[SMCARA] Amateur Radios used to hack military Satellites

Fri Apr 24 08:04:35 EDT 2009

FYI. This article was sent to me by a co-worker....  Interesting reading

The Great Brazilian Sat-Hack Crackdown

By Marcelo Soares 
Brazilian satellite hackers use high-performance antennas and homebrew gear
to turn U.S. Navy satellites into their personal CB radios.
Photo: Divulgação/Polícia Federal 

CAMPINAS, Brazil — On the night of March 8, cruising 22,000 miles above the
Earth, U.S. Navy communications satellite FLTSAT-8 suddenly erupted with
illicit activity. Jubilant voices and anthems crowded the channel on a
junkyard's worth of homemade gear from across vast and silent stretches of
the Amazon: Ronaldo, a Brazilian soccer idol, had just scored his first goal
with the Corinthians.
It was a party that won't soon be forgotten. Ten days later, Brazilian
Federal Police swooped in on 39 suspects in six states in the largest
crackdown to date on a growing problem here: illegal hijacking of U.S.
military satellite transponders.
"This had been happening for more than five years," says Celso Campos, of
the Brazilian Federal Police. "Since the communication channel was open, not
encrypted, lots of people used it to talk to each other."
The practice is so entrenched, and the knowledge and tools so widely
available, few believe the campaign to stamp it out will be quick or easy.
Much of this country's geography is remote, and beyond the reach of
cellphone coverage, making American satellites an ideal, if illegal,
communications option. The problem goes back more than a decade, to the
mid-1990s, when Brazilian radio technicians discovered they could jump on
the UHF frequencies dedicated to satellites in the Navy's Fleet Satellite
Communication system, or FLTSATCOM. They've been at it ever since.
Truck drivers love the birds because they provide better range and sound
than ham radios. Rogue loggers in the Amazon use the satellites to transmit
coded warnings when authorities threaten to close in. Drug dealers and
organized criminal factions use them to coordinate operations.
Today, the satellites, which pirates called "Bolinha" or "little ball," are
a national phenomenon.
"It's impossible not to find equipment like this when we catch an organized
crime gang," says a police officer involved in last month's action.
The crackdown, called "Operation Satellite," was Brazil's first large-scale
enforcement against the problem. Police followed coordinates provided by the
U.S. Department of Defense and confirmed by Anatel, Brazil's FCC. Among
those charged were university professors, electricians, truckers and
farmers, the police say. The suspects face up to four years and jail, but
are more likely to be fined if convicted.
First lofted into orbit in the 1970s, the FLTSATCOM bird was at the time a
major advance in military communications. Their 23 channels were used by
every branch of the U.S. armed forces and the White House for encrypted data
and voice, typically from portable ground units that could be quickly
unpacked and put to use on the battlefield.
As the original FLTSAT constellation of four satellites fell out of service,
the Navy launched a more advanced UFO satellite (for Ultra High Frequency
Follow-On) to replace them. Today, there are two FLTSAT and eight UFO birds
in geosynchronous orbit. Navy contractors are working on a next-generation
system called Mobile User Objective System beginning in September 2009.
Until then, the military is still using aging FLTSAT and UFO satellites —
and so are a lot of Brazilians. While the technology on the transponders
still dates from the 1970s, radio sets back on Earth have only improved and
plummeted in cost — opening a cheap, efficient and illegal backdoor.
To use the satellite, pirates typically take an ordinary ham radio
transmitter, which operates in the 144- to 148-MHZ range, and add a
frequency doubler cobbled from coils and a varactor diode. That lets the
radio stretch into the lower end of FLTSATCOM's 292- to 317-MHz uplink
range. All the gear can be bought near any truck stop for less than $500.
Ads on specialized websites offer to perform the conversion for less than
$100. Taught the ropes, even rough electricians can make Bolinha-ware.
"I saw it more than once in truck repair shops," says amateur radio operator
Adinei Brochi (PY2ADN) "Nearly illiterate men rigged a radio in less than
one minute, rolling wire on a coil."
Brochi, who assembled his first radio set from spare parts at 12, has been
tracking the Brazilian satellite hacking problem
<http://www.py2adn.com/artigos/Satelite-Bolinha.pdf>  (.pdf) for years.
Brochi says the Pentagon's concerns are obvious.
"If a soldier is shot in an ambush, the first thing he will think of doing
will be to send a help request over the radio," observes Brochi. "What if
he's trying to call for help and two truckers are discussing soccer? In an
emergency, that soldier won't be able to remember quickly how to change the
radio programming to look for a frequency that's not saturated."
When real criminals use these frequencies, it's easy to tell they're hiding
something, but it's nearly impossible to know what it is. In one intercepted
conversation <http://www.youtube.com/watch?v=TUrYwMK2V5s>  posted to
YouTube, a man alerts a friend that he should watch out, because things are
getting "crispy" and "strong winds" are on their way.
Sometimes loggers refer to the approach of authorities by saying, "Santa
Claus is coming," says Brochi.
When the user's location is stable, the signal can be triangulated. That's
how the Defense Department got the coordinates to feed Brazilian authorities
in March's raids.
While Brazil may be the world capital of FLTSATCOM hijacking, there have
been cases in other countries — even in the United States. In February of
last year, FCC investigators used a mobile direction-finding vehicle to
trace rogue transmissions to a Brazilian immigrant in New Jersey. When the
investigators inspected his radio gear, they found a transceiver programmed
to a FLTSAT frequency, connected to an antenna in the back of his house.
Joaquim Barbosa was hit with a $20,000 fine.
A technician with Anatel, speaking on condition of anonymity, says the chief
problem with ending the satellite abuse in this country is that U.S. and
Brazilian authorities simply waited too long to start. Thousands of users
are believed to have the know-how to use the system. After a bust, the
airwaves always go quiet for a while, but the hijackers always return.
One week after the "Operation Satellite," Brochi met with Wired.com at a
gathering of amateur radio enthusiasts in a bucolic square in Campinas,
about 60 miles north of Sao Paulo. Brochi switches on his UHF receiver and
scans through the satellite frequencies.
It's relatively quiet now on the satellite underground, except for the
static-like sound of encrypted military traffic. But eventually, a lone
creaky voice cuts through. It's a man in Porto Velho, the capital of
Rondônia, a day's drive north into the upper Amazon basin. He's making small
talk with a friend in Portuguese. The satellite pirates are creeping back on
the air.

73s de Steve / K3EZ 