April 18, 2014, 1:20 PM — Security researchers have found that many satellite communication systems have vulnerabilities and design flaws that can let remote attackers intercept, manipulate, block and in some cases take full control of critical communications.
Between October and December last year, researchers from IOActive analyzed the firmware of popular satellite communications (SATCOM) devices that are used in the military, aerospace, maritime, critical infrastructure and other sectors. The research covered products manufactured or marketed by Harris, Hughes Network Systems, Cobham, Thuraya Telecommunications, Japan Radio Company (JRC) and Iridium Communications. The analysis focused on SATCOM terminals that are used on ground, in the air and at sea, not satellite communications equipment in space.
"IOActive found that all devices within the scope of this research could be abused by a malicious actor," the IOActive researchers said in a report published Thursday. "We uncovered what would appear to be multiple backdoors, hardcoded credentials, undocumented and/or insecure protocols, and weak encryption algorithms."
"These vulnerabilities allow remote, unauthenticated attackers to compromise the affected products," the researchers said. "In certain cases no user interaction is required to exploit the vulnerability; just sending a simple SMS or specially crafted message from one ship to another ship would be successful for some of the SATCOM systems."
For example, vulnerabilities that IOActive claims to have found in mobile Harris BGAN terminals would allow attackers to install malicious firmware or execute arbitrary code. Such terminals may be used by the military to coordinate attacks between different units and are common within the forces of the North Atlantic Treaty Organization (NATO), the researchers said.
In an attack scenario described by the IOActive team, malware running on a laptop connected to a BGAN terminal could inject malicious code into the device that would use its GPS to monitor its geographic location.
"This would allow the attacker to compare the systems position with a fixed area (target zone) where an attack from enemy forces is planned," the researchers said. The code could then disable communications from the device when it enters the target zone, hindering the ability to call for support or organize a counter-attack, the researchers said.
The Hughes BGAN M2M terminals, which are used in the utilities, oil and gas, retail banking and environment monitoring sectors, also contain vulnerabilities that could allow attackers to perform fraud, launch denial-of-service attacks, cause physical damage and spoof data, according to IOActive. These satellite user terminals can be controlled remotely via SMS messages, the company's researchers said.