Search papers, labs, and topics across Lattice.
This paper presents the first comprehensive security analysis of the Iridium satellite radio link, revealing critical vulnerabilities in authentication and radio communication protocols. By reverse engineering the SIM-based authentication, the authors demonstrate secret key extraction, enabling device cloning and impersonation. Analysis of Iridium traffic reveals a lack of encryption, exposing sensitive data, and custom SDR tools are developed to demonstrate spoofing and jamming attacks due to missing source authentication.
Iridium's global satellite communication network, relied upon by critical industries and governments, is riddled with vulnerabilities, allowing for device cloning, data exposure, and service disruption via readily achievable attacks.
The Iridium Low Earth Orbit (LEO) satellite constellation remains a unique provider of global communications for critical industries, governments, and private users, serving over 2.5 million active subscribers despite recent market competition. In contrast to terrestrial wireless standards such as 3GPP, Iridium protocol specifications are proprietary and have not undergone rigorous, public, and systematic security evaluation. In this work, we present the first comprehensive security analysis of Iridium authentication and radio link protocols. We reverse engineer Iridium SIM-based authentication mechanism and demonstrate that the secret key can be extracted from the SIM card, enabling full device cloning and impersonation attacks. Leveraging a month-long dataset of Iridium up- and downlink satellite traffic, we further show that nearly all signaling and radio communication protocols currently in use lack encryption, resulting in the exposure of sensitive information in cleartext over the air such as login credentials and large volumes of personal data. Finally, we develop custom software-defined radio (SDR) tools to carry out spoofing and jamming attacks, revealing that modestly equipped adversaries can inject falsified messages or disrupt the Iridium service locally due to the absence of source authentication. Our findings uncover systemic vulnerabilities in the Iridium radio link and highlight the urgent need for users of critical applications to transition to more secure communication radio links.
