The most suitable group of people to review this topic would be Senior Cybersecurity Analysts specializing in Critical Infrastructure and Satellite Communications.
Abstract
This presentation details a comprehensive security audit of Geostationary Earth Orbit (GEO) satellite communications utilizing passive observation techniques with commercial off-the-shelf (COTS) hardware. The research, conducted by UC San Diego, successfully intercepted and analyzed a large volume of unencrypted data broadcast over continental-scale transponder footprints (KU band).
Key findings reveal widespread security failures across multiple domains, including the exposure of:
Critical Infrastructure: Cleartext SCADA/DNP3 control commands and SNMP network configuration data (including passwords) for major US utility providers (e.g., PG&E).
Telecommunications Backhaul: Unencrypted raw voice call audio, SMS content, and session keys originating from remote cellular towers and VoIP services (e.g., T-Mobile, Telmex).
Government and Military: Unencrypted asset tracking (GPS coordinates for ships and helicopters) for foreign militaries (Mexico) and sensitive VOIP traffic linked to US defense agencies.
Financial Data: Unencrypted credit card numbers and Electronic Benefits Transfer (EBT) transaction details.
The pervasive lack of encryption is attributed to a combination of economic disincentives (encryption sold as a costly add-on), technical overhead (up to 30% bandwidth loss), and a systemic failure among highly regulated organizations to audit and control security configurations within complex commercial satellite service contracts. Successful disclosures led to remediation in several critical cases.
Passive Observation of Unencrypted GEO Satellite Traffic
0:16 Research Overview: The project utilized consumer-grade satellite dish equipment installed at UC San Diego to passively observe and record data transmitted from geostationary satellites across the visible arc.
1:47 GEO Satellite Context: Geostationary satellites (approximately 590 active) function as "bent-pipe" repeaters, lacking on-board encryption or decryption capability. Their large transponder footprints (e.g., continental North America) mean unencrypted data is broadcast to a massive, passive adversary pool.
5:26 Hardware Procurement and Setup: The study utilized inexpensive COTS KU-band equipment, including a dish, LNB, and a non-tracking motor. The primary receiving component was a specialized tuner card, now confirmed to be out of production following the paper's publication.
7:50 Alignment and Targeting: Achieving precise alignment proved challenging, requiring the use of augmented reality tools and Software Defined Radio (SDR) analysis of signal strength. The dish sweep was calibrated to the geostationary arc.
9:07 Satellite Identification Methodology: Specific satellites were identified either by running the strings utility on the raw downlink (which sometimes revealed satellite names and orbital parameters, e.g., AMC3) or by cross-referencing observed TV channel listings against public data.
10:49 Data Processing Challenge: Initial data capture was heavily filtered for television formats. A key discovery was finding and disabling a deep, obscure filter setting in the commercial tuner software, which allowed for the capture of raw IP and network data.
13:17 Protocol Parsing: Custom Python parsers (dissectors) were developed to translate the raw stream into Wireshark-compatible pcap files, necessary due to non-standard or proprietary implementations of DVB-S2 and GSE protocols.
15:52 Encryption Adoption Rates: Analysis showed that only 6% of observed transponders employed ubiquitous network-layer encryption, typically via IPSec tunnels. While HTTPS successfully encrypted most end-user web browsing, critical infrastructure and government data frequently lacked protection.
16:46 In-Flight Wi-Fi Vulnerabilities: Traffic from two major in-flight Wi-Fi vendors (Intelsat, Panasonic) exposed cleartext DNS queries and hostnames, including endpoints related to crew software. The vendors categorized the risk as comparable to "cafe Wi-Fi."
19:33 Cellular Backhaul Exposure: Unencrypted control plane data (session keys) and user plane data (raw audio/RTP packets from phone calls, SMS) were observed from cell towers relying on satellite backhaul (e.g., T-Mobile US). T-Mobile's traffic was found within an IPSec tunnel configured with a null cipher.
22:29 Telmex Status: VoIP traffic from Telmex (Mexico's largest phone provider) was observed unencrypted, including call setup (SIP) and raw voice data. Despite disclosure attempts, the cleartext data remains broadcast.
24:10 Military and Government Data: Mexican military systems were observed broadcasting unencrypted asset location updates (GPS coordinates). US government traffic included unencrypted VOIP destined for a Navy base city, linked to a specific Inmarsat Government provider. Both issues were remediated post-disclosure.
26:44 Critical Infrastructure SCADA: PG&E's internal network traffic was observed unencrypted, including SCADA (DNP3) commands and SNMP network configuration data containing community strings (passwords). PG&E was responsive and promptly encrypted the data.
28:36 Payment System Leakage: The service provider Sagenet was found broadcasting unencrypted credit card numbers, EBT (food assistance) transaction details, and balances. Sagenet subsequently encrypted their traffic.
29:22 Systemic Causes for Non-Encryption: The lack of encryption is driven by economic and technical factors: (1) Encryption reduces bandwidth efficiency (up to 30% overhead by preventing compression and adding headers); (2) Providers historically charged encryption as a premium add-on; (3) Organizations had insufficient visibility to audit their complex network configurations, leading to accidental plaintext transmission.
31:09 Threat Model Update: The findings necessitate an update to telecom threat models to include passive, continent-wide eavesdropping resulting from service providers treating satellite backhaul as a trusted, transparent extension of their internal, unencrypted networks.