Tweet
By Mike Szczys
Satellite television is prevalent in Europe and Northern Africa. This is delivered through a Set Top Box (STB) which uses a card reader to decode the scrambled satellite signals. You need to buy a card if you want to watch. But you know how people like to get something for nothing. This is being exploited by hackers, and the result is millions of these Set Top Boxes just waiting to form into botnets.
This was the topic of Sofiane Talmat's talk at DEF CON 23. He also gave this talk earlier in the week at BlackHat and has published his slides(PDF).
The Hardware in Satellite receivers is running Linux. They use a card reader to pull in a Code Word (CW) which decodes the signal coming in through the satellite radio.
An entire black market has grown up around these Code Words. Instead of purchasing a valid card, people are installing plugins from the Internet which cause the system to phone into a server which will supply valid Code Words. This is known as “card sharing”.
On the user side of things this just works; the user watches TV for free. It might cause more crashes than normal, but the stock software is buggy anyway so this isn’t a major regression. The problem is that now these people have exposed a network-connected Linux box to the Internet and installed non-verified code from unreputable sources to run on the thing.
Sofiane demonstrated how little you need to know about this system to create a botnet:
It is literally that easy. The toolchain to compile the STLinux binaries (gcc) is available in the Linux repos. The STB will look for a “bin” directory on a USB thumb drive at boot time, the binary in that folder will be automatically installed. Since the user is getting free TV they voluntarily install this malware.
Here’s a prime example of why you always want to verify the checksum when you download software to install on your own system. Sofiane researched the “same” software package for card sharing across many download sites on the internet and there were multiple different checksums. The assumption is that these are carrying different malware payloads.
In addition to this easy exploit, the boxes are broken by design anyway. There are no firewalls, there are secondary root accounts (back doors), there are FTP servers running by default with root privileges and no password. The most laughable vulnerability for me is that updates from the manufacturer don’t do anything to patch or improve the OS, they’re 100% user experience updates. The BusyBox build running on the demo machine was from 2012 and has multiple known vulnerabilities. Even if you don’t want to use a card sharing service, the device can be compromised just by being connected to the Internet.
This talk was presented in the IoT villiage, not on a main stage. This a great example of why you should take these talks seriously. You’ll get a much grittier explanation and demonstration of the hacks than on the highly-polished “Track” talks. You also have the opportunity to ask questions and it’s less likely people will be asking questions just to hear themselves talk (which happens far too often here).
Satellite television is prevalent in Europe and Northern Africa. This is delivered through a Set Top Box (STB) which uses a card reader to decode the scrambled satellite signals. You need to buy a card if you want to watch. But you know how people like to get something for nothing. This is being exploited by hackers, and the result is millions of these Set Top Boxes just waiting to form into botnets.
This was the topic of Sofiane Talmat's talk at DEF CON 23. He also gave this talk earlier in the week at BlackHat and has published his slides(PDF).
The Hardware in Satellite receivers is running Linux. They use a card reader to pull in a Code Word (CW) which decodes the signal coming in through the satellite radio.
An entire black market has grown up around these Code Words. Instead of purchasing a valid card, people are installing plugins from the Internet which cause the system to phone into a server which will supply valid Code Words. This is known as “card sharing”.
On the user side of things this just works; the user watches TV for free. It might cause more crashes than normal, but the stock software is buggy anyway so this isn’t a major regression. The problem is that now these people have exposed a network-connected Linux box to the Internet and installed non-verified code from unreputable sources to run on the thing.
Sofiane demonstrated how little you need to know about this system to create a botnet:
- Build a plugin in C/C++
- Host a card-sharing server
- Botnet victims come to you (profit)
It is literally that easy. The toolchain to compile the STLinux binaries (gcc) is available in the Linux repos. The STB will look for a “bin” directory on a USB thumb drive at boot time, the binary in that folder will be automatically installed. Since the user is getting free TV they voluntarily install this malware.
Here’s a prime example of why you always want to verify the checksum when you download software to install on your own system. Sofiane researched the “same” software package for card sharing across many download sites on the internet and there were multiple different checksums. The assumption is that these are carrying different malware payloads.
In addition to this easy exploit, the boxes are broken by design anyway. There are no firewalls, there are secondary root accounts (back doors), there are FTP servers running by default with root privileges and no password. The most laughable vulnerability for me is that updates from the manufacturer don’t do anything to patch or improve the OS, they’re 100% user experience updates. The BusyBox build running on the demo machine was from 2012 and has multiple known vulnerabilities. Even if you don’t want to use a card sharing service, the device can be compromised just by being connected to the Internet.
This talk was presented in the IoT villiage, not on a main stage. This a great example of why you should take these talks seriously. You’ll get a much grittier explanation and demonstration of the hacks than on the highly-polished “Track” talks. You also have the opportunity to ask questions and it’s less likely people will be asking questions just to hear themselves talk (which happens far too often here).