Re: WP: Russian military behind hack of satellite communication devices

Point to multipoint / TDMA contended access VSAT hub and CPE networks are well known for not having much security. In many setups the remote CPE modems, which are built from a fairly cheap BOM of hardware, implicitly trust the hub linecard. Have seen this with 3 different vendors’ platforms.

I’d be willing to bet that this was either a malicious firmware push that was applied to the CPEs without proper authentication methods being in place, such as CPEs being able to verify a crypto key signed firmware signature, or a configuration file pushed to the CPEs that knocked them off the network with incorrect RF/channel/modulation/timing parameters.

Note that the Viasat KA-SAT terminals are at the very lower end of the market for contended access (64:1 or more) consumer/small business grade geostationary VSAT. Which is why it sort of makes sense that a lot of them were used for low data rate SCADA for wind farms and such.

“The terminal management network … that manages the KA-SAT network, and manages other Eutelsat networks—that network was penetrated,” said one Viasat official. “And from there, the hackers were able to launch an attack against the terminals using the normal function of the management plane of the network.”


The attack compromised the management plane—the part of the network that controls customer terminals to ensure they can communicate with the satellite, the Viasat officials said. The hackers had abused that functionality to change the software configuration on the terminals and render them inoperable.

But, contrary to some early reports, the attack did not brick the terminals. “It did not make them permanently inoperable,” said the second official. “Every single terminal that was knocked off the air can be brought back with a software update.” Although the network is generally capable of updating terminals over the air, by downloading new software via the satellite link, many of the terminals attacked cannot be brought back online by the customer, and so can’t get the required update over the air. Those will have to be updated by tech support staff, the first official said.

Despite this, Viasat was now bringing “thousands of terminals back online per day, and will have the network completely restocked and back to full capacity within a few weeks,” the first official said.

Editor’s Note: This story was updated at 3:15 p.m. on March 25 to correct some technical issues with how the KA-SAT network and other assets were described