Hacker News Reader

Comment by tg180 | Hacker News Reader

The article compares the Russian jamming of Viasat with the compromise of a Starlink UT. No, no, no... This is really wrong!

> As is typically the case with any technology, the increase in use and deployment of Starlink and other satellite constellations also means that threat actors have a greater interest in finding their security holes to attack them.

> Indeed, Russia saw an advantage in taking out a satellite providing internet communications across Europe by attacking its technology on the ground as Russian troops entered Ukraine on Feb. 24.

Viasat orbits at 22,000 miles, Starlink is in LEO. Precisely for this reason Starlink is naturally more resistant to jamming, and is used in Ukraine because of this.

Locally compromising a UT is a hack of an endpoint connection device, which has nothing to do with ELINT and electronic warfare activities (which is an entirely different kind of attacks for satellite networks).

View on HN

The attack on Viasat was not related to it's GEO vs LEO situation, or blocking signals, it was an attack specifically on the consumer device to disable them

https://www.viasat.com/about/newsroom/blog/ka-sat-network-cy...

There's no reason that Starlink is any less susceptable to that. The attackers got into a terminal management network and issued various commands to shut down the endpoints. There's no reason an LEO constellation is more or less susceptible to this type of attack than a GEO system.

Viasat attack was by hacking ground terminals, not jamming satellites.

The Russian approach is hybrid: in addition to the use of jamming (they use Divnomorye, Leer, Moskva, Krasukha, ...), traditional hacking is used to extend the damage range beyond what can be obtained through pure electronic warfare.

In the case of Viasat they had access to a badly configured VPN appliance and used it to deploy on the terminals. Which is a classical case of network compromise, not a direct hack of the user devices.

Also considering this aspect the comparison is not there: it's a local access to the hardware vs an "I own your infrastructure and I'm able to deploy my firmware".

> Also considering this aspect the comparison is not there: it's a local access to the hardware vs an "I own your infrastructure and I'm able to deploy my firmware".

Yes, performing this reverse engineering requires physical access. But it potentially enables one to find further vulnerabilities and systems knowledge necessary to build attacks that brick network terminals or otherwise disrupt the network. Russia's action proves these attacks are viable and useful (even if an authenticated management vector was used).

Your original comment about the constellation height was a non-sequitur: we're talking about threat actors' attacks on end-user terminals. The article makes clear ("on the ground") that this is what it was referring to.

Yes, jamming, etc, are also useful attacks that threat actors use but not what we're talking about.

> The article compares the Russian jamming of Viasat with the compromise of a Starlink UT. No, no, no... This is really wrong!

This is a bit misleading. The article mentions the Viasat hack in the next-to-last paragraph of the article before the update in the context of satellite security more broadly:

> "As an increasing amount of satellites are launched—Amazon, OneWeb, Boeing, Telesat, and SpaceX are creating their own constellations—their security will come under greater scrutiny. In addition to providing homes with internet connections, the systems can also help to get ships online, and play a role in critical infrastructure. Malicious hackers have already shown that satellite internet systems are a target. As Russian troops invaded Ukraine, alleged Russian military hackers targeted the Via-Sat satellite system, deploying wiper malware that bricked people’s routers and knocked them offline. Around 30,000 internet connections in Europe were disrupted, including more than 5,000 wind turbines."

> Viasat orbits at 22,000 miles, Starlink is in LEO. Precisely for this reason Starlink is naturally more resistant to jamming, and is used in Ukraine because of this.

Orbit height is incredibly and completely irrelevant to the ease of breaking into systems...

Starlink by its nature of using phased array antennas are inherently pretty hard to jam through traditional means. Not impossible but more difficult than older systems with simpler antennas.

Buuuut.... If you wanted to jam starlink, then having full access to a terminal would be a really good start....

For example you could modify the terminal to transmit at the exact time another user is supposed to be transmitting, therefore clobbering their data and DoS-ing them.

The transmission schedule of exactly which user should be transmitting in which slots is probably transmitted with a single encryption key the terminal has access to.

Reply on news.ycombinator.com