SlideShare ist ein Scribd-Unternehmen logo
1 von 89
Downloaden Sie, um offline zu lesen
SPREAD SPECTRUM SATCOM
HACKING
ATTACKINGTHE GLOBALSTAR SIMPLEX DATA SERVICE
Colby Moore
@colbymoore - colby@synack.com
WHO AM I?
Colby Moore
Synack R&D
KD7SCT
Black Hat '15: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex Data Service
INTRODUCTION
MOTIVATION
• Try something new
• Satellite hacking often too
theoretical
• Unexplored frontier
• Systems are hopelessly
broken
• Inspire and collaborate
WHAT ARE WE GOINGTO
LEARN?
• RF signals and modulation
• What is spread spectrum?
• Selecting a target and
reverse engineering
• Exploiting the target
PREREQUISITES
• High school mathematical
knowledge
• Lets keep things relatively
“understandable”
• Will provide resources
(see github)
TARGETING
SELECTING ATARGET
GovernmentCommercial
• SPOT - Consumer grade satellite tracking
• Aging satellite network: voice, data, messaging
• But wait… this tech is used everywhere. Jackpot.
WHERE IS IT USED?
Military / Classified
Trailers / Containers
Air Quality Monitoring
PersonnelTracking
Fire Detection and Prevention
Water Quality Monitoring
Tank Level Gauging
Perimeter / Border monitoring
Asset / Vehicle Tracking
Remote Meters
Buoys
Ship Movement
Fishing vessel monitoring
Power line monitoring
Dispersed sensors
and many more…
SIMPLEX DATA NETWORK
“Simplex works where infrequent, small packets of data are to be collected”
GPS Satellite
Asset
Globalstar Satellite
Globalstar Ground StationThe Internet
Globalstar Infrastructure
User Infrastructure
BENT PIPE
“A bent pipe satellite does not demodulate or decode
the signal.A gateway station on the ground is
necessary to control the satellite and route traffic to
and from the satellite and to the internet.”
REDUNDANCY
• Yes, the network only talks in one direction (simplex)
• How is this reliable?
GROUND STATIONS AND
COMMAND CENTERS
Hundreds of ground stations Two Operations Centers
COVERAGE
48 satellites - 5850 km diameter footprint - 1410 km orbit - In service since 2000
SECURITY POSTURE
“Error 100: Database query failed - retrieving
login information You have an error in your
SQL Syntax;…”
NOT SO MUCH…
–Globalstar
“The received data is then forwarded to a user defined
network interface that may be in the form of an FTP
host or HTTP host where the user will interpret the data
for further processing.”
INTELLIGENCE GATHERING
WHERETO LOOK
PRIOR RESEARCH
Travis Goodspeed
https://github.com/travisgoodspeed/pyspot
Natrium42
https://web.archive.org/web/20120202211125/
http://natrium42.com/projects/spot/
STX-3
“Worlds’ smallest and lowest power consuming industrial-
use satellite transmitter”
DSSS? BPSK? What the &^#% is that?…
FREQUENCIES
Globalstar L-Band Frequencies
Globalstar Simplex Data Frequencies
THE BREAKTHROUGH
Clues!
REVIEW OF WAVES AND
MODULATION
WAVES
Amplitude - A
Phase - φ (radians)
Time (t)
Wavelength
TIME DOMAINVS.
FREQUENCY DOMAIN
Frequency DomainTime Domain
Amplitude
Time
Frequency
ANALOG MODULATION
• Amplitude Modulation (AM)
• Frequency Modulation (FM)
AMPLITUDE MODULATION
Carrier
Modulating Signal (Data)
Modulated Signal
FREQUENCY MODULATION
Carrier
Modulating Signal (Data)
Modulated Signal
DIGITAL MODULATION
• Amplitude Shift Keying (ASK / OOK)
• Frequency Shift Keying (FSK)
• Phase Shift Keying (PSK)
PHASE SHIFT KEYING (PSK)
Modulated Signal
Modulating Signal (Data)
0 0 1 1 0 1 1 1
0˚ 180˚ 0˚ 180˚
BPSK - Two phases (0 and 180 degrees) are used to represent 1 and 0
SPREAD SPECTRUM
SPREAD SPECTRUM
MODULATION
• Why is Spread Spectrum special?
• WiFi, Bluetooth, GPS, and basically all modern RF
communications
• Processing Gain
• Jam Resistant
• CDMA
SPREAD SPECTRUM
MODULATION
• Frequency Hopping Spread Spectrum (FHSS)
• Direct Sequence Spread Spectrum (DSSS)
DIRECT SEQUENCE SPREAD
SPECTRUM (DSSS)
• Mixes a slow signal with fast pseudo-random signal
• Signal still contains original information but occupies much
more bandwidth.
BPSK Signal
Occupies ~100Hz
Spread BPSK Signal
Occupies ~1.25Mhz
DSSS CONTD.
Data Signal
Pseudo Random
Result
000000000000 111111111111
110001111001 010000101000
110001000110 010000010111
⊕
⊕
DSSS CONTD.
Data Signal
Pseudo Random
Result
000000000000 111111111111
110001111001 010000101000
110001000110 010000010111
⊕
⊕
M-SEQUENCES AS PN CODES
• Periodic binary codes that have strong
autocorrelation properties
• Commonly generated with LFSRs
M-SEQUENCES AND
CORRELATION
0001
0001
0001
0010
0001
0100
0001
1000
4 0 0 0
M-Sequence:
Shifted:
Correlation:
This makes looking for the m-sequence in a signal easy!
DECODINGTHEORY
• Simple in practice. More difficult in theory
• Mix incoming signal with PN sequence and the original
BPSK signal will emerge.
• Compensate for frequency differential between local and
remote oscillators
• Signal needs to be phase aligned with PN code
HARDWARE
TOOLS AND HARDWARE
USRP B200
$675
GSP-1620 LHCP Antenna
$65
MORE HARDWARE
Dimension Engineering AnyVolt 3
$55
12v AC/DC Adapter
$5SMA Cables
$20
MiniCircuits ZX60-1614LN-S
Low Noise Amplifier
$150
ASSEMBLED CAPABILITY
SAMPLING
Nyquist: Sample at least
twice as fast as the signal’s
fastest frequency.
The human ear can’t hear frequencies higher than 20Khz.
CD audio is sampled at 44.1Khz (twice the human range).
IQ MODULATION
• Makes generation of signals easy in software!
https://www.youtube.com/watch?v=h_7d-m1ehoY
Basics of IQ Signals and IQ modulation & demodulation - A tutorial
PN RECOVERY
WHATTO EXPECT
• Pseudo random sequence
(1s and 0s)
• Repeating
• 255 bits long
• 1.25 million “chips” per
second
Much like Bart in detention, the PN will
repeat over and over and over…
PN RECOVERY
• In order to decode the signal, we need to know the PN sequence
• DSSS BPSK == BPSK
BPSK DSSS
BPSK
LowFrequencyHighFrequency
SAMPLING REQUIREMENTS
32 Mhz
———— = 4 Mhz (> 1.25 x 2)
8 Mhz > 2x faster than 1.25 Mhz (Nyquist)
Even multiple of 32 Mhz (USRP)
4 Mhz 3.2 samples
—————— = —————— (not even)
1.25 Mcps 1 symbol
4 Mhz 5 4 samples
—————— x —— = —————
1.25 Mcps 4 symbol
Even samples / symbol
(Implementation Specific)
*We can resample the
signal from 4 to 5 Mhz.
*
PN RECOVERY
• PN Sequence is much shorter than bit length
• PN repeats 49 times for each bit
• PN ⊕ Data == PN (within a bit boundary)
1,250,000 chips 1 second 1 PN seq. 49 PN seq.
———————— x —————— x ————— = —————
1 second 100.04 bits 255 chips 1 bit
PN RECOVERY
PN RECOVERY
11111111001011010110111010101011
10010011011010011001101000111011
01100010001001111010010010000111
10001010011100011111010111100111
01000010101100101000101100000110
01000110000110111111011100001000
00100101010010111110000001110011
0001101010000000101110111101100
DESPREADING
WHATTO EXPECT
• Mix original signal with PN
• Narrow band signal will
emerge
• Shown as sharp spike on
FFT
REALTIME IS HARD
• Unfortunately doing this is very computational intensive
• Lots of room for optimizations
• Record now, process later
sh-­‐3.2#	
  time	
  python	
  sync.py	
  
real	
   0m58.326s	
  
user	
   0m48.754s	
  
sys	
  	
  	
  	
  0m0.909s
1.4 second capture (one packet)
4M samp/sec * 2 floats/samp * 4 bytes/float = 30.5 MB/sec
CORRELATION
Correlation
Time
Slide PN against data and correlate at each step.
CODETRACKING
Time (samples)
Correlation
Correlation Peak
If we don’t compensate for misalignment, we will drift and lose
correlation over time.
Search for
peaks, and track
themStrong Correlation (PN aligned)
No Correlation (PN unaligned)
Early
Late
Aligned
CODETRACKING
Time (samples)
Correlation
Early or late detection lets us keep track.
Positive and negative correlations
indicate bits!
Consistent Correlation (PN aligned)
DESPREAD SIGNAL
It works!
Mix the PN against the signal. Original signal appears.
DECODING
EXTRACTING DATA
Low Pass Filter
Rational Resampler
PSK Demodulator
Decoder
Signal
Time Domain
Frequency Domain
10100 0 0111 ……
PACKET FORMAT
000000101100101001101100011110100000010100000000010011110000000100000010000010000000000000000100000000000000000000000000000011001000001010010011
001 01001101100011110100000Manufacturer ID Unit ID
LOCATION DECODING
Latitude: bits 8:32
Longitude: bits 32:56 + -
Latitude
Northern
Hemisphere
Southern
Hemisphere
Longitude
Eastern
Hemisphere
Western
Hemisphere
Convert to decimal
(signed int MSB to LSB)
Multiply by degrees per
count
1.
2.
3.
CHECKSUM
Packet (without preamble and CRC)
110 bits
CRC
(Code Provided)
Compare
If we known how to reproduce the checksum, we can create our own
packets… no signing, no encryption, lets spoof!
000000101100101001101100011110100000010100000000010011110000000100000010000010000000000000000100000000000000000000000000000011001000001010010011
24 bits
INTERCEPTING ON
DOWNLINK
• Bigger antennas and better equipment
• RF downconversion
• Doppler Shift
• Multipath
Worst Case Doppler Shift
TRANSMITTING
DISCLAIMER
Transmitting on Globalstar’s frequencies may be illegal where you live and could
interfere with critical communications.
Donotdothis!
Seriously,don’t.
No one likes late night visits from the FCC.
TRANSMITTING
MGA-2000 0.5W RF Amplifier
$190.00
But if you like late night visits from the FCC…
• This is actually the easy part.
• ~.2 Watts power
• Simply mix data, PN, and carrier and correct rates
BUT WAIT… ITS EASIER
Spot Device Updater SPOT3FirmwareTool.jar
Currently $49.99
DOES IT WORK?
SpotTrace1 SpotTrace 2
Clone
IMPACT
EMERGENCY RESPONSE
Real Emergency
Fake Emergency
Overwhelm emergency
response center
anonymously?
WHERE ELSE?
BUT WAIT,THERE’S MORE
Lockheed Martin Flight Service (LMFS) Integration
CAPABILITY
Uplink Interception
RF Beam
Globalstar
Attacker
Attacker intercepts and
plots pattern of life
SPOOFING LOCATION
Planned Route
Hijack Route
Attacker hijacks truck, disables tracker,
transmits location as if delivery is on
track.
FalseLocationData
TESTINGTHE CAPABILITY
Reception
Window
DEMO
Video demo time. It’s better to not tempt the demo gods. ;)
CONCLUSIONS
"Like all companies and industries in the 21st century, including those that Wired
reported on this week to expose hacking vulnerabilities like Chrysler, GM, Brinks
and others, Globalstar monitors the technical landscape and its systems to protect
our customers. Our engineers would know quickly if any person or entity was
hacking our system in a material way, and this type of situation has never been an
issue to date.We are in the business of saving lives daily and will continue to
optimize our offerings for security concerns and immediately address any illegal
actions taken against our Company."
DISCLOSURE & RESPONSE
• ~180 days ago
• Friendly and concerned for user privacy, but no further
communication
NEXT STEPS
• Collaboration
• Code optimization - realtime
• Downlink interception
• Data aggregation
CONCLUSIONS
• Long lifecycle
• Unpatchable
• Security going forward
• DSSS != security
• Assume Insecure
• Act accordingly
• Higher standards
SPECIALTHANKS
Alex K., Chris W., Cyberspectrum Meetup, David C., Michael Ossmann,
Mom and Dad, Paul David,Tom Rondeau
The Interns
and
QUESTIONS / COMMENTS?
https://github.com/synack/globalstar
https://syn.ac/bh15satcom
@colbymoore
colby@synack.com
code
slides
twitter
email
IMAGE CREDITS
• http://images.google.com

Weitere ähnliche Inhalte

Was ist angesagt?

The Easytrieve Presention by Srinimf
The Easytrieve Presention by SrinimfThe Easytrieve Presention by Srinimf
The Easytrieve Presention by SrinimfSrinimf-Slides
 
Tunnel vs VPN on Mikrotik
Tunnel vs VPN on MikrotikTunnel vs VPN on Mikrotik
Tunnel vs VPN on MikrotikGLC Networks
 
Hacktivity 2016: Stealthy, hypervisor based malware analysis
Hacktivity 2016: Stealthy, hypervisor based malware analysisHacktivity 2016: Stealthy, hypervisor based malware analysis
Hacktivity 2016: Stealthy, hypervisor based malware analysisTamas K Lengyel
 
Speed layer : Real time views in LAMBDA architecture
Speed layer : Real time views in LAMBDA architecture Speed layer : Real time views in LAMBDA architecture
Speed layer : Real time views in LAMBDA architecture Tin Ho
 
Army plan for Cyber Offensive Operations -- ESF 18
Army plan for Cyber Offensive Operations -- ESF 18Army plan for Cyber Offensive Operations -- ESF 18
Army plan for Cyber Offensive Operations -- ESF 18David Sweigert
 
EC-Council Certification Roadmap and Course Catalog
EC-Council Certification Roadmap and Course CatalogEC-Council Certification Roadmap and Course Catalog
EC-Council Certification Roadmap and Course CatalogNetCom Learning
 
Complete ASIC design flow - VLSI UNIVERSE
Complete ASIC design flow - VLSI UNIVERSEComplete ASIC design flow - VLSI UNIVERSE
Complete ASIC design flow - VLSI UNIVERSEVLSIUNIVERSE
 
Build enterprise wireless with CAPsMAN
Build enterprise wireless with CAPsMANBuild enterprise wireless with CAPsMAN
Build enterprise wireless with CAPsMANGLC Networks
 

Was ist angesagt? (12)

Ceh
CehCeh
Ceh
 
The Easytrieve Presention by Srinimf
The Easytrieve Presention by SrinimfThe Easytrieve Presention by Srinimf
The Easytrieve Presention by Srinimf
 
Tunnel vs VPN on Mikrotik
Tunnel vs VPN on MikrotikTunnel vs VPN on Mikrotik
Tunnel vs VPN on Mikrotik
 
Hacktivity 2016: Stealthy, hypervisor based malware analysis
Hacktivity 2016: Stealthy, hypervisor based malware analysisHacktivity 2016: Stealthy, hypervisor based malware analysis
Hacktivity 2016: Stealthy, hypervisor based malware analysis
 
Speed layer : Real time views in LAMBDA architecture
Speed layer : Real time views in LAMBDA architecture Speed layer : Real time views in LAMBDA architecture
Speed layer : Real time views in LAMBDA architecture
 
Army plan for Cyber Offensive Operations -- ESF 18
Army plan for Cyber Offensive Operations -- ESF 18Army plan for Cyber Offensive Operations -- ESF 18
Army plan for Cyber Offensive Operations -- ESF 18
 
EC-Council Certification Roadmap and Course Catalog
EC-Council Certification Roadmap and Course CatalogEC-Council Certification Roadmap and Course Catalog
EC-Council Certification Roadmap and Course Catalog
 
Complete ASIC design flow - VLSI UNIVERSE
Complete ASIC design flow - VLSI UNIVERSEComplete ASIC design flow - VLSI UNIVERSE
Complete ASIC design flow - VLSI UNIVERSE
 
Embedded systems
Embedded systemsEmbedded systems
Embedded systems
 
Coverage and Introduction to UVM
Coverage and Introduction to UVMCoverage and Introduction to UVM
Coverage and Introduction to UVM
 
Build enterprise wireless with CAPsMAN
Build enterprise wireless with CAPsMANBuild enterprise wireless with CAPsMAN
Build enterprise wireless with CAPsMAN
 
DSP Processor.pptx
DSP Processor.pptxDSP Processor.pptx
DSP Processor.pptx
 

Andere mochten auch

Synack cirtical infrasructure webinar
Synack cirtical infrasructure webinarSynack cirtical infrasructure webinar
Synack cirtical infrasructure webinarSynack
 
[DefCon 2016] I got 99 Problems, but 
Little Snitch ain’t one!
[DefCon 2016] I got 99 Problems, but 
Little Snitch ain’t one![DefCon 2016] I got 99 Problems, but 
Little Snitch ain’t one!
[DefCon 2016] I got 99 Problems, but 
Little Snitch ain’t one!Synack
 
Zeronights 2016 - Automating iOS blackbox security scanning
Zeronights 2016 - Automating iOS blackbox security scanningZeronights 2016 - Automating iOS blackbox security scanning
Zeronights 2016 - Automating iOS blackbox security scanningSynack
 
Jesusparablesaboutmoney 12737974976907-phpapp02
Jesusparablesaboutmoney 12737974976907-phpapp02Jesusparablesaboutmoney 12737974976907-phpapp02
Jesusparablesaboutmoney 12737974976907-phpapp02Sonu Jena
 
Ma10バックエンドレスサンプルアプリ(android編)の説明
Ma10バックエンドレスサンプルアプリ(android編)の説明Ma10バックエンドレスサンプルアプリ(android編)の説明
Ma10バックエンドレスサンプルアプリ(android編)の説明acrodea
 
iOS Automation Primitives
iOS Automation PrimitivesiOS Automation Primitives
iOS Automation PrimitivesSynack
 
Networkingtips 130213160947-phpapp02
Networkingtips 130213160947-phpapp02Networkingtips 130213160947-phpapp02
Networkingtips 130213160947-phpapp02Sonu Jena
 
Thai horror cinema (lee sweetwan)
Thai horror cinema (lee sweetwan)Thai horror cinema (lee sweetwan)
Thai horror cinema (lee sweetwan)Xiao Yun
 
DEF CON 23: Stick That In Your (root)Pipe & Smoke It
DEF CON 23: Stick That In Your (root)Pipe & Smoke ItDEF CON 23: Stick That In Your (root)Pipe & Smoke It
DEF CON 23: Stick That In Your (root)Pipe & Smoke ItSynack
 
OS X Malware: Let's Play Doctor
OS X Malware: Let's Play DoctorOS X Malware: Let's Play Doctor
OS X Malware: Let's Play DoctorSynack
 
Qcl 14-v3 _Problem Solving_SIMSREE_Divya Adity Selvaraj Nadar
Qcl 14-v3 _Problem Solving_SIMSREE_Divya Adity Selvaraj NadarQcl 14-v3 _Problem Solving_SIMSREE_Divya Adity Selvaraj Nadar
Qcl 14-v3 _Problem Solving_SIMSREE_Divya Adity Selvaraj NadarDivya Nadar
 
преимущества и недостатки интернета
преимущества и недостатки интернетапреимущества и недостатки интернета
преимущества и недостатки интернетаAy_sel
 

Andere mochten auch (20)

Synack cirtical infrasructure webinar
Synack cirtical infrasructure webinarSynack cirtical infrasructure webinar
Synack cirtical infrasructure webinar
 
[DefCon 2016] I got 99 Problems, but 
Little Snitch ain’t one!
[DefCon 2016] I got 99 Problems, but 
Little Snitch ain’t one![DefCon 2016] I got 99 Problems, but 
Little Snitch ain’t one!
[DefCon 2016] I got 99 Problems, but 
Little Snitch ain’t one!
 
Zeronights 2016 - Automating iOS blackbox security scanning
Zeronights 2016 - Automating iOS blackbox security scanningZeronights 2016 - Automating iOS blackbox security scanning
Zeronights 2016 - Automating iOS blackbox security scanning
 
Sip structural insulated panels
Sip structural insulated panelsSip structural insulated panels
Sip structural insulated panels
 
Jesusparablesaboutmoney 12737974976907-phpapp02
Jesusparablesaboutmoney 12737974976907-phpapp02Jesusparablesaboutmoney 12737974976907-phpapp02
Jesusparablesaboutmoney 12737974976907-phpapp02
 
400 blows
400 blows400 blows
400 blows
 
Ma10バックエンドレスサンプルアプリ(android編)の説明
Ma10バックエンドレスサンプルアプリ(android編)の説明Ma10バックエンドレスサンプルアプリ(android編)の説明
Ma10バックエンドレスサンプルアプリ(android編)の説明
 
Mgo+eps+mgo structural insulated panels
Mgo+eps+mgo structural insulated panelsMgo+eps+mgo structural insulated panels
Mgo+eps+mgo structural insulated panels
 
Sips structural insulated panel pressing machine
Sips structural insulated panel pressing machineSips structural insulated panel pressing machine
Sips structural insulated panel pressing machine
 
TAPipedia User Tutorial
TAPipedia User TutorialTAPipedia User Tutorial
TAPipedia User Tutorial
 
iOS Automation Primitives
iOS Automation PrimitivesiOS Automation Primitives
iOS Automation Primitives
 
Osb sips structrual insulated panels
Osb sips structrual insulated panelsOsb sips structrual insulated panels
Osb sips structrual insulated panels
 
Log
LogLog
Log
 
Networkingtips 130213160947-phpapp02
Networkingtips 130213160947-phpapp02Networkingtips 130213160947-phpapp02
Networkingtips 130213160947-phpapp02
 
Thai horror cinema (lee sweetwan)
Thai horror cinema (lee sweetwan)Thai horror cinema (lee sweetwan)
Thai horror cinema (lee sweetwan)
 
DEF CON 23: Stick That In Your (root)Pipe & Smoke It
DEF CON 23: Stick That In Your (root)Pipe & Smoke ItDEF CON 23: Stick That In Your (root)Pipe & Smoke It
DEF CON 23: Stick That In Your (root)Pipe & Smoke It
 
OS X Malware: Let's Play Doctor
OS X Malware: Let's Play DoctorOS X Malware: Let's Play Doctor
OS X Malware: Let's Play Doctor
 
Qcl 14-v3 _Problem Solving_SIMSREE_Divya Adity Selvaraj Nadar
Qcl 14-v3 _Problem Solving_SIMSREE_Divya Adity Selvaraj NadarQcl 14-v3 _Problem Solving_SIMSREE_Divya Adity Selvaraj Nadar
Qcl 14-v3 _Problem Solving_SIMSREE_Divya Adity Selvaraj Nadar
 
преимущества и недостатки интернета
преимущества и недостатки интернетапреимущества и недостатки интернета
преимущества и недостатки интернета
 
Fiber cement eps fiber cement structural insulated panels
Fiber cement eps fiber cement structural insulated panelsFiber cement eps fiber cement structural insulated panels
Fiber cement eps fiber cement structural insulated panels
 

Ähnlich wie Black Hat '15: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex Data Service

Lecture intro to_wcdma
Lecture intro to_wcdmaLecture intro to_wcdma
Lecture intro to_wcdmaGurpreet Singh
 
Behavioral modeling of Clock/Data Recovery
Behavioral modeling of Clock/Data RecoveryBehavioral modeling of Clock/Data Recovery
Behavioral modeling of Clock/Data RecoveryArrow Devices
 
Signal Integrity - A Crash Course [R Lott]
Signal Integrity - A Crash Course [R Lott]Signal Integrity - A Crash Course [R Lott]
Signal Integrity - A Crash Course [R Lott]Ryan Lott
 
802.11 technology overview
802.11 technology overview802.11 technology overview
802.11 technology overviewsureshkumarmss
 
Digital communication
Digital communicationDigital communication
Digital communicationmeashi
 
Orthogonal Frequency Division Multiplexing.ppt
Orthogonal Frequency Division Multiplexing.pptOrthogonal Frequency Division Multiplexing.ppt
Orthogonal Frequency Division Multiplexing.pptStefan Oprea
 
Screaming Channels: When Electromagnetic Side Channels Meet Radio Transceivers
Screaming Channels: When Electromagnetic Side Channels Meet Radio TransceiversScreaming Channels: When Electromagnetic Side Channels Meet Radio Transceivers
Screaming Channels: When Electromagnetic Side Channels Meet Radio TransceiversPriyanka Aash
 
1999 si pi_dws_training_course
1999 si pi_dws_training_course1999 si pi_dws_training_course
1999 si pi_dws_training_coursePiero Belforte
 
EC8395 COMMUNICATION ENGINEERING UNIT V
EC8395 COMMUNICATION ENGINEERING UNIT V EC8395 COMMUNICATION ENGINEERING UNIT V
EC8395 COMMUNICATION ENGINEERING UNIT V ManojKumar791621
 
Lecture_1 (1).pptx
Lecture_1 (1).pptxLecture_1 (1).pptx
Lecture_1 (1).pptxDavidHamxa
 
Introduction to spred spectrum and CDMA
Introduction to spred spectrum and CDMAIntroduction to spred spectrum and CDMA
Introduction to spred spectrum and CDMABidhan Ghimire
 
Webinar Keysight: Soluções de Teste para Tecnologias Emergentes 5G-NR e IoT-L...
Webinar Keysight: Soluções de Teste para Tecnologias Emergentes 5G-NR e IoT-L...Webinar Keysight: Soluções de Teste para Tecnologias Emergentes 5G-NR e IoT-L...
Webinar Keysight: Soluções de Teste para Tecnologias Emergentes 5G-NR e IoT-L...Embarcados
 
SPREAD SPECTRUM MODULATION.pptx
SPREAD SPECTRUM MODULATION.pptxSPREAD SPECTRUM MODULATION.pptx
SPREAD SPECTRUM MODULATION.pptxDeepakBaghel50
 
Radio Signal Classification with Deep Neural Networks
Radio Signal Classification with Deep Neural NetworksRadio Signal Classification with Deep Neural Networks
Radio Signal Classification with Deep Neural NetworksKachi Odoemene
 
Speaker Dependent WaveNet Vocoder
Speaker Dependent WaveNet VocoderSpeaker Dependent WaveNet Vocoder
Speaker Dependent WaveNet VocoderAkira Tamamori
 
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.pptLectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.pptShamsAli42
 
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.pptLectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.pptArnabChakraborty499766
 

Ähnlich wie Black Hat '15: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex Data Service (20)

Lecture intro to_wcdma
Lecture intro to_wcdmaLecture intro to_wcdma
Lecture intro to_wcdma
 
Behavioral modeling of Clock/Data Recovery
Behavioral modeling of Clock/Data RecoveryBehavioral modeling of Clock/Data Recovery
Behavioral modeling of Clock/Data Recovery
 
Signal Integrity - A Crash Course [R Lott]
Signal Integrity - A Crash Course [R Lott]Signal Integrity - A Crash Course [R Lott]
Signal Integrity - A Crash Course [R Lott]
 
802.11 technology overview
802.11 technology overview802.11 technology overview
802.11 technology overview
 
Digital communication
Digital communicationDigital communication
Digital communication
 
Orthogonal Frequency Division Multiplexing.ppt
Orthogonal Frequency Division Multiplexing.pptOrthogonal Frequency Division Multiplexing.ppt
Orthogonal Frequency Division Multiplexing.ppt
 
Screaming Channels: When Electromagnetic Side Channels Meet Radio Transceivers
Screaming Channels: When Electromagnetic Side Channels Meet Radio TransceiversScreaming Channels: When Electromagnetic Side Channels Meet Radio Transceivers
Screaming Channels: When Electromagnetic Side Channels Meet Radio Transceivers
 
1999 si pi_dws_training_course
1999 si pi_dws_training_course1999 si pi_dws_training_course
1999 si pi_dws_training_course
 
EC8395 COMMUNICATION ENGINEERING UNIT V
EC8395 COMMUNICATION ENGINEERING UNIT V EC8395 COMMUNICATION ENGINEERING UNIT V
EC8395 COMMUNICATION ENGINEERING UNIT V
 
Lecture_1 (1).pptx
Lecture_1 (1).pptxLecture_1 (1).pptx
Lecture_1 (1).pptx
 
cdma2000_Fundamentals.pdf
cdma2000_Fundamentals.pdfcdma2000_Fundamentals.pdf
cdma2000_Fundamentals.pdf
 
Introduction to spred spectrum and CDMA
Introduction to spred spectrum and CDMAIntroduction to spred spectrum and CDMA
Introduction to spred spectrum and CDMA
 
Pass band transmission
Pass band transmission Pass band transmission
Pass band transmission
 
Webinar Keysight: Soluções de Teste para Tecnologias Emergentes 5G-NR e IoT-L...
Webinar Keysight: Soluções de Teste para Tecnologias Emergentes 5G-NR e IoT-L...Webinar Keysight: Soluções de Teste para Tecnologias Emergentes 5G-NR e IoT-L...
Webinar Keysight: Soluções de Teste para Tecnologias Emergentes 5G-NR e IoT-L...
 
Gps signals
Gps signalsGps signals
Gps signals
 
SPREAD SPECTRUM MODULATION.pptx
SPREAD SPECTRUM MODULATION.pptxSPREAD SPECTRUM MODULATION.pptx
SPREAD SPECTRUM MODULATION.pptx
 
Radio Signal Classification with Deep Neural Networks
Radio Signal Classification with Deep Neural NetworksRadio Signal Classification with Deep Neural Networks
Radio Signal Classification with Deep Neural Networks
 
Speaker Dependent WaveNet Vocoder
Speaker Dependent WaveNet VocoderSpeaker Dependent WaveNet Vocoder
Speaker Dependent WaveNet Vocoder
 
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.pptLectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
 
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.pptLectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
Lectures 1-2 Time-Domain Characterization of LTI Discrete-Time Systems.ppt
 

Mehr von Synack

RSA OSX Malware
RSA OSX MalwareRSA OSX Malware
RSA OSX MalwareSynack
 
Gatekeeper Exposed
Gatekeeper ExposedGatekeeper Exposed
Gatekeeper ExposedSynack
 
Virus Bulletin 2015: Exposing Gatekeeper
Virus Bulletin 2015: Exposing GatekeeperVirus Bulletin 2015: Exposing Gatekeeper
Virus Bulletin 2015: Exposing GatekeeperSynack
 
DEF CON 23: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex ...
DEF CON 23: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex ...DEF CON 23: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex ...
DEF CON 23: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex ...Synack
 
DEF CON 23: 'DLL Hijacking' on OS X? #@%& Yeah!
DEF CON 23: 'DLL Hijacking' on OS X? #@%& Yeah!DEF CON 23: 'DLL Hijacking' on OS X? #@%& Yeah!
DEF CON 23: 'DLL Hijacking' on OS X? #@%& Yeah!Synack
 
DEF CON 23: Internet of Things: Hacking 14 Devices
DEF CON 23: Internet of Things: Hacking 14 DevicesDEF CON 23: Internet of Things: Hacking 14 Devices
DEF CON 23: Internet of Things: Hacking 14 DevicesSynack
 
Black Hat '15: Writing Bad @$$ Malware for OS X
Black Hat '15: Writing Bad @$$ Malware for OS XBlack Hat '15: Writing Bad @$$ Malware for OS X
Black Hat '15: Writing Bad @$$ Malware for OS XSynack
 
DLL Hijacking on OS X
DLL Hijacking on OS XDLL Hijacking on OS X
DLL Hijacking on OS XSynack
 
Electromagnetic Hypersensitivity and You
Electromagnetic Hypersensitivity and YouElectromagnetic Hypersensitivity and You
Electromagnetic Hypersensitivity and YouSynack
 
Home Automation Benchmarking Report
Home Automation Benchmarking ReportHome Automation Benchmarking Report
Home Automation Benchmarking ReportSynack
 
Let's Hack a House
Let's Hack a HouseLet's Hack a House
Let's Hack a HouseSynack
 
Synack at AppSec California with Patrick Wardle
Synack at AppSec California with Patrick WardleSynack at AppSec California with Patrick Wardle
Synack at AppSec California with Patrick WardleSynack
 
Synack at AppSec California 2015 - Geolocation Vulnerabilities
Synack at AppSec California 2015 - Geolocation VulnerabilitiesSynack at AppSec California 2015 - Geolocation Vulnerabilities
Synack at AppSec California 2015 - Geolocation VulnerabilitiesSynack
 
Synack at ShmooCon 2015
Synack at ShmooCon 2015Synack at ShmooCon 2015
Synack at ShmooCon 2015Synack
 

Mehr von Synack (14)

RSA OSX Malware
RSA OSX MalwareRSA OSX Malware
RSA OSX Malware
 
Gatekeeper Exposed
Gatekeeper ExposedGatekeeper Exposed
Gatekeeper Exposed
 
Virus Bulletin 2015: Exposing Gatekeeper
Virus Bulletin 2015: Exposing GatekeeperVirus Bulletin 2015: Exposing Gatekeeper
Virus Bulletin 2015: Exposing Gatekeeper
 
DEF CON 23: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex ...
DEF CON 23: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex ...DEF CON 23: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex ...
DEF CON 23: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex ...
 
DEF CON 23: 'DLL Hijacking' on OS X? #@%& Yeah!
DEF CON 23: 'DLL Hijacking' on OS X? #@%& Yeah!DEF CON 23: 'DLL Hijacking' on OS X? #@%& Yeah!
DEF CON 23: 'DLL Hijacking' on OS X? #@%& Yeah!
 
DEF CON 23: Internet of Things: Hacking 14 Devices
DEF CON 23: Internet of Things: Hacking 14 DevicesDEF CON 23: Internet of Things: Hacking 14 Devices
DEF CON 23: Internet of Things: Hacking 14 Devices
 
Black Hat '15: Writing Bad @$$ Malware for OS X
Black Hat '15: Writing Bad @$$ Malware for OS XBlack Hat '15: Writing Bad @$$ Malware for OS X
Black Hat '15: Writing Bad @$$ Malware for OS X
 
DLL Hijacking on OS X
DLL Hijacking on OS XDLL Hijacking on OS X
DLL Hijacking on OS X
 
Electromagnetic Hypersensitivity and You
Electromagnetic Hypersensitivity and YouElectromagnetic Hypersensitivity and You
Electromagnetic Hypersensitivity and You
 
Home Automation Benchmarking Report
Home Automation Benchmarking ReportHome Automation Benchmarking Report
Home Automation Benchmarking Report
 
Let's Hack a House
Let's Hack a HouseLet's Hack a House
Let's Hack a House
 
Synack at AppSec California with Patrick Wardle
Synack at AppSec California with Patrick WardleSynack at AppSec California with Patrick Wardle
Synack at AppSec California with Patrick Wardle
 
Synack at AppSec California 2015 - Geolocation Vulnerabilities
Synack at AppSec California 2015 - Geolocation VulnerabilitiesSynack at AppSec California 2015 - Geolocation Vulnerabilities
Synack at AppSec California 2015 - Geolocation Vulnerabilities
 
Synack at ShmooCon 2015
Synack at ShmooCon 2015Synack at ShmooCon 2015
Synack at ShmooCon 2015
 

Kürzlich hochgeladen

Bird eye's view on Camunda open source ecosystem
Bird eye's view on Camunda open source ecosystemBird eye's view on Camunda open source ecosystem
Bird eye's view on Camunda open source ecosystemAsko Soukka
 
Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1DianaGray10
 
Linked Data in Production: Moving Beyond Ontologies
Linked Data in Production: Moving Beyond OntologiesLinked Data in Production: Moving Beyond Ontologies
Linked Data in Production: Moving Beyond OntologiesDavid Newbury
 
UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8DianaGray10
 
Do we need a new standard for visualizing the invisible?
Do we need a new standard for visualizing the invisible?Do we need a new standard for visualizing the invisible?
Do we need a new standard for visualizing the invisible?SANGHEE SHIN
 
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...Aggregage
 
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...UbiTrack UK
 
NIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopNIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopBachir Benyammi
 
Salesforce Miami User Group Event - 1st Quarter 2024
Salesforce Miami User Group Event - 1st Quarter 2024Salesforce Miami User Group Event - 1st Quarter 2024
Salesforce Miami User Group Event - 1st Quarter 2024SkyPlanner
 
UiPath Community: AI for UiPath Automation Developers
UiPath Community: AI for UiPath Automation DevelopersUiPath Community: AI for UiPath Automation Developers
UiPath Community: AI for UiPath Automation DevelopersUiPathCommunity
 
Introduction to Matsuo Laboratory (ENG).pptx
Introduction to Matsuo Laboratory (ENG).pptxIntroduction to Matsuo Laboratory (ENG).pptx
Introduction to Matsuo Laboratory (ENG).pptxMatsuo Lab
 
RAG Patterns and Vector Search in Generative AI
RAG Patterns and Vector Search in Generative AIRAG Patterns and Vector Search in Generative AI
RAG Patterns and Vector Search in Generative AIUdaiappa Ramachandran
 
9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding Team9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding TeamAdam Moalla
 
Nanopower In Semiconductor Industry.pdf
Nanopower  In Semiconductor Industry.pdfNanopower  In Semiconductor Industry.pdf
Nanopower In Semiconductor Industry.pdfPedro Manuel
 
Spring24-Release Overview - Wellingtion User Group-1.pdf
Spring24-Release Overview - Wellingtion User Group-1.pdfSpring24-Release Overview - Wellingtion User Group-1.pdf
Spring24-Release Overview - Wellingtion User Group-1.pdfAnna Loughnan Colquhoun
 
Digital magic. A small project for controlling smart light bulbs.
Digital magic. A small project for controlling smart light bulbs.Digital magic. A small project for controlling smart light bulbs.
Digital magic. A small project for controlling smart light bulbs.francesco barbera
 
OpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureOpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureEric D. Schabell
 
AI Fame Rush Review – Virtual Influencer Creation In Just Minutes
AI Fame Rush Review – Virtual Influencer Creation In Just MinutesAI Fame Rush Review – Virtual Influencer Creation In Just Minutes
AI Fame Rush Review – Virtual Influencer Creation In Just MinutesMd Hossain Ali
 
Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Commit University
 
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdfIaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdfDaniel Santiago Silva Capera
 

Kürzlich hochgeladen (20)

Bird eye's view on Camunda open source ecosystem
Bird eye's view on Camunda open source ecosystemBird eye's view on Camunda open source ecosystem
Bird eye's view on Camunda open source ecosystem
 
Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1
 
Linked Data in Production: Moving Beyond Ontologies
Linked Data in Production: Moving Beyond OntologiesLinked Data in Production: Moving Beyond Ontologies
Linked Data in Production: Moving Beyond Ontologies
 
UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8
 
Do we need a new standard for visualizing the invisible?
Do we need a new standard for visualizing the invisible?Do we need a new standard for visualizing the invisible?
Do we need a new standard for visualizing the invisible?
 
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
 
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
 
NIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopNIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 Workshop
 
Salesforce Miami User Group Event - 1st Quarter 2024
Salesforce Miami User Group Event - 1st Quarter 2024Salesforce Miami User Group Event - 1st Quarter 2024
Salesforce Miami User Group Event - 1st Quarter 2024
 
UiPath Community: AI for UiPath Automation Developers
UiPath Community: AI for UiPath Automation DevelopersUiPath Community: AI for UiPath Automation Developers
UiPath Community: AI for UiPath Automation Developers
 
Introduction to Matsuo Laboratory (ENG).pptx
Introduction to Matsuo Laboratory (ENG).pptxIntroduction to Matsuo Laboratory (ENG).pptx
Introduction to Matsuo Laboratory (ENG).pptx
 
RAG Patterns and Vector Search in Generative AI
RAG Patterns and Vector Search in Generative AIRAG Patterns and Vector Search in Generative AI
RAG Patterns and Vector Search in Generative AI
 
9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding Team9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding Team
 
Nanopower In Semiconductor Industry.pdf
Nanopower  In Semiconductor Industry.pdfNanopower  In Semiconductor Industry.pdf
Nanopower In Semiconductor Industry.pdf
 
Spring24-Release Overview - Wellingtion User Group-1.pdf
Spring24-Release Overview - Wellingtion User Group-1.pdfSpring24-Release Overview - Wellingtion User Group-1.pdf
Spring24-Release Overview - Wellingtion User Group-1.pdf
 
Digital magic. A small project for controlling smart light bulbs.
Digital magic. A small project for controlling smart light bulbs.Digital magic. A small project for controlling smart light bulbs.
Digital magic. A small project for controlling smart light bulbs.
 
OpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureOpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability Adventure
 
AI Fame Rush Review – Virtual Influencer Creation In Just Minutes
AI Fame Rush Review – Virtual Influencer Creation In Just MinutesAI Fame Rush Review – Virtual Influencer Creation In Just Minutes
AI Fame Rush Review – Virtual Influencer Creation In Just Minutes
 
Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)
 
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdfIaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
 

Black Hat '15: Spread Spectrum Satcom Hacking: Attacking The GlobalStar Simplex Data Service