Millions of Satellite Receivers are Low-Hanging Fruit for Botnets

Satellite television is prevalent in Europe and Northern Africa. This is delivered through a Set Top Box (STB) which uses a card reader to decode the scrambled satellite signals. You need to buy a card if you want to watch. But you know how people like to get something for nothing. This is being exploited by hackers and the result is millions of these Set Top Boxes just waiting to form into botnets.

This was the topic of [Sofiane Talmat’s] talk at DEF CON 23. He also gave this talk earlier in the week at BlackHat and has published his slides (PDF).

stb-hardwareThe Hardware in Satellite receivers is running Linux. They use a card reader to pull in a Code Word (CW) which decodes the signal coming in through the satellite radio.

An entire black market has grown up around these Code Words. Instead of purchasing a valid card, people are installing plugins from the Internet which cause the system to phone into a server which will supply valid Code Words. This is known as “card sharing”.

On the user side of things this just works; the user watches TV for free. It might cause more crashes than normal, but the stock software is buggy anyway so this isn’t a major regression. The problem is that now these people have exposed a network-connected Linux box to the Internet and installed non-verified code from unreputable sources to run on the thing.

[Sofiane] demonstrated how little you need to know about this system to create a botnet:

  • Build a plugin in C/C++
  • Host a card-sharing server
  • Botnet victims come to you (profit)

It is literally that easy. The toolchain to compile the STLinux binaries (gcc) is available in the Linux repos. The STB will look for a “bin” directory on a USB thumb drive at boot time, the binary in that folder will be automatically installed. Since the user is getting free TV they voluntarily install this malware.

Click through for more on the STB Hacks.

Continue reading “Millions of Satellite Receivers are Low-Hanging Fruit for Botnets”

Hacklet 34 – Satellite Projects

Space. The final frontier. Every tinkerer, hacker, and maker has dreamed of flying out of Earth’s atmosphere and into the heavens. Last year one hard-working team got a chance to fly a member to space by winning the Hackaday prize. For the rest of us, we can still experience some of that excitement by contacting satellites in orbit, or even sending a bit of our own hardware into space. This week’s Hacklet focuses on the best satellite projects on!

basicSatWe start with [movax] and Your satellite devkit and launch. Chipsat is a tiny satellite which runs BASIC code. Yes, BASIC in space! Chipsats will be stacked into a launcher and sent off into space in groups. The idea is to eventually have them launched from the International Space Station. Power is provided by a small solar cell which charges up a pair of super capacitors. When the capacitors are charged, the satellite will run for a few seconds. Connectivity with the ground is via a 433 MHz link. Chipsat doesn’t just float in space, three coils give it the ability to control its attitude and rotation. Chipsat will sense the space around it with a magnetometer and a light sensor.



No satellite-themed Hacklet would be complete without [Pierros Papadeas] and his team’s work on SatNOGS – Global Network of Ground Stations. SatNOGS aims to create a global network of connected satellite ground stations. Think of it as a grass-roots version of NASA’s deep space network for satellites in earth orbit. This is more than just a great idea, as SatNOGS won the 2014 Hackaday Prize. You can check out our coverage of the project back in November, 2014. Since then, the SatNOGS team has been busy! They’ve just deployed the first SatNOGS V2 system above their hackerspace in Athens, Greece.

trsiNext up is TRSI PocketQub Satellite, another project by [movax]. TRSI is a satellite that sends data via images which can be viewed with a simple RTL-SDR stick using Hellschreiber mode. Hell mode means that images can be directly viewed in the waterfall display of whichever SDR application is running the receiver. Numbers or entire images snapped with TRSI’s cell phone style camera module can be encoded and displayed. Power is of course provided by solar cells, and the communications link will be on the coordinated 433 MHz band. The original TRSI hardware has actually morphed into a deployment machine for ChipSat, [morvax’s] other satellite project. He’s put the main TRSI program on hold until after the ChipSat campaign is complete.

pocketquRounding out our satellite special is [OzQube] with his project QubeCast Max. QubeCast is the first Australian version of the PocketQube PQ60 satellite form factor. After watching the success of $50Sat project, [OzQube] wanted to design a satellite of his own. Since he wanted to add sensors and send more data back to Earth than previous efforts, he needed a higher data rate than the current crop of satellites. This meant going to a high-powered radio. To achieve this, he’s using a  NiceRF RF4463F30 radio module. The module is based upon a Silicon Labs Si4463 RF ISM band chip, coupled with a power amplifier. The module outputs 1 watt, which is quite a bit of power for a tiny satellite!

Want more satellite goodness? Check out’s freshly minted Satellite List.

The countdown is almost at 0, so that’s just about all the time we have for this episode of the Hacklet. See you next week.  Same hack time, same hack channel, bringing you the best of!

Hackaday Prize Finalist: A Network of Satellite Ground Stations

There are astonishing things you can do with a network of sensors spread across the globe, all connected to the Internet. Thousands of people have already installed hardware to detect lightning and flightaware gives out subscriptions to their premium service to anyone who will listen in to airplane transponders and send data back to their servers. The folks behind SatNOGS, one of the five finalists for The Hackaday Prize are using this same crowdsourced data collection for something that is literally out of this world: listening to the ever-increasing number of amateur satellites orbiting the planet.

There are dozens of cubesats and other amateur satellites flying every year, and they have become an extremely popular way of experimenting in a space environment, giving some budding engineers an awesome project in school, and testing out some technologies that are just too weird for national space agencies. The problem with sending one of these birds up is getting the data back down; a satellite will pass above the horizon of a single location only a few times a day, and even then for only minutes at a time. The SatNOGS team hopes to change that by planting receivers all around the globe, connecting them to the Internet, and hopefully providing real-time telemetry from dozens of orbiting satellites.

[Pierros] from the SatNOGS team was kind enough to sit down and answer a few questions for us about his entry to The Hackaday Prize. That’s below, right after their finalist video. Some of the SatNOGS team will also be at our Munich event where we announce the winner of the Prize.

Continue reading “Hackaday Prize Finalist: A Network of Satellite Ground Stations”

SDR: Satellite Death Receiver

Halloween may be over, but [happysat] has found a way to listen to the dead. Satellites, that is, specifically those in the 136-138 MHz and 150-400 MHz ranges. He’s using an RTL-SDR dongle and a QFH antenna to detect the death throes of decommissioned navigation and space research satellites.

[happysat] was listening to NOAA/Meteor on the 137MHz band when he made this discovery. When a satellite is near end of life, the last bit of fuel is used to push it into graveyard orbit. This doesn’t always work, however, and when the light is just right, a chemical reaction makes the long-dead batteries conduct and these satellites in purgatory transmit once more.

They’re not sending out anything proprietary useful, just unmodulated carrier that sometimes interferes with currently operational satellites on the 136-138 MHz band. [happysat] captured some audio from two of the oldest satellites that are still broadcasting, and links to a TLE set of dead satellites he created. Check out his frequency database for SDR# as well. Don’t have a weather satellite-capable antenna? Build one!

[via /r/RTLSDR]

THP Entry: SatNOGS

NOGS Here’s an interesting thought: it’s possible to build a cubesat for perhaps ten thousand dollars, and hitch a ride on a launch for free thanks to a NASA outreach program. Tracking that satellite along its entire orbit would require dozens of ground stations, all equipped with antennas, USB TV tuners, and a connection to the Internet. It’s actually more expensive to build and launch a cubesat than it costs to build a network of ground stations to get reasonably real-time telemetry from a cubesat. The future is awesome and weird, it seems.

This is the observation the guys behind SatNOGS have made. They’re developing a platform for a completely open source ground station network, with the idea being people an institutions along every longitude and latitude would build a simple satellite tracking antenna mount, connect it to the Internet, and become part of an open source Near Space Network, capable of receiving telemetry from any one of the small cubesats whizzing around in low earth orbit.

Despite being what is probably one of the most ambitious and far-reaching projects in open source hardware, the design of the system is relatively simple: the hardware is a 3D printed alt-az mount, capable of pointing a pair of antennas anywhere in the sky. The stepper motor driver board is based on the Arduino, and the computer running each antenna node is powered by a BeagleBone Black or a WR703N router. The antenna receiver is, of course, an RTL-SDR dongle, capable of listening to all the common cubesat bands. Even the software is derived from open source projects. Tracking a satellite across the sky can be calculated with GPredict, and the team is working on an observation scheduling and management system that combines multiple ground stations for coverage across the globe.

It’s a great idea, crowdsourcing satellite tracking from people around the globe, and something that could be used by hundreds of institutions lucky enough to launch a small cube of electronics into orbit.

SpaceWrencherThe project featured in this post is an entry in The Hackaday Prize. Build something awesome and win a trip to space or hundreds of other prizes.

ISEE-3: Ready To Come Home


The team working to reboot the ISEE-3 satellite hurtling towards an August encounter with Earth is hard at work. They’ve put up a crowdfunding page, and now that they’re completely funded (don’t stop donating, btw), they’re starting to go deeper into the waters that will allow them to capture a forgotten satellite.

The project put up a status report going over what they’ve accomplished so far, and what work has yet to be done. For a few months now, they knew both transmitters aboard the craft were operational, but they were not sending telemetry. The team has gone through the documentation, came up with a set of commands, and are currently en route to Arecibo to transmit those commands.

Two ground station transmitters are being constructed, one specifically built to be installed at Arecibo for this application. The other is a portable, self-contained 700 watt transmitter that will be used at the official ISEE-3 ground station in Morehead State University in Kentucky.

With transmitters taken care of and receiving handled by an SDR from Ettus Research, a lot of work has focused on the command and telemetry systems.  In 1978, the user interface for commands and telemetry was primitive to say the least. The team is now working on a system built-in Labview that’s much easier on the eyes than the vintage text terminal screens.

So far, signals from ISEE-3 are planned to be received at Arecibo, Morehead State, and Bochum observatory in Germany. This will give the team extremely good coverage for most of a day, and there are other ground stations in California that will extend the time the team is able to communicate with ISSE-3 each day by a few hours.

There’s still a lot of work to be done; the team really doesn’t know what systems are still operating, although most of them did make it 20 years with only one fault. In the next few days, we’ll all get to see if this satellite will be up to the task of coming back home to Earth. If everything goes to plan, ISEE-3 will be on track towards a 17 hour burn to put it on the correct trajectory some time in mid June.

Listening To A Swarm Of Satellites In Orbit


A few months ago, we heard of a Kickstarter with an amazing goal: give everyone with $300 burning a hole in their pocket their very own satellite orbiting Earth. Time passes, the mothership has been launched, and in just a few short hours, over a hundred of these personal femtosatellites will be released into low Earth orbit.

The Kicksat consists of a 3U cubesat that was recently launched aboard the SpaceX CRS-3 mission to the International Space Station. Inside this cubesat are over one hundred satellites called Sprites, loaded up with solar cells, magnetometers, a microcontroller and a radio to communicate with ground stations below. The current mission is a proof of concept, but if everything goes as planned, similar satellites can be deployed into the path of incoming asteroids, or whenever a mission calls for a swarm of small smart devices covering a huge area.

Already the Kicksat mothership has been tracked by a few enterprising amateur radio enthusiasts but the deployment of the Sprites isn’t scheduled until today at 4:00 PM EDT (20:00 GMT). After that, the Sprites will be on their own, spewing out data and the initials of kickstarter backers to most of the population of Earth.

For anyone worrying about these Sprites causing an ablation cascade or a Kessler syndrome, don’t. Orbital decay is a function of surface area and mass, and these extremely lightweight thin rectangles will burn up in the atmosphere in a few week’s time. The lack of radiation hardening on the Sprites won’t be a problem, either. This shouldn’t be a surprise, as they’re orbiting well within our wonderful, protective magnetosphere, and there are digital cameras, tablets, and other much more radiation sensitive electronics that have been working perfectly on the ISS for years now.

You can check out the current location of the orbiting Kicksat mothership on the project website, read the updates on the project blog, or check out our coverage of the Kicksat program from last year’s world maker faire in New York. Relevant videos below.

Oh, and if you have a USB TV tuner, a good antenna, LNA, and some experience with SDR, here’s what you need to listen in.

Continue reading “Listening To A Swarm Of Satellites In Orbit”