Satellite baseband mods: Taking Control of the GMR-2 phone InmarSat terminal

No ratings

Presented at ekoparty 2012 by

Alfredo Ortega

Sebastian Muiz

We present a way to modify the firmware of a satellite phone (Inmarsat IsatPhonePro) using only a USB cable. In Addition to the complete compromise of the security device, the modifications Allows to read and write frames Directly to any layer of the GMR-2 (GEO Mobile Radio, GEO stands for Geostationary Earth Orbit) communication system, Allowing the user to inject and / sniff or frames without the need of any additional equipment. A number of techniques will be presented, Including Both unauthenticated code execution in application and baseband processor. Additionally a brief analysis of the communication stack software will be presented, enough points to Identify instrumentation code to extract valuable information, ie broadcast from inside frames or the stream cipher.