It shouldn't count as a vulnerability that you can get root of a device that you have physical possession of. If there's any real vulnerability here, it's that having root of your terminal gives you any extra privileges to the rest of the network.
E.g.
You may want to protect end users against implants and other attacks from physical tampering with their terminals.
You might not want hostile parties to have an easy time reverse engineering terminals so they can more easily search for remote vulnerabilities in the terminals.
You may not want to hand hostile parties a phased array optimized to transmit to Starlink running arbitrary software of their choice, along with keys identifying the terminal, because even though you think the satellites and authentication mechanisms are robust, making it hard to get this information adds defense in depth.
So, if you make things harder and someone comes along that invests more effort to overcome, can you really call that a vulnerability? It'd be a real vulnerability if with this access to a user terminal they could elevate permissions on the satellites, but that hasn't been shown (yet?).
Yes. Just because executing the attack doesn't seem to get you anything particularly valuable doesn't make it "not a vulnerability."
We're not personally insulting it, we're just describing reality.
If it's hard enough that only state actors can potentially do it, then what does it matter in real life that it's theoretically vulnerable?
To put it another way, consider physical locks, which must inherently be able to resist direct physical tampering by an adversary. Under your definition, no flaw in a lock could be considered a vulnerability since any lock can eventually be cracked. The problem is that this doesn't provide us any useful insight, it just makes the word "vulnerability" useless. It's already well-known that any lock can eventually be cracked, but tradeoffs still have to be made in deciding which lock to use for a certain situation.
Yes? This is defense in depth. Anything that bypasses a defense is still a vulnerability, even if your backup defenses protect you.
Defending physical hardware is indeed a theoretical impossibility as on paper, it will always be possible to make a perfect electrical clone of the original hardware and then modify it to suit. However, reality is different, and mitigations against physical access have become much more effective in recent years (iPhone anti-jailbreaking and the Xbox One come to mind as fairly successful).
So, this is a vulnerability indeed, just not a high severity one. One layer of the defenses are bypassed, but the remaining defenses remain.
https://en.wikipedia.org/wiki/Defense_in_depth_(computing)
For the same reason, security-by-obscurity is also a valid (though not sufficient) tactic for one of those layers (which also surprises people).
Its about delay and demotivation to slow down your attackers.
That said it is a clever approach and it’s good it was discovered by someone without nefarious intentions.
See mobiles like iPhones, gaming devices like XBox, Playstation etc. authenticators like chipcards or security token and HSM. All have to asume that the attacker has physical access to the device.
Security Engineering Ch. 16 "Physical Tamper Resistance" is a good read for some special classes of devices. But I would recommend all topics from this book even unrelated to this thread. ;)
All in all there are plenty of devices in the world that are protected against physical access, so if Starlink tried doing that and failed, then that's definitely through an exploited vulnerability.
Have they? I know Apple an Nintendo have been trying for years and we have jailbreak and Homebrew, I believe there is even jailbreak for nintendo switch.
If there isn't yet an exploit to gain root on Xbox and PS5, it's only a matter of time.
Xbox One didn't have a root exploit for its entire lifetime and counting. It was released back in 2013. That's nine years. So one could say MS "solved it".
I don't know if they really "solved" it. I think the appetite for new hacks dwindled with broadband internet everywhere and streaming services.
Cat doesn't care for the mouse so much when there's kibble everywhere.
https://en.wikipedia.org/wiki/Conditional_access#Digital_sys...
EDIT: More than that, some recent ones even solved so called 'card sharing' which is basically using a legitimate card to transmit control words over network to many users.
And as an example satellite TV providers did it (or acquired a license for it). If you're saying that incentives to hack them aren't there anymore, then that's just wrong because the foundation on which such security is based on affects many things.
Declining popularity of SatTV as a whole in a particular country is neither here, nor there. If a hacker mentioned in the article could hack a CA system, he would've.
This is different than a Starlink base station. Base stations aren't built to be hardened against a physical attacks, and are rather intended to be untrusted links to the satellites.
So it's kind of in a grey area, but I would also not consider this a vulnerability of the Starlink base station itself, in the same way that rooting an iPhone with physical access would be a vulnerability.
> Curious why an iPhone hasn't been susceptible to this type of hack before?
The answer is probably, "it's complicated." These sort of hardware hacks are quite clever, and typically depend on using chips in unintended ways -- I mean most circuits will have some undefined behavior if you start shorting parts!
There are lots of reasons an iPhone might not get a widely popularized exploit like this. Firstly it might be low-priority -- iPhones are general purpose computing devices, so there are usually software bugs for people who want to root their iPhones. Second, it might legitimately be more difficult. Apple has lots of experience in hardware, their circuits might be more robust. And iPhones are quite tightly integrated, it might be hard to sort out which parts you need to short when everything is on a handful of chips.