<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-satellite-communication-security
description: >-
  Satellite communication security assessment including DVB-S/S2 signal analysis, VSAT terminal testing, satellite internet interception risks, GPS spoofing detection, and ground segment security evaluation.
domain: cybersecurity
subdomain: wireless-security
tags:
  - satcom
  - dvb-s
  - vsat
  - gps-security
  - rf-security
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1040", "T1557", "T1600"]
  nist-csf: ["PR.DS-2", "PR.AC-5", "DE.CM-1"]
  uuid: 8c0ab9b5-535f-418b-bb71-955686ac56d2
---

# Performing Satellite Communication Security

## Overview

Satellite communications present unique security challenges due to wide-area signal
coverage, lack of encryption in many legacy protocols, and the difficulty of securing
ground-to-space links. This technique covers DVB-S/S2 signal interception analysis,
VSAT terminal assessment, GPS signal integrity validation, and ground segment security
testing. All testing requires explicit written authorization.

Mode: `[MODE: RED]` for this technique.

## Prerequisites

| Requirement | Details |
|---|---|
| Software-defined radio (SDR) capable of L/C/Ku-band reception | Required |
| GNU Radio for signal processing | Required |
| gr-dvbs2rx for DVB-S2 demodulation | Required |
| SatDump for satellite signal decoding | Required |
| Appropriate dish/antenna for target frequency bands | Required |
| Written authorization / Rules of Engagement | Required |

## Key Concepts

### Satellite Communication Attack Surface

```
Satcom Security Assessment:
├── Signal Analysis
│   ├── DVB-S/S2 carrier identification
│   ├── Signal parameter extraction (SR, FEC, modulation)
│   ├── Unencrypted transponder identification
│   └── Bandwidth utilization mapping
├── VSAT Security
│   ├── Terminal firmware analysis
│   ├── Management interface assessment
│   ├── Hub-spoke traffic interception
│   └── Terminal identity spoofing
├── GPS/GNSS Security
│   ├── GPS signal integrity monitoring
│   ├── Spoofing detection mechanisms
│   ├── Receiver vulnerability assessment
│   └── Timing attack analysis
└── Ground Segment
    ├── Teleport facility security
    ├── Network management system assessment
    ├── Encryption gateway evaluation
    └── Uplink security controls
```

### DVB-S2 Signal Analysis

```bash
# Scan for DVB-S2 carriers using SDR
# Using rtl_sdr for initial spectrum survey
rtl_power -f 950M:2150M:100k -g 40 -i 10 -e 1h satellite_scan.csv

# Process spectrum data for carrier identification
python3 -c "
import csv
import numpy as np
with open('satellite_scan.csv') as f:
    reader = csv.reader(f)
    for row in reader:
        freq_start = float(row[2])
        freq_step = float(row[4])
        powers = [float(x) for x in row[6:]]
        peak_idx = np.argmax(powers)
        peak_freq = freq_start + peak_idx * freq_step
        if max(powers) > -30:
            print(f'Carrier: {peak_freq/1e6:.2f} MHz, Power: {max(powers):.1f} dB')
"

# Demodulate DVB-S2 signal with GNU Radio
# (Requires appropriate SDR hardware for satellite bands)
grcc dvbs2_rx.grc --freq=12450e6 --sr=27500000 --output=ts_output.ts
```

### GPS Signal Integrity Monitoring

```bash
# Monitor GPS signal quality with gpsd
gpsd /dev/ttyUSB0
cgps -s

# Log GPS data for anomaly detection
gpspipe -w -n 100 | python3 -c "
import sys, json
for line in sys.stdin:
    try:
        data = json.loads(line)
        if data.get('class') == 'TPV':
            lat, lon = data.get('lat', 0), data.get('lon', 0)
            alt = data.get('alt', 0)
            hdop = data.get('hdop', 99)
            print(f'Lat:{lat:.6f} Lon:{lon:.6f} Alt:{alt:.1f} HDOP:{hdop}')
            if hdop < 0.5:
                print('[ALERT] Unusually precise fix — possible spoofing indicator')
    except json.JSONDecodeError:
        pass
"

# Monitor for GPS signal strength anomalies
gpspipe -w | jq 'select(.class=="SKY") | .satellites[] | select(.used==true) | {prn:.PRN, ss:.ss}'
```

### VSAT Terminal Assessment

```bash
# Scan VSAT management interfaces
nmap -sV -p 80,443,22,23,8080,161 $VSAT_TERMINAL_IP

# Check for default credentials on common VSAT platforms
hydra -L vsat_users.txt -P vsat_passwords.txt $VSAT_TERMINAL_IP http-get /

# Analyze VSAT traffic patterns
sudo tcpdump -i eth0 -w vsat_traffic.pcap host $VSAT_TERMINAL_IP
tshark -r vsat_traffic.pcap -q -z conv,ip
```

## Workflow

### Step 1: Pre-Engagement

Confirm scope includes satellite systems and obtain authorization from service provider.

### Step 2: Signal Survey

```bash
# Perform spectrum survey of target frequency bands
rtl_power -f 950M:2150M:100k -g 40 -i 10 satellite_scan.csv
```

### Step 3: VSAT Assessment

Evaluate terminal security, management interfaces, and firmware versions.

### Step 4: GPS Validation

```bash
# Monitor GPS signal integrity for spoofing indicators
gpspipe -w -n 1000 > gps_baseline.json
```

### Step 5: Reporting

Document findings including signal interception risks and ground segment vulnerabilities.

## Detection

```yaml
title: Satellite Communication Security Detection
id: ef27b8d2-a38c-42c4-a092-63b2c5c3d175
status: experimental
description: Detects suspicious activity related to performing satellite communication security techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1040
  - attack.t1557
  - attack.t1600
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Satellite Communication Security Detection | windows/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1040, T1557, T1600 |

## Verification

- [ ] Spectrum survey completed for authorized frequency bands
- [ ] VSAT terminals assessed for default credentials and firmware issues
- [ ] GPS integrity monitoring baseline established
- [ ] Encryption status documented for all observed carriers
- [ ] Findings reported with risk ratings and remediation

## References

- MITRE ATT&CK T1040 — Network Sniffing
- MITRE ATT&CK T1600 — Weaken Encryption
- NIST SP 800-59 — Guideline for Identifying an Information System
- [GNU Radio documentation](https://wiki.gnuradio.org/)
