White Hat Hackers Expose Security Flaws In Iridium Satellite Communications

German white hat hackers have recently demonstrated significant security vulnerabilities in Iridium satellite communications, potentially compromising the privacy of users, including U.S. Department of Defense (DoD) employees, as first reported by Spectrum.

The hackers revealed how they were able to intercept text messages and pinpoint user locations with remarkable accuracy, raising concerns about the system’s integrity.

Spectrum reports that during a presentation at the Chaos Communication Congress in Hamburg in late December, hackers Sec and Schneider showcased their findings.

They revealed that despite Iridium’s reliance on a secure gateway to route and encrypt traffic for the DoD, their eavesdropping equipment was able to pinpoint the location of DoD users with an accuracy of approximately 4 kilometers.

They utilized a home-assembled kit consisting of an Iridium antenna, a software-defined radio receiver, and a basic computer such as a Raspberry Pi.

“We see devices that register with the DoD service center and then we can find their positions from these registrations,” Sec explained, as reported by Spectrum. “You don’t have to see the communication from the actual phone to the network, you just see the network’s answer with the position, and you then can map where all the registered devices are.”

The Iridium satellite constellation, launched in the late 1990s, was the first to offer global satellite communication services. Although the company has upgraded its systems with more secure satellites, many of its older devices still operate on the legacy radio protocol, which lacks encryption, says Spectrum.

According to analyst Christian von der Ropp, this outdated system leaves users vulnerable. “The regular satellite phones that they sell still operate under the old legacy protocol,” von der Ropp said, as reported by Spectrum.

“If you buy a brand-new civilian Iridium phone, it still operates using the 30-year-old radio protocol, and it is subject to the same vulnerability. So, you can intercept everything. You can listen to the voice calls, you can read SMS, absolutely everything. Out of the box it’s a totally unsecure service.”

The hackers also demonstrated the ease of intercepting communications. They revealed a text message exchanged between two employees of the German Foreign Office, showing how low-cost, readily available equipment can intercept Iridium signals across vast areas.

“With US $400 worth of equipment and freely available software, you can start right away intercepting Iridium communications,” von der Ropp said, as reported by Spectrum.

Despite these vulnerabilities, Iridium remains a key player in satellite communications, having secured a $94 million contract with the U.S. Space Force last year. However, the DoD is reportedly seeking alternatives, such as Starlink, due to concerns over Iridium’s security risks, as noted by SPectrum.