1. $atellite Hacking for Fun &
Pr0fit!
Adam Laurie
adam@algroup.co.uk
http://rfidiot.org

2. Who Am I?
● Open Source developer / researcher
– Bluetooth
– RFID
– Full Disclosure / White Hat!
● Freelance research / training / lecturing

3. Why Now?
● Jim Geovedi & Raditya Iryandi
– Hacking a Bird in The Sky
● Old Skewl
– Started doing this in late 90's.
– So, err... why did it take so long to publish?

4. Feed Hunting
● Look for 'interesting' satellite feeds
– Scan all satellites
– Scan all frequencies
– Report on mailing lists / forums

5. Poking in the dark

6. Poking in the dark

7. Poking in the dark

8. Poking in the dark

9. There must be a better way!
● Visualisation is your friend
– Human Brain likes images
● Recognise food
● Recognise danger
● Recognise friends
● Recognise enemies

10. Visual Representations

11. Visual Representations

12. Visual Representations

13. Time travel – day 1

14. Time travel – day 2

15. That was then...
● Proprietary control systems
– Undocumented
● Reluctant manufacturers
– Special hardware / interface converters
● Motor Control
● Signal Status
– to RS232
– Expensive receivers

16. This is now...
● Open standards
– DVB Cards
– Embedded Linux Receivers
● Dreambox
– Tuxbox based
– GPL source code
– Cross compilers
– Alternative firmware
● http://www.i­have­a­dreambox.com
– http://www.dream­multimedia­tv.de/

17. This is now...
● Web Interface
– Select programming
– Steer dish
– Examine feed properties

18. Web Interface

19. Stream Info

20. Stream Info

21. You've got to know how to grab it...

22. Stream Info
● dvbsnoop ­ DVB and MPEG stream analyzer
– “WireShark for DVB”
– Access to raw data from DVB card
– Decode known PIDs
http://dvbsnoop.sourceforge.net

23. Stream Info

24. Stream Info

25. Stream Info

26. Stream Info

27. Stream Info

28. Stream Info

29. Stream Info

30. Stream Info

31. Stream Info

32. Taking over the Dreambox
● Avoid programming
– Analyse config files
– Tools to tweak and update
– Use existing Web Interface URLS
– Use remote tools via IP
● ssh / scp
● dvbsnoop
● tun/tap

33. Taking over the Dreambox

34. Taking over the Dreambox

35. dreaMMap
● python (yay!) script
– Grab URL
– Read status from returned webpage
– Create 3D model

36. This is now...

37. This is now...

38. 3D model capabilities
● Point & Click
– Steer to sat/freq
– Decode DVB/Audio within model
– Read Text / EPG
– Pipe datagrams to Wireshark

39. Demonstration

45. Equipment List
● Dreambox 7020
– £250 ($350)
● Dish
– £50 ­ £200
● Motor & Mount
– £100
● Total = £550 ($785)

46. Questions?
http://rfidiot.org
adam@algroup.co.uk