An in-depth treatment of satellite telephony networks from a security perspective. The overall system seems secure, but in reality, it cannot be expected to be fully reliable.
Internet Teleport Corporate Data Networks (Interactive & Multicast) Direct Broadcast TV Last-mile Broadband Broadcast Video to Cable Headends Satellite Communications
Existing Satellite Systems Warezzman DVB Satellite Hacking Jim Geovedi, Raditya Iryandi, Hacking a Bird in the Sky: Hijacking VSAT Connection Jim Geovedi, Raditya Iryandi, Anthony Zboralski Hacking a Bird in the Sky: Exploiting Satellite Trust Relationship Adam Laurie $atellite Hacking for Fun & Pr0fit! Leonardo Nve Egea, Christian Martorella Playing in a Satellite Environment 1.2 Jim Geovedi, Raditya Iryandi Hacking Satellite: A New Universe to Discover 1996 1998 2004 2006 2008 2009 2011 Jim Geovedi, Raditya Iryandi, Raoul Chiesa Hacking a Bird in the Sky: The Revenge of Angry Birds Jim Geovedi Satellite Telephony Security: What Is and What Will Never Be
35,786 km Low Earth Orbit Altitude: 500-2,000 km Medium Earth Orbit Altitude: 8,000-20,000 km Highly Elliptical Orbit Altitude: >35,786 km Satellite Orbits
Forward Link Intersatellite Link (ISL) Orbital Altitude Gateway PSTN Cellular End User Terminal LEO Satellite i+1 LEO Satellite i LEO Communication Satellite Constellation System
K L G B A F E C D H I J K L B A E C D I J K L Spotbeams: Regional Coverage G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L
GSM MSC GSM SIM GPS RECEIVER CM MM RR DLL PHYS PHYS PHYS RR DLL PHYS BSSMAP SCCP MTP CM MM BSSMAP SCCP MTP GMR-1 Um-Interface Spotbeams L-Band Feeder Link Ku or C-Band GSM/A-Interface (CCS7)
EARTH STATION SATELLITE LOGICAL CHANNELS PHYSICAL CHANNELS TCH Traffic Timeslot Number TDMA Frame Sequence RF Channel CCH Control and Signalling Frequency (RF Channels) Time (Timeslots) PHYSICAL RESOURCE UPLINK DOWNLINK CONTROL ENTITIES MAPPING
K L G B A F E C D H I J K L B A E C D I J K L L-band Spotbeams for MSS Users G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L G B A F E C D H I J K L Traffic Signalling
• Date, time and duration of call. • MES IMSI. • GPS co-ordinates of MES. • Random Reference Number (CallerID). • TMSI called by MES. • Mobile or Fixed Originated Call (Voice, Fax, Data or SMS). • Terminal type. • Ciphering key sequence number. • RAND and SRES. • Encryption Algorithm