White Hat Hackers Expose Iridium Satellite Security Flaws | Hacker News Reader

White Hat Hackers Expose Iridium Satellite Security Flaws

spectrum.ieee.org

134 pointsBrajeshwar30 comments

I was once offered an engineering manager position at iridium (which i discussed here https://news.ycombinator.com/item?id=41748519)-- that entire company is a race to reduce the bottom line. They offered me (an engineering manager to 5 engineers) a lower salary than I was offered as a new grad. Also their talent pipeline is quite stale, most of the engineers on my prospective team were at the org for 10-20 years. For such an interesting aspect of technology, it's ashame they can't attract more talent, such an untapped market low earth orbit satellite networks are...

Iridium, that is a name I've not heard in a long time.

IMHO, the worst places to be are organizations that were supposed to change the world, but didn't, and don't quite get it.

Your experience totally tracks with that.

They set up global satellite communications over 20 years ago. They did change the world.

This seems like it should be totally expected. Iridium's engineering efforts are largely in the past, they're purely in the revenue extraction mode at this point. Your job description is basically just "maintain obsolete legacy system just enough to make money."

Sadly I expect them to be at the stage of no relevance. Just enough that as another commenter said it could make some money but satellites have no business value.

Their value is the niche of being able to work at the poles, unlike any other constellation, despite being dialup speed.

But how can you translate that to dollars today?

Starlink ate Iridium's lunch. Any benefits Iridium was supposed to provide are currently achieved by Starlink.

Maybe specialty hardware? Are there handsets yet which can connect to starlink?

iPhone, most notably.

Starlink Direct to Cell is not available yet

I have it on my Pixel 9 Pro XL right now and have had it since the end of January. Worked well so far for me in the country where Tmo typically has had dead spots, if not a little slow.

https://i.imgur.com/wrl5KLf.png

That is just texting though, not voice or data.

Let's not move goalposts. It's still undeniably both "Starlink" and "Direct To Cell," so I would say that Starlink Direct To Cell is indeed available.

Moving the goalposts? The point I was refuting was "Any benefits Iridium was supposed to provide are currently achieved by Starlink", but Iridium offers services today which StarLink does not.

Is it 5G only or does LTE also work?

It's only for texting so it doesn't really matter. That said Iridium is so slow it's mostly only useful for texting type situations as well. Even the voice is so heavily compressed and laggy as to be mildly unpleasant to use.

Much more than iPhone. From Tmobile's FAQ [0]:

Apple iPhone 14 and later (including Plus, Pro & Pro Max), Google Pixel 9 (including Pro, Pro Fold, & Pro XL), Motorola 2024 and later (including razr, razr+, edge and g series), Samsung Galaxy A14, A15, A16, A35, A53, A54, Samsung Galaxy S21 and later (including Plus, Ultra and Fan Edition), Samsung Galaxy X Cover6 Pro, Samsung Galaxy Z Flip3 and later, Samsung Galaxy Z Fold3 and later and REVVL 7 (including Pro)

[0] https://www.t-mobile.com/coverage/satellite-phone-service?ic...

Iridium and other satellite companies also went bankrupt and their satellites were going to be de-orbited until the US Government bailed them out in the 2000s. They couldn’t get enough customers to support enough launches.

Terrestrial networks in the meantime have only gotten better and improved coverage. Not that many customers, relatively, need satellite comms.

Now SpaceX is eating their lunch.

I don’t think the market for satellite comms has ever been big enough for a pure-satellite company to get enough money to do something cool. SpaceX can afford the R&D because they are a little more diversified.

> They couldn’t get enough customers to support enough launches.

No surprise, the only usecases back then for the price that Iridium and others commanded were SAR, a few military/secret service style use cases and execs who deem themselves to be of such importance that they need to be reachable on the globe 24/7 even if they are just taking a flight over the Atlantic or on a cruise ship, and Iridium can't be reasonably used for much more than that.

> Now SpaceX is eating their lunch.

Partially due to physics. Latency on Starlink is reportedly low enough to run online games or telephony and the bandwidth high enough to allow for video streaming in the outback, which makes the potential market size muuuuch bigger so the price point can be lowered enough to be competitive with landline DSL of all things.

The problem is, SpaceX isn't something that the US government can rely on forever. For now, its leader is in good standing with the 47th, but that may change overnight (it has happened with either of these characters before and both have quite the large egos that will collide rather sooner than later). And what to do then?

>Now SpaceX is eating their lunch. Fact Check Time! Iridium stock jumped 15% today, because their 4Q earnings vastly beat expectations. They earned $0.31 per share versus expectations of $0.16 Their Revenue grew 9% Year over Year to $213 million

"Eccentric Orbits: The Iridium Story" by John Bloom is a must-read for anyone remotely interested in satellites, communication networks, or corporate management. The project achieved several outstanding engineering feats, then fumbled into an almost unrecoverable position, then rose from the ashes into the small niche it holds today.

Plus, "Early calculations showed that 77 satellites would be needed, hence the name Iridium", is an eternally cool piece of trivia.

I concur: was a very good read! Can wholeheartedly recommend.

My guess is, that similar flaws have been known and exploited for ages. I doubt that iridium was ever truly safe to begin with. I was recently looking into renting an iridium satellite modem and while doing so, I found a pdf on some shady private intelligence agencies website that documented a tool to intercept calls and messages as well as locating users of the network. The screenshots looked like a late 90s, early 2000s windows ui and talked about special radio equipment that the tool interfaces with.

Search for "Iridium Interception System reference manual pdf"

> I found a pdf on some shady private intelligence agencies website that documented a tool to intercept calls and messages as well as locating users of the network. ... Search for "Iridium Interception System reference manual pdf"

This? https://pegasusintelligence.com/docs/iridium-monitoring-syst...

> The screenshots looked like a late 90s, early 2000s windows ui and talked about special radio equipment that the tool interfaces with.

Mid-2000s. A lot of them have dates, and they're all Jan/Feb 2007.

This has been known for a while. You can buy the RTL-SDR Blog antenna on Amazon:

1. https://www.amazon.com/RTL-SDR-Blog-1525-1637-Inmarsat-Iridi...

2. https://www.youtube.com/watch?v=V_jDTs79kq8

3. https://www.youtube.com/watch?v=PKO8hgtJUZ0

4. https://www.youtube.com/watch?v=2-mPaUwtqnE

5. https://www.rtl-sdr.com/talk-decoding-data-from-iridium-sate...

I assume the article is based on this presentation at 38c3: https://media.ccc.de/v/38c3-investigating-the-iridium-satell...

As Sec said in 2015, "The problem isn't that Iridium has poor security. It's that it has no security."

  >Users' locations and texts can be intercepted, including DoD employees

Leaking DoD operator locations? Yikes!

If this was Starlink, you're kidding yourself if you think this wouldn't be dominating an entire news cycle, and then transition into an endlessly repeated mob refrain.

Since it's not, I expect crickets.

I yearn for the old days when the default media slant and popular reach of tech news wasn't merely a function of its proximity to Elon Musk.

Starlink has 4.6 million users, an extremely rapid growth rate, and an outspoken owner who’s currently in the news for causing what amounts to a massive cybersecurity breach. Iridium has fewer than half as many users and it and its leadership are not household names.

Reply on news.ycombinator.com