AI
VSAT Architecture Creates a Web-Based Attack Surface
VSAT systems have three main components: the antenna, the ACU (antenna control unit), and the satellite modem. The ACU provides a web interface for remote antenna management over HTTP and HTTPS. Unlike the modem’s proprietary RF protocols, the ACU web interface can be accessed with a browser. The team found ACU web interfaces exposed on the internet, still using default credentials. Compromising the ACU gives antenna control, allowing attackers to cut satellite connections or point the antenna at the wrong satellite.
Firmware Rehosting Finds Six Vulnerabilities
The team used binwalk to confirm the firmware was ARM-based with a SquashFS filesystem. Extraction revealed two filesystems. The second contained the web interface code running on a lighttpd server. Using ARM QEMU, they port-forwarded to their host PC and mounted both filesystems manually. The full ACU management web interface ran locally, including login and settings. Analysis found 6 vulnerabilities, all from insufficient user input validation. Four were XSS vulnerabilities. Two were remote command injections in report functions, where user input passed directly to the system() function.
Six-Step Attack Chain From ACU to PLC
The team built a 5-level test bed for ship ICS, from VSAT to network gateway to PLC and HMI. In 2023, they found 104 Kobham and 14 Intellian ACU web interfaces exposed online using Shodan and Criminal IP. 25.96% of Kobham and 100% of Intellian systems had known vulnerabilities. Default credentials in manuals give attackers satellite configuration and vessel location. The team discovered 4 zero-days in maritime network switches, including one bypassing admin via a POST request. From the ACU, attackers can reach the HMI running Windows CE and overwrite PLC projects.
Demo Confirms Physical Impact
The demo showed a rehosted ACU web interface on a Raspberry Pi. The team used a vulnerability to change the root password without authentication and gained SSH access. Network scanning revealed connected devices. Port scanning showed port 22 open on one device and port 80 on another. They set up port forwarding to access a network switch login page and used the switch vulnerability to log in. From there, they reached the HMI and overrode the PLC project. When the HMI started, the connected fan stopped. No authentication was required for the PLC override.
Maritime Policy Misses Systemic Attack Chains
The maritime industry relies on IMO regulations and ISO/IEC standards covering ship manufacturing, operation, and certification. But cybersecurity differs from safety. Checklist-based security views ship infrastructure through a narrow lens. UR E26 and similar policies requiring security certification for individual equipment are a start, but ship digitalization demands shipwide threat modeling and penetration testing. Cyber attacks exploit interdependencies and cascading vulnerabilities across connected devices. The team calls for partnerships with shipping companies to build customized testbeds for proper threat modeling.
Notable Quotes
No technical vulnerabilities needed. They get immediately access to sensitive information like uh satellite configuration, vessel location data and network topology. Juwon Cho · ▶ 13:43
What’s notable is how easy this attack is to execute execute. Attackers can use free proxy tools to attack ship reset and login as administrator. Juwon Cho · ▶ 14:34
cyber cyber security is a little bit different uh checklist based security force forces us to view ship infrastructure with its vast array of equipment through a narrow lens Juwon Cho · ▶ 21:59
Key Takeaways
- Six vulnerabilities found in Kobham VSAT ACU web interfaces, including two RCEs via system() calls.
- 25.96% of Kobham and 100% of Intellian systems exposed online with known vulnerabilities.
- Attackers can reach PLC control from exposed ACU interfaces through a six-step chain.
About the Speaker(s)
Juwon Cho is currently pursuing a Master’s degree in Information Security at Yonsei University, where his research focuses on AI security, particularly jailbreak attacks on large language models. He actively explores methods to evaluate and strengthen the robustness of generative AI through adversarial prompting and system-level analysis. He was selected as one of the Top 30 participants in the 12th Best of Best program at KITRI and received the Excellent Award at the Chungcheong Cybersecurity Conference in September 2023 for his team’s work on scenario-based analysis of cyber threats in critical infrastructure.