A researcher from the University of Leuven demonstrated a technique for compromising the Starlink user terminal, used to connect subscribers to SpaceX's satellite network, at the Black Hat conference. The terminal is equipped with a custom 64-bit SoC created by STMicro specifically for SpaceX. The software environment is based on Linux.
The proposed method allows executing one's code on the Starlink terminal, gaining root access and access to an internal network that is normally inaccessible to users via standard ports, used by terminals for tasks like firmware updates. The published findings may also apply to advanced experiments in software-defined radio (SDR) due to the specific structure of the Starlink terminal (a phased array of antennas, controlled via software).
Hacking the Starlink terminal is intriguing from the perspective of attacking a well-protected Linux system with a robust implementation of secure boot mode. As the software-based system could not be compromised, the hack was executed at the hardware level using specialized laboratory equipment. Ultimately, the necessary equipment for the hack was reduced to an off-the-shelf modchip using a standard Raspberry Pi RP2040 (dual-core Cortex M0) microcontroller.
The prepared modchip is connected to specific tracks on the Starlink terminal's mainboard and induces a fault by altering voltage in certain parts of the circuitry (a 'voltage fault'). Triggering a fault at the moment of checking the digital signature in the ROM bootloader (BL1) allows arbitrary code to run on the SoC, despite the lack of a valid digital signature for that code.
The schematics for the modchip designed to hack Starlink terminals have been published on GitHub in KiCad format. The code for the firmware used in the attack has also been released. The estimated cost to manufacture the board is around $25.
Source: opennet.ru
