Explorer’s Guide to Shooting Satellite Transponders

~ Jay Turla

#! /usr/bin/whoami

• Application Security Engineer at Bugcrowd Inc.

• One of the goons of ROOTCON – the premiere hacking conference in the Philippines

• Former Senior Security Consultant at Hewlett-Packard Enterprise (Fortify on Demand)

• Acknowledged and rewarded by Facebook, Adobe, Yahoo, Microsoft, Mozilla, etc. for his responsible disclosures

• Contributed auxiliary and exploit modules to the Metasploit Framework e.g. Zemra, w3tw0rk, Phoenix Exploit Kit exploits

• nullcon virgin :)

#! disclaimer• Some memes and images may have explicit meaning in them but

hope you don’t get angry with me ;)

• Topic is limited to shooting TV sat transponders + the hardware risks

• The views and opinions expressed are not from my employers

#! credits

• Inspired by Adam Laurie’s talk entitled “Satellite Hacking for Fun and Profit” at Black Hat DC 2009

• Inspired by “Hacking a Bird in the Sky: The Revenge of Angry Birds” by Jim Geovedi, Raditya Iryandi, and Raoul Chiesa

• My father for the equipments and hardware

• lyngsat.com - a good resource for beaming all those transponders

• Filsat and PhilDISH - satellite association groups / forums in the Philippines

#! how to shoot the sat transponders?

#! why do we shoot?

• Free Radio and TV

• It’s a geek thing

• It’s a hobby

• for fun and profit

• Card Sharing (illegal stuff)

• You can watch free Pr0n

• …wait I didn’t add that one ^

#! you can watch free……

• Reference: http://rintosingkep.blogspot.com/2013/04/zamjari-tv-channel-khusus-dewasa-di.html

#! previous slide explanation

• Just a fact that such thing exists and just for educational purposes (some are FTA, some have keys)

• Not to promote p0rnography (seriously) - don’t ask me how

#! satellite hobbyist starter pack

#! satellite hobbyist hardcore pack

• Satellite receiver

• C (4 - 8 GHz)/ Ku (12 - 18 GHz) Band satellite dish

• Ant Cables / TV Cables

• Monitor / TV

• Smart Cards

• Internet connection

• Routers

• Satellite Finder (Digital / Analog)

• Umbrella (it’s freakin hot setting up the dish)

• LNB (Ku / C band)

• PCI DVB-S2 Digital Satellite Tuner Card for PC

#! PCI DVB-S2 Digital Satellite Tuner Card for PC (Sample)

#! sat frequencies and bands

• reference: http://www.inetdaemon.com/tutorials/satellite/communications/frequency-bands/

#! sat frequencies and bands

• reference: http://www.esa.int/spaceinimages/Images/2013/11/Satellite_frequency_bands

#! now choose your satellite

#! now choose your satellite

#! now choose your satellite

#! start the scan

#! choose the scanning method

#! scanning

#! introducing the risks and simple hacks of the hobbyists for the hardware

#! echo “Hello World”

#! if there is a shell or web interface, there is a way

#! access me

• Dreambox -> root : dreambox

• Some Linux-based satellite receivers have telnet access (try bruteforcing root : root)

• Most Linux-based satellite receivers which have Enigma2 firmware have FTP

• Try the Web UI

• Most don’t have HTTPS :)

• Card sharing credentials / info are stored in plaintext

• dvbsnoop - DVB / MPEG stream analyzer program (http://dvbsnoop.sourceforge.net/ or opkg update && opkg install dvbsnoop)

#! vulnerabilities

#! getting the CCcam information of a box

• https://github.com/shipcod3/cccam-info

#! How do I crack a pay-per-view

• How Do I Crack Satellite and Cable Pay TV -https://www.youtube.com/watch?v=lhbSD1Jba0Q

• Search for Alternative Channels from other Satellite TV’s that are free (satellite feed hunting)

• Card Sharing (Illegal)

• Watch Streaming videos (yeah but we wan’t a better one right)

• and ……

#! Manny Pacquiao Pay-Per-View for free last year

• CAID: 2600 Palapa D (113.0°E)Channel: TVONE3786 H 5632 (MPEG2/$)SID: 0001Provid: nullEven CW: 00 22 66 88 33 55 77 FFODD CW: 00 22 66 88 33 55 77 FF

#! Manny Pacquiao Pay-Per-View for free last year

#! Manny Pacquiao Pay-Per-View for free last year

#! wait how?

• all you need is searching! Biss, Viaccess, Nagra keys etc.

Questions?

• ???

References

• lyngsat.com• http://www.inetdaemon.com/tutorials/satellite/communications/fr

equency-bands/

• http://www.esa.int/spaceinimages/Images/2013/11/Satellite_frequency_bands

• http://rintosingkep.blogspot.com/2013/04/zamjari-tv-channel-khusus-dewasa-di.html