HITB2011KUL - D1T2 - Jim Geovedi - Satellite Telephony Security - What Is and What Will Never Be

### Overview In this presentation at HITB2011KUL, speaker Jim Geovedi explores the security architecture and interception vulnerabilities associated with satellite telephony systems. Geovedi reviews the history of satellite hacking research and outlines the operational structure of satellite communication networks, comparing terrestrial cellular architectures to satellite radio interfaces. He demonstrates how satellite communications—particularly those adhering to GEO Mobile Radio (GMR) standards derived from GSM—can be monitored and intercepted via tactical and strategic approaches.

### Key Topics - **History of Satellite Research**: Evolution of satellite security research from early discussions in 1996 and 1998, to DVB satellite hacking by researchers like "Warmenh" (Warman) and Adam Laurie in 2009, leading up to GMR satellite phone systems. - **Satellite Orbits & Operators**: The technical differences and operational tradeoffs among Low Earth Orbit (LEO, 500–2,000 km, e.g., Iridium, Globalstar), Medium Earth Orbit (MEO, 8,000–20,000 km), and Geostationary Earth Orbit (GEO, ~35,000 km, e.g., Inmarsat, Thuraya, ACeS). - **Network Architecture & Standards**: GMR-1 and GMR-2 specifications based on GSM standards; multiplexing approaches including TDMA and CDMA; spot beam coverage dynamics compared to terrestrial GSM cells; and network gateway routing connecting to terrestrial networks (PSTN/PLMN). - **Monitoring & Interception Techniques**: Distinction between tactical mobile ground interception (line-of-sight L-band signals at ~1.5–1.6 GHz) and strategic passive gateway monitoring (intercepting satellite C-band downlinks at 3–6 GHz using 7–9 meter dishes).

### Technical Details - **Frequency Bands & Channels**: Handsets communicate with satellites over L-band frequencies (~1.6 GHz uplink, ~1.5 GHz downlink). Primary gateway Earth stations link with satellites using C-band frequencies (~6 GHz uplink, ~3 GHz downlink) and coordinate telemetry, tracking, and spot beam configurations. - **Encryption & Protocol Vulnerabilities**: GMR-1 and GMR-2 inherit cryptographic and signaling mechanisms from terrestrial GSM. Encryption protocols discussed include A5/1 (noted as crackable in seconds, and used for protecting initial signaling/location update/IMSI attach) and A5/2 for payload/data traffic. The talk highlights that because cellular and GMR protocol stacks have historically been proprietary and closed, auditing has lagged behind standard networks. - **Location Tracking & Intercept Capabilities**: Handsets provide GPS positions back to gateways for spot beam management, though documented accuracy is deliberately limited to roughly 100 meters. Geovedi showcases passive monitoring data capture, recovering call analysis metrics including spot beam IDs, timestamps, call durations, dialed numbers, caller IDs, partial IMSI/TMSI, IMEI, and Arabic SMS messages. - **Tooling & Projects**: The presentation references the open-source Osmocom project—notably Osmocom-GMR and Karsten Nohl and Sylvain Munaut's work with OsmocomBB—as enabling researchers to analyze satellite mobile packets and construct software-defined packet sniffers.

### Takeaways Geovedi emphasizes that satellite telephony systems rely on legacy GSM foundations and weak encryption schemes, making both tactical and strategic eavesdropping viable. With newer hybrid smartphones (such as Windows Mobile satellite devices) entering the market and open-source projects like Osmocom-GMR emerging, satellite systems represent a critical, yet frequently overlooked, attack surface that requires closer community scrutiny.