Skill: Satellite & LEO Communication Security

Supplementary Files:

• payloads.md — Command catalogue organized by satellite family: Starlink (terminal hardware, boot chain, gRPC terminal APIs, starlinkground, Open Satellite Project), Iridium (gr-iridium L-band burst demod, SBD short-burst data, Iridium NEXT enumeration), Inmarsat (BGAN, FleetExpress, IsatPhone, Sned SBD), Viasat KA-SAT (SurfBeam2 firmware, AcidRain wiper analysis, TtDotMon), DVB-S/S2/S2X (leandvb software decoder, welle.io, blind scan, DVB-CSA descrambling in authorized lab), VSAT/iDirect/Hughes (9500/9800 modem shell, HM/HT attach, DNS hijack on uplink, provisioning abuse), GNSS receiver attacks (GPS-SDR-SIM, Galileo spoofing, RAIM detection). 60+ code blocks, 2,000+ lines.
• test-cases.md — Structured test cases TC-SL-001..012: Starlink terminal enumeration, Iridium SBD burst decode, KA-SAT modem fingerprint, VSAT uplink hijack lab, GPS spoofing with GPS-SDR-SIM, DVB-S2 signal capture, Inmarsat BGAN terminal recon, iDirect modem shell access, multi-constellation GNSS attack, DVB-CSA descrambling (authorized lab), beam hopping observation, constellation tracking with gpredict. Plus a Verification Checklist and Defense/Mitigation Patterns section.
• guides/satellite-leo-security-playbook.md — End-to-end satellite red team playbook: frequency band taxonomy (L/S/C/X/Ku/Ka/V), constellation comparison (LEO/GEO/MEO, latency, throughput, coverage), real-world incidents (Viasat KA-SAT AcidRain Feb 2022 with 5,800+ bricked terminals coincident with Russia-Ukraine invasion, Starlink SpaceX cyber-attacks claim 2022, Iridium pager SNMS, HughesNet DSL modem CSRF 2017, Apache Chukwa fleet monitoring), lab setup (HackRF/BladeRF/PlutoSDR + LNB for Ku-band, gr-iridium for L-band, leandvb for DVB-S2, GPS-SDR-SIM lab-only GNSS spoofing), defensive guidance (link-layer AES, DVB-RCS2 mutual auth, beam hopping, firmware signing).

Summary

Satellite communication security covers the space segment, the ground segment, and the link between them — the radio path that carries broadband, voice, pager, TV, IoT, and navigation data to roughly four billion receivers worldwide. This skill targets commercial satellite communications: LEO broadband constellations (Starlink, Kuiper, OneWeb, Telesat Lightspeed), LEO narrowband (Iridium NEXT, Globalstar), GEO/MEO broadband (Inmarsat BGAN, Viasat KA-SAT, HughesNet Jupiter), GEO broadcast (DVB-S/S2/S2X, DIRECTV, Dish), VSAT enterprise networks (iDirect, Hughes PES, Newtec, Comtech), and the GNSS receiver attack class (GPS / Galileo / GLONASS / BeiDou / SBAS) at the receiver side only.

Tools: HackRF One / BladeRF 2.0 micro / PlutoSDR (with Ku/Ka LNB downconverter), GNU Radio with gr-iridium and gr-gnss, leandvb (software DVB-S2 decoder), welle.io (DVB GUI), GPS-SDR-SIM (GNSS spoofing lab), Wireshark with DVB/GNSS dissectors, Starlink DEMO / starlinkground, Open Satellite Project (opensat), RTL-SDR V3 / AirSpy R2, SDR# / SDRangel / GQRX, gpredict (satellite tracking), multimon-ng (POCSAG/FLEX/ACARS for VSAT paging), Universal Radio Hacker (URH).

Domain: satellite

MITRE ATT&CK: T1557-Adversary-in-the-Middle, T1485-Data Destruction (AcidRain-class wipers), T1499-Endpoint Denial of Service (satellite link jamming), T1098-Account Manipulation (VSAT provisioning abuse), T1584-Compromise Infrastructure (satellite uplink takeover).

Detection Methods

LEO Communication Audit

• Starlink anomalies: User terminal communicating with non-Starlink endpoint.
• Iridium anomalies: Anomalous burst patterns; signal strength manipulation.
• Viasat KA-SAT anomalies: Modem compromise; command injection signatures.
• DVB-S2 anomalies: Signal strength manipulation; channel unauthorized use.

SIEM Detection Rules

• Splunk SPL (satellite): index=sat sourcetype=modem | where event_type="reboot" | stats count by terminal_id
• Vendor-specific: Starlink LMOD status, Iridium SBD audit, Viasat modem logs.

Defense Evasion Techniques

Satellite Terminal Compromise

• Use legitimate credentials: Don't trigger new-login alerts; use stolen but valid credentials.
• Off-hours operation: Satellite bandwidth often low at night; blend with maintenance.
• Mimic legitimate traffic: Mimic typical user terminal traffic patterns.

Signal Manipulation

• Gradual drift: Slowly change parameters; avoid sudden jump detection.
• Directional antennas: Limit RF footprint to specific terminal.
• Brief transmissions: <5 second bursts; below triangulation threshold.

Ground Station Compromise

• Use legitimate credentials: Steal operator account; appears as legitimate operation.
• Compromise maintenance window: Operate during scheduled maintenance; blends with activity.

Differentiation

This skill is distinct from three adjacent RF attack skills:

• 5g-telecom-attack — Terrestrial 3GPP cellular infrastructure (5GC AMF/SMF/UPF, RAN gNodeB, O-RAN, signaling PFCP/GTP/Diameter/SS7, IMSI catchers). All calls/signaling ride terrestrial cell-site backhaul; no satellite transponder is in the path. satellite-leo-security covers the case where the backhaul IS a satellite: Iridium Certus maritime, Inmarsat BGAN, Viasat KA-SAT, or a Starlink user terminal backhauling a remote cell. Where the two overlap (an SBA core reachable over a satellite backhaul), each skill owns its layer.
• hf-vhf-radio-attack — Licensed aviation and maritime VHF/HF bands (ATC voice, ACARS over VHF, AIS ship tracking, ADS-B at 1090 MHz, HF SELCAL, analog AM voice at 118–137 MHz). These are terrestrial aviation/maritime services, not satellite. satellite-leo-security covers ADS-B/AIS only when the uplink is satellite (e.g., Aireon ADS-B hosted on Iridium NEXT, or Starlink maritime AIS backhaul).
• sdr-rf-attack — Sub-GHz ISM band attacks (garage door remotes, wireless doorbells, weather stations, keyfobs, IoT sensors at 315/433/868/915 MHz). These are unlicensed short-range ISM devices. satellite-leo-security covers licensed Ku/Ka-band satellite downlinks (10.7–12.75 GHz) and L-band (1.5–1.6 GHz) which require an LNB or active antenna, not a naked Sub-GHz SDR.

In scope: Starlink / Kuiper / OneWeb / Telesat Lightspeed user terminals and their Ku/Ka downlinks, Iridium L-band bursts, Inmarsat BGAN, Viasat KA-SAT, HughesNet, DVB-S/S2 broadcast, VSAT (iDirect / Hughes / Newtec), GNSS receiver-side attacks. Out of scope: satellite uplink transmission (TX) — receive-only and terminal-side attack surface only; uplink work requires explicit national licensing authority and a Faraday cage.

Description

Satellite communications have been an attack surface since the 1980s, when Captain Midnight broadcast a pornographic movie over HBO's Galaxy 1 transponder by injecting an unauthorized uplink signal during a televised match. The modern attack surface looks different but the underlying physics is unchanged: anyone within the footprint of a satellite downlink can receive, demodulate, and analyze its signal. The defense has always been cryptography — link-layer encryption (DVB-CSA for TV, AES for IP, custom for Iridium), conditional access systems (NDS/Videoguard, Irdeto, Viaccess), and per-terminal authentication (iDirect HOPPING plans, DVB-RCS2 mutual authentication). When the cryptography fails or is absent, the satellite becomes readable; when the terminal becomes remotely manageable by the attacker, it becomes brickeable.

This skill covers the eight things that distinguish satellite/LEO attacks from terrestrial RF attacks:

1. LEO is moving — Doppler, beam handover, and footprint migration are first-class — A Starlink or Iridium satellite at 550–780 km altitude moves across the sky at roughly 7 km/s; a single pass is 8–15 minutes. The user terminal must electronically steer its phased array, hand over the active beam to the next satellite in the constellation, and migrate its IP session across the gateway earth station in under 30 seconds. Each step is an attack surface: beam handover can be jammed or spoofed, gateway migration can leak session state, and the Doppler shift (tens of kHz at Ku-band) is a fingerprint that reveals which satellite the terminal is tracking.

2. GEO is far — latency, bandwidth, and gateway centralization are the attack — A GEO satellite sits at 35,786 km altitude. Round-trip latency is ~500 ms (vs. 30–60 ms for LEO); throughput per transponder is 1–10 Gbps shared across an entire beam's worth of terminals. The gateway earth stations are centralized — Viasat KA-SAT has a handful of gateways across Europe; severing or compromising one gateway can black out a continent. The AcidRain wiper (Feb 2022) demonstrated this: ~5,800 KA-SAT terminals in Ukraine and across Europe bricked coincident with the Russia-Ukraine invasion, by wiping the flash storage on the SurfBeam2 modem's MIPS-class firmware.

3. DVB-S/S2 is broadcast — every receiver in the beam sees every stream — DVB-S/S2/S2X (ETSI EN 300 421 / 302 307) uses a single wide carrier per transponder (typically 27–36 MHz wide, QPSK/8PSK/16APSK/32APSK modulation) that is downlinked across the entire beam footprint. Conditional Access (CA) scrambling (DVB-CSA, DVB-CISSA) provides confidentiality; the descrambling control words are delivered via Entitlement Control Messages (ECM) every 2–10 seconds. In authorized labs, DVB-CSA descrambling is a teaching exercise — a single lab receiver can recover the control words from the entitlement stream.

4. VSAT networks are centralized — the hub is the crown jewel — A VSAT (Very Small Aperture Terminal) enterprise network has a single Hub earth station (typically the iDirect or Hughes hub) and many remote terminals (the 1.2m Ku-band or 74cm Ka-band antennas on retail/branch sites). The hub routes all remote-to-remote traffic and aggregates Internet egress. Compromise of the hub (or its NMS — Network Management System) compromises the entire fleet; compromise of a single remote terminal (default credentials, exposed SSH, provisioning protocol abuse) gives lateral movement to the hub.

5. GNSS attacks are receiver-side — the satellite cannot be touched — The GPS / Galileo / GLONASS / BeiDou satellites broadcast their navigation messages (L1 C/A at 1575.42 MHz, L2C at 1227.60 MHz, L5 at 1176.45 MHz; Galileo E1/E5; BeiDou B1/B2) in a predictable format with weak spread-spectrum processing gain. A receiver-side attacker with a transmitter and lab/Faraday environment can synthesize a stronger counterfeit signal thatoverrides the authentic one — spoofing the receiver's computed position, time, or both. Real-world GPS spoofing has been documented for ships (C4ADS 2019, vessels in the Black Sea and Persian Gulf), drones, and business jets (over the Eastern Mediterranean and Iraq, 2023–2024). The defense is receiver-side: RAIM (Receiver Autonomous Integrity Monitoring), multi-constellation cross-check, and inertial navigation correlation.

6. Maritime and aviation satellite are dual-attack-surface — Inmarsat Fleet and Iridium Certus ship terminals, and Iridium / Inmarsat aviation terminals, have two distinct attack surfaces: (a) the satellite downlink/uplink (L-band, subject to jamming, spoofing, and lawful intercept), and (b) the on-board Ethernet/LAN side (subject to standard IT pentest of the bridge network, ECDIS, AIS transponder, and satcom router). The 2020 SST Dryad report on Russian GPS spoofing off the Syrian coast was a (a)-side attack; the 2018 CyberKeel report on VSAT terminals on merchant ships was a (b)-side attack. Both are valid pentest scopes.

7. Fleet management and provisioning planes are C2 in disguise — Every modern satellite terminal (Starlink, Viasat SurfBeam2, iDirect 9500/9800, Hughes HM/HT) is remotely managed by the operator via a dedicated management plane: Starlink uses gRPC over IPv6 from the terminal to a SpaceX NOC; Viasat SurfBeam2 uses TtDotMon and a TR-069-class provisioning flow; iDirect uses the Evolution or Velocity NMS over a dedicated in-band management VLAN on the hub; Hughes uses a DVB-RCS-class NMS. Each is a command-and-control channel with full firmware-update authority over the terminal fleet — and each has, historically, had weak or shared authentication.

8. AcidRain-class wipers are the new threat model — The Feb 2022 Viasat KA-SAT incident established that satellite terminal fleets are now a target of state-level data-destruction operations. The wiper — publicly attributed as AcidRain — was purpose-built for the MIPS-class uClinux environment of the SurfBeam2 modem, overwrote the flash storage with /dev/urandom output, and bricked ~5,800 terminals across Ukraine and several EU countries. The incident demonstrated that satellite terminals are now critical infrastructure — they backhaul Ukrainian military communications, ATMs, and wind-turbine SCADA — and that their boot chains and firmware update paths are an attack class, not just an attack vector.

This skill is the space-segment counterpart to 5g-telecom-attack (terrestrial cellular) and hf-vhf-radio-attack (aviation/maritime VHF/HF). Where those skills cover the licensed RF that travels horizontally across the earth, this skill covers the licensed RF that travels vertically — up to the satellite and back down to a beam footprint that may cover an entire hemisphere.

Use Cases

• Starlink terminal assessment — Authorized engagement against a deployed Starlink user terminal (Dishy) in a corporate/enterprise remote-site deployment. Enumerate the terminal's gRPC API, identify the boot chain and firmware update path, test the IPv6 prefix allocation for spoofing, characterize the geographic-restriction bypass surface.
• Iridium L-band burst analysis — Passive receive-only engagement: deploy a HackRF/BladeRF with a 1.6 GHz antenna and the gr-iridium GNU Radio flowgraph to capture Iridium L-band bursts, decode SBD (Short Burst Data) messages, characterize the transceiver channel mapping, and identify Iridium NEXT satellite passes via gpredict. Receive-only — no uplink.
• Inmarsat BGAN / FleetExpress terminal pentest — Grey-box assessment of an Inmarsat BGAN terminal deployed in a remote-site or maritime context. Identify the terminal firmware version, the provisioning flow, the IsatPhone voice encryption, the Sned SBD class, and the LAN-side attack surface (satcom router, attached devices).
• Viasat KA-SAT modem analysis — Lab-only engagement against a SurfBeam2 modem: extract the MIPS firmware, identify the TtDotMon management interface, characterize the boot chain and flash layout, and assess whether the terminal's firmware-update path could have delivered an AcidRain-class wiper. Authorized lab only.
• DVB-S/S2 broadcast signal capture — Authorized lab capture of a DVB-S/S2 downlink with leandvb (software decoder) or welle.io (GUI), characterization of the modulation, FEC, and symbol rate, identification of the ECM stream, and (in a fully authorized lab with a CA card) descrambling of the payload for teaching/verification.
• VSAT enterprise network pentest — Authorized engagement against an iDirect or Hughes VSAT network. Identify the hub and remote terminals, fingerprint the modem (9500/9800 for iDirect, HM/HT for Hughes), enumerate the NMS, test the provisioning protocol for abuse, identify weak per-terminal credentials, and assess lateral movement from remote terminal to hub.
• GNSS receiver spoofing assessment (lab) — Fully authorized Faraday-cage or open-field lab engagement against a GPS/Galileo receiver: generate a spoofed signal with GPS-SDR-SIM, broadcast it via a HackRF/BladeRF, observe the receiver's reported position, characterize the receiver's RAIM detection, and verify multi-constellation cross-check defenses.
• Maritime/aviation satellite fleet review — Defensive engagement: review a fleet of Inmarsat or Iridium ship/aircraft terminals for (a) fleet-wide terminal firmware versions and patch status, (b) LAN-side exposure of the satcom router, (c) GPS/GNSS spoofing-detection posture, (d) the C2/provisioning plane's authentication model.

Core Tools

Tool	Purpose	License / Notes
HackRF One / BladeRF 2.0 micro / PlutoSDR	General-purpose SDRs for the 1 MHz–6 GHz range. Paired with a Ku-band (10.7–12.75 GHz) or Ka-band (19.7–20.2 GHz) LNB downconverter (standard satellite TV LNB, ~$20) for receive-only satellite downlink capture.	GPL/Hardware. greatscottgadgets.com/hackrf, nuand.com, analog.com/plutosdr
GNU Radio + gr-iridium + gr-gnss	GNU Radio SDR framework; gr-iridium is the Iridium L-band burst demodulator; gr-gnss is the GNSS signal analyzer (GPS, Galileo, GLONASS, BeiDou).	GPL-3.0. gnuradio.org, github.com/muccy/gr-iridium, github.com/gnss-sdr/gnss-sdr
leandvb	Software DVB-S/DVB-S2/DVB-S2X demodulator. Reads an IQ file from RTL-SDR/HackRF/BladeRF and outputs a Transport Stream. The default tool for DVB-S2 receive-only lab work without dedicated hardware.	GPL-2.0. github.com/pabr/perfect-vines (leandvb)
welle.io	GUI DVB-T/DVB-S2 receiver. Real-time spectrum, signal, and TS view. Used for visual confirmation of DVB-S2 captures.	GPL-2.0. welle.io
GPS-SDR-SIM	GPS L1 C/A signal generator. Reads a RINEX ephemeris file and synthesizes an IQ signal that a HackRF/BladeRF can transmit (lab/Faraday only) to spoof a GPS receiver's computed position.	MIT. github.com/osqzsun/GPS-SDR-SIM
Wireshark (with DVB/GNSS dissectors)	Packet analysis. Dissects DVB MPE (Multi-Protocol Encapsulation), GSE (Generic Stream Encapsulation), DVB-S2 BBFRAME, GPS L1 C/A navigation messages, Galileo E1, Iridium SBD.	GPL-2.0. wireshark.org
Starlink DEMO tool / starlinkground	Reverse-engineered gRPC clients for the Starlink user terminal (Dishy). Expose terminal status, obstruction map, current satellite, beam, and boot state via the local gRPC API on 192.168.100.1:9200.	MIT. github.com/sparkydishy/starlink-grpc-tools
Open Satellite Project (opensat)	Suite of tools for parsing meteorological-satellite (GOES, Himawari, METEOSAT, METOP, NOAA) and other unencrypted satellite downlinks (LRIT, HRIT, APT). Useful as a training ground for satellite signal analysis.	GPL-3.0. opensatproject.org
RTL-SDR V3 / AirSpy R2	Low-cost receive-only SDRs. RTL-SDR V3 covers 100 kHz–1.7 GHz (incl. Iridium L-band with bias-tee active antenna). AirSpy R2 covers 24–1700 MHz with 10 MHz bandwidth.	GPL/Hardware. rtl-sdr.com, airspy.com
SDR# / SDRangel / GQRX	GUI SDR receivers. SDR# for Windows, SDRangel for cross-platform multi-channel, GQRX for macOS/Linux. Used for visual signal identification before recording.	GPL. airspy.com/sdrsharp, github.com/f4exb/sdrangel, gqrx.dk
gpredict	Real-time satellite tracking program. Predicts Iridium, Starlink, GPS, Inmarsat, and other passes from the observer's location using TLE (Two-Line Element) data from Celestrak. Essential for LEO capture planning.	GPL-2.0. gpredict.oz9aec.net
multimon-ng	Decoder for POCSAG (pager), FLEX (pager), and ACARS (aircraft) — used to decode VSAT paging and other narrowband satellite control channels.	GPL-2.0. github.com/EliasOenal/multimon-ng
Universal Radio Hacker (URH)	Reverse-engineering tool for unknown RF protocols. Records IQ, identifies modulation and framing, builds a decoder. Used for custom satellite IoT (Swarm, Astrocast, Kineis, Lacuna) and proprietary VSAT control links.	GPL-3.0. github.com/jopohl/urh

Methodology

The engagement methodology is organized in five phases. The default posture is receive-only / passive: in most jurisdictions, transmitting in licensed satellite bands (Ku 14.0–14.5 GHz uplink, Ka 28–30 GHz uplink, L-band 1.6 GHz uplink for Iridium/Inmarsat) without a national license is a criminal offense on par with cellular jamming. The only TX-side work this skill covers is GPS-SDR-SIM GNSS spoofing, and only inside an authorized Faraday cage or open-field test range.

Phase 1: Reconnaissance (Passive, RX-Only)

• Frequency survey — Sweep the relevant downlink bands: L-band (Inmarsat 1525–1559 MHz, Iridium 1616–1626.5 MHz), Ku-band (10.7–12.75 GHz with a standard LNB downconverting to 950–2150 MHz IF), Ka-band (19.7–20.2 GHz with a Ka-band LNB). Use HackRF/BladeRF with osmocom_fft or SDRangel to identify active carriers. For Ku/Ka work the LNB is fed via coax into the SDR's 50-ohm input with a DC-block / bias-tee power.
• Constellation tracking — Use gpredict with current TLEs (Celestrak catalog) to predict Starlink, Iridium NEXT, GPS, Galileo, Inmarsat, and Viasat passes. Starlink's per-pass footprint is ~15 minutes per satellite; Iridium NEXT ~10 minutes; GPS satellites are GEO-like in apparent sky motion (8 hour semi-circles).
• Beam footprint mapping — For GEO satellites (Viasat KA-SAT at 9°E, Inmarsat I-4 at 64°E/54°W/178°E, Hughes Jupiter at 22°W/55°W/97°W, SES, Eutelsat), identify the beam footprint that covers the engagement location. Each beam is a distinct carrier set; VSAT NMSs are per-beam.
• Terminal discovery (LAN-side) — For on-prem engagements, nmap-sweep the management subnet for known terminal types: Starlink (192.168.100.1 gRPC), Viasat SurfBeam2 (192.168.0.1 web UI), iDirect 9500/9800 (192.168.1.1 SSH), Hughes HM/HT (192.168.0.1 web UI), Inmarsat BGAN (192.168.128.100).

Phase 2: Signal Capture (RX-Only)

• L-band capture (Iridium, Inmarsat) — Set SDR center frequency to 1621.25 MHz (Iridium downlink), 1525–1559 MHz (Inmarsat). Sample rate 500 ksps minimum (Iridium channels are 31.5 kHz wide BDPSK/QPSK). Record to IQ file for offline gr-iridium processing.
• Ku/Ka-band capture (Starlink, Viasat, Hughes) — Connect LNB to SDR via bias-tee. Set SDR center frequency to the downconverted IF (typically 950–2150 MHz). Sample rate 2 Msps minimum for DVB-S2 (typical symbol rate 27.5 Msym/s requires a larger capture; multiple SDRs or a high-bandwidth SDR like BladeRF 2.0 micro xA4 or a dedicated DVB receiver card is preferred).
• DVB-S2 demodulation — Pipe the IQ capture through leandvb to recover the Transport Stream: leandvb --vit 27500 --sr 27500000 --n helpers --in input.iq --out output.ts. Verify TS structure with dvbsnoop or ts2sec.
• GNSS capture (lab) — For spoofing receiver-side analysis, capture authentic GPS L1 with a u-blox or HackRF; for spoofing TX-side work, GPS-SDR-SIM generates the IQ file (lab/Faraday only).

Phase 3: Protocol & Firmware Analysis

• DVB MPE/GSE decapsulation — DVB-S2 carries IP via MPE (Multi-Protocol Encapsulation, ETSI EN 301 192) or GSE (Generic Stream Encapsulation, ETSI TS 102 606). Use Wireshark's DVB-MPE dissector to extract the IP payload from the TS.
• Starlink gRPC enumeration — Query the Dishy's local gRPC API (grpcurl -plaintext -import-path . -proto starlink.proto 192.168.100.1:9200 list), enumerate the device_info, obstruction_map, and current_satellite endpoints. Identify the firmware version and the boot chain.
• Viasat SurfBeam2 firmware extraction — In an authorized lab, dump the SurfBeam2 flash via the JTAG or serial console (the modem runs uClinux on a MIPS-class Broadcom SoC). Identify the TtDotMon interface, the firmware-update URL, and the boot loader.
• iDirect / Hughes modem shell — For authorized engagements, identify the modem's debug shell: iDirect 9500/9800 expose telnet/SSH on the LAN after engineering password recovery; Hughes HM/HT modems expose a hidden debug menu via CSRF-protected forms on the web UI.

Phase 4: Active Test (Authorized Lab Only)