.infosecinstitute.com/topic/how-to-hack-mob...

...found a vulnerability (CVE-2022-20210) that can be abused to disrupt the device’s radio communication via a malformed packet causing a DoS condition. This vulnerability allows attackers can neutralize communications in a specific location.

Reply on news.ycombinator.com