6 ms·

Some of the stuff that was extracted from the unencrypted traffic in the link: - T-Mobile backhaul: Users' SMS, voice call contents and internet traffic conten

by vayup 11mo ago

Some of the stuff that was extracted from the unencrypted traffic in the link: - T-Mobile backhaul: Users' SMS, voice call contents and internet traffic content in plain text. - AT&T Mexico cellular backhaul: Raw user internet traffic - TelMex VOIP on satellite backhaul: Plaintext voice calls - U.S. military: SIP traffic exposing ship names - Mexico government and military: Unencrypted intra-government traffic - Walmart Mexico: Unencrypted corporate emails, plaintext credentials to inventory management systems, inventory records transferred and updated using FTP This is insane! While it is important to work on futuristic threats such as Quantum cryptanalysis, backdoors in standardized cryptographic protocols, etc. - the unfortunate reality is that the vast majority of real-world attacks happen because basic protection is not enabled. Good reminder not take our eyes off the basics.

CGMthrowaway 11mo ago
Is there a git repo that lets one read this stuff in real time yet?
zelos 11mo ago
> Real-time military object telemetry with precise geolocation, identifiers, and live telemetry Oops
- NoiseBert69 11mo ago
  Pulls out the bamboo whip Another round of OpSec training
  - atoav 11mo ago
    Why? I thought we are now clear on OpSec?
    - 1oooqooq 11mo ago
      that message was about the inner circle of the regime, to discuss the plans to sabotage opsec elsewhere. anyway, but even that had a joke of opsec.
    - misswaterfairy 11mo ago
      Perhaps not in the clear for OpSec purposes...
alfiedotwtf 11mo ago
> This is insane! Not as insane as it was in the early 2000s… > while link-layer encryption has been standard practice in satellite TV for decades Before Snowden, I would say 99% of ALL TCP traffic I saw on satellites was in unadulterated plain-text. Web and email mostly. … the pipe was so fast, you could only pcap if you had a SCSI hard drive!
- deleted 11mo ago
  [deleted]
- T3OU-736 11mo ago
```… the pipe was so fast, you could only pcap if you had a SCSI hard drive!``` This is why NSA asked for (and got from SGI) a guranteed rate I/O API - to make sure that whstever the signal intelkigence platform sensors captured could be written to storage.
- petercooper 11mo ago
  I was exposed to some of this as a teenager due to a (now dead) family member being heavily into telecoms. You could receive and process POCSAG (the protocol used by paging systems) to pretty much read the entire stream of unencrypted, plain text pager messages going out over the wire. You could also reprogram a generic pager to receive pages for whatever number you liked. You could also transmit your own POCSAG and send any number a page (only within your transmission range). SMS was also a bit like this in its early days and you could read them coming off the local cell (also true of calls at a certain time, but I didn't see much of this). I just did a quick search and apparently many pagers in the UK are still running cleartext POCSAG! https://www.reddit.com/r/RTLSDR/comments/1asnchu/are_uk_pagers_going_encrypted/ https://www.reddit.com/r/RTLSDR/comments/1asnchu/are_uk_page...
  - tmjwid 11mo ago
    Yeah POCSAG is not encrypted here in the UK. You can still see all the emergency information from around the country unencrypted in realtime. They even broadcast the details of the emergency and a lot of times it's not nice. You do/did get some bird watching sightings though!
feraloink 11mo ago
In https://satcom.sysnet.ucsd.edu/ https://satcom.sysnet.ucsd.edu/ Has The Issue Been Fixed section: >we re-scanned with their permission and were able to verify a remedy had been deployed: T-Mobile, WalMart, and KPU. The fact that critical infrastructure (e.g. utility companies using satellite links for remote-operated SCADA) was exposed is really scary too.
- colechristensen 11mo ago
  >The fact that critical infrastructure (e.g. utility companies using satellite links for remote-operated SCADA) was exposed is really scary too. Really serious security risks in critical/industrial infrastructure are ... numerous. And these aren't complex vulnerabilities, these are leaving the door open with default passwords, unencrypted traffic, and that sort of thing.
jabiko 11mo ago
When driving by Bad Aibling I always wondered why the BND (intelligence agency) invests so heavily in satellite communication eavesdropping. I naively assumed that this kind of communication would be encrypted. Also a fun fact: For a long time it was only semi-officially known that the BND owned and operated the site. Officially it was called "Long distance telecommunications station of the Bundeswehr" and operated by the "Federal Office for Telecommunications Statistics"
- MagnumOpus 11mo ago
  At least since the mid-1990s Echelon revelations in the EU parliament anybody who cares knows that Bad Aibling (and similar stations all across Europe like Bude/Morwenstow in the UK) had been operated by the NSA in collaboration with US Army intelligence (if the official name of “18th United States Army Security Agency Field Station” didn’t clue you in. Officially it has been transferred to the BND; experience suggests all data from there still goes straight back to Fort Meade… (And in exchange the BND gets some morsels back on people _they_ are not allowed to spy on publicly.)
  - unit149 11mo ago
    [dead]
RajT88 11mo ago
I'm waiting for IT departments worldwide to wake up to the threat that your browsers are leaking all of your URI's by default back to the manufacturers. URI's leak company secrets. I'm sure there's some people at Google using Edge which are leaking company data to Microsoft. I'm sure there's some people at Microsoft using Chrome which are leaking data to Google. Edge and Chrome both send back every URI you visit to "improve search results" or to "sync history across devices". It's not clear if this includes private mode traffic or not (they don't say). Huge privacy hole to allow this, and nobody seems to be aware or care.
- pengaru 11mo ago
  Wait til you hear about how many companies willfully perform all their work in g-suite and office 365/teams
  - RajT88 11mo ago
    Indeed. And they are trying to find sneaky ways to get you to back up more and more data there. They do have privacy policies which say they won't sell that data, or use it for advertising or anything other than delivering the service. But - who knows if that is true? There's no oversight. And if they get caught breaking that privacy policy, who has the appetite these days to do anything meaningful in terms penalties? Nobody.
    - shadowgovt 11mo ago
      I believe the point of the above comment is "The trust model already trusts the recipient, so nobody cares that the recipient is seeing query params because they trust the recipient to ignore them." > who knows if that is true? There's no oversight The oversight is that those companies rely heavily on being trustworthy, and proving untrustworthy would be disastrous for their business models. Companies don't have to care right now because they have reason to believe Google, MS, et. al. aren't sniffing that data. If they came to believe they were? Google alone is making $43 billion on Cloud and would prefer not to jeopardize that revenue stream.
rurban 11mo ago
Did you check how hospitals or governments treat sensitive patient data? They are transported in clear (no TLS) over the net from the hospital or ensurers databases to the practitioners. Not on 80, but still just plain DICOM XML. With full names and all the sensitive data. That's a bit more insane IMHO. The new German ecard patient system is also trivial to hack, as shown multiple times on CCC. As long as no one goes to jail, they will continue like this.

by vayup 11mo ago

CGMthrowaway 11mo ago

Is there a git repo that lets one read this stuff in real time yet?

zelos 11mo ago

> Real-time military object telemetry with precise geolocation, identifiers, and live telemetry Oops

NoiseBert69 11mo ago
Pulls out the bamboo whip Another round of OpSec training
- atoav 11mo ago
  Why? I thought we are now clear on OpSec?
  - 1oooqooq 11mo ago
    that message was about the inner circle of the regime, to discuss the plans to sabotage opsec elsewhere. anyway, but even that had a joke of opsec.
  - misswaterfairy 11mo ago
    Perhaps not in the clear for OpSec purposes...

alfiedotwtf 11mo ago

> This is insane! Not as insane as it was in the early 2000s… > while link-layer encryption has been standard practice in satellite TV for decades Before Snowden, I would say 99% of ALL TCP traffic I saw on satellites was in unadulterated plain-text. Web and email mostly. … the pipe was so fast, you could only pcap if you had a SCSI hard drive!

deleted 11mo ago
[deleted]
T3OU-736 11mo ago
```… the pipe was so fast, you could only pcap if you had a SCSI hard drive!``` This is why NSA asked for (and got from SGI) a guranteed rate I/O API - to make sure that whstever the signal intelkigence platform sensors captured could be written to storage.
petercooper 11mo ago
I was exposed to some of this as a teenager due to a (now dead) family member being heavily into telecoms. You could receive and process POCSAG (the protocol used by paging systems) to pretty much read the entire stream of unencrypted, plain text pager messages going out over the wire. You could also reprogram a generic pager to receive pages for whatever number you liked. You could also transmit your own POCSAG and send any number a page (only within your transmission range). SMS was also a bit like this in its early days and you could read them coming off the local cell (also true of calls at a certain time, but I didn't see much of this). I just did a quick search and apparently many pagers in the UK are still running cleartext POCSAG! https://www.reddit.com/r/RTLSDR/comments/1asnchu/are_uk_pagers_going_encrypted/ https://www.reddit.com/r/RTLSDR/comments/1asnchu/are_uk_page...
- tmjwid 11mo ago
  Yeah POCSAG is not encrypted here in the UK. You can still see all the emergency information from around the country unencrypted in realtime. They even broadcast the details of the emergency and a lot of times it's not nice. You do/did get some bird watching sightings though!

feraloink 11mo ago

In https://satcom.sysnet.ucsd.edu/ https://satcom.sysnet.ucsd.edu/ Has The Issue Been Fixed section: >we re-scanned with their permission and were able to verify a remedy had been deployed: T-Mobile, WalMart, and KPU. The fact that critical infrastructure (e.g. utility companies using satellite links for remote-operated SCADA) was exposed is really scary too.

colechristensen 11mo ago
>The fact that critical infrastructure (e.g. utility companies using satellite links for remote-operated SCADA) was exposed is really scary too. Really serious security risks in critical/industrial infrastructure are ... numerous. And these aren't complex vulnerabilities, these are leaving the door open with default passwords, unencrypted traffic, and that sort of thing.

jabiko 11mo ago

When driving by Bad Aibling I always wondered why the BND (intelligence agency) invests so heavily in satellite communication eavesdropping. I naively assumed that this kind of communication would be encrypted. Also a fun fact: For a long time it was only semi-officially known that the BND owned and operated the site. Officially it was called "Long distance telecommunications station of the Bundeswehr" and operated by the "Federal Office for Telecommunications Statistics"

MagnumOpus 11mo ago
At least since the mid-1990s Echelon revelations in the EU parliament anybody who cares knows that Bad Aibling (and similar stations all across Europe like Bude/Morwenstow in the UK) had been operated by the NSA in collaboration with US Army intelligence (if the official name of “18th United States Army Security Agency Field Station” didn’t clue you in. Officially it has been transferred to the BND; experience suggests all data from there still goes straight back to Fort Meade… (And in exchange the BND gets some morsels back on people _they_ are not allowed to spy on publicly.)
- unit149 11mo ago
  [dead]

RajT88 11mo ago

I'm waiting for IT departments worldwide to wake up to the threat that your browsers are leaking all of your URI's by default back to the manufacturers. URI's leak company secrets. I'm sure there's some people at Google using Edge which are leaking company data to Microsoft. I'm sure there's some people at Microsoft using Chrome which are leaking data to Google. Edge and Chrome both send back every URI you visit to "improve search results" or to "sync history across devices". It's not clear if this includes private mode traffic or not (they don't say). Huge privacy hole to allow this, and nobody seems to be aware or care.

pengaru 11mo ago
Wait til you hear about how many companies willfully perform all their work in g-suite and office 365/teams
- RajT88 11mo ago
  Indeed. And they are trying to find sneaky ways to get you to back up more and more data there. They do have privacy policies which say they won't sell that data, or use it for advertising or anything other than delivering the service. But - who knows if that is true? There's no oversight. And if they get caught breaking that privacy policy, who has the appetite these days to do anything meaningful in terms penalties? Nobody.
  - shadowgovt 11mo ago
    I believe the point of the above comment is "The trust model already trusts the recipient, so nobody cares that the recipient is seeing query params because they trust the recipient to ignore them." > who knows if that is true? There's no oversight The oversight is that those companies rely heavily on being trustworthy, and proving untrustworthy would be disastrous for their business models. Companies don't have to care right now because they have reason to believe Google, MS, et. al. aren't sniffing that data. If they came to believe they were? Google alone is making $43 billion on Cloud and would prefer not to jeopardize that revenue stream.

rurban 11mo ago

Did you check how hospitals or governments treat sensitive patient data? They are transported in clear (no TLS) over the net from the hospital or ensurers databases to the practitioners. Not on 80, but still just plain DICOM XML. With full names and all the sensitive data. That's a bit more insane IMHO. The new German ecard patient system is also trivial to hack, as shown multiple times on CCC. As long as no one goes to jail, they will continue like this.