Accidental Satellite Hijacks Can Rebroadcast Cell Towers

A lot of us will use satellite communications without thinking much about the satellite itself. It’s tempting to imagine that up there in orbit is a communications hub and distribution node of breathtaking complexity and ingenuity, but it might come as a surprise to some people that most communications satellites are simple transponders. They listen on one frequency band, and shift what they hear to another upon which they rebroadcast it.

This simplicity is not without weakness, for example the phenomenon of satellite hijacking has a history stretching back decades. In the 1980s for example there were stories abroad of illicit trans-atlantic serial links nestling as unobtrusive single carriers among the broad swathe of a broadcast satellite TX carrier.

Just sometimes, this phenomenon happens unintentionally. Our attention was drawn to a piece by [Harald Welte] on the unintended rebroadcast of GSM base station traffic over a satellite transponder, and of particular interest is the presentation from a conference in 2012 that it links to. The engineers show how they identified their interference as GSM by its timing frames, and then how they narrowed down its source to Nigeria. This didn’t give them the uplink in question though, for that they had to make a downconverter from an LNB, the output of which they coupled to an aged Nokia mobile phone with a wire antenna placed into an RF connector. The Nokia was able to decode the cell tower identification data, allowing them to home in on the culprit.

There was no fault on the part of the GSM operator, instead an unterminated port on the uplink equipment was enough to pick up the GSM signal and introduce it into the transponder as a parasitic signal for the whole of Europe and Africa to hear. Meanwhile the tale of how the engineers identified it contains enough detective work and outright hardware hacking that we’re sure the Hackaday readership will find it of interest.

If satellite hacks interest you, how about reading our thread of posts on the recapture of ISEE-3, or maybe you’d like to listen for a lost satellite from the 1960s.

Thanks [Kia] for the tip.

21 thoughts on “Accidental Satellite Hijacks Can Rebroadcast Cell Towers

    1. Detective Ed: “OK Simon — bring up the waterfall display.”

      Simon: “I’m one step ahead of you … here it is”

      Ed: “Hmm, I can’t make out the signal. Simon, zoom and enhance!”

      Simon:

      Ed: “Perfect! We have ID’d the perp.”

  1. The original presentation never explains the source of the Nigeria cell tower signal, it only shows the Nokia phone photo.

    It does, however, explain that there were actually multiple cell phone signals in the sattelite broadcast, originating from sattelite uplinks all over europe.

  2. Satellites are simple because they have to be future-proof (because their intended use can change during their lifespan) and robust (because putting them into geostationary orbit is fantastically expensive).

    1. One of my college professors once claimed one of his emails got “lost on a satellite”. Apart from satellites being a layer 1 device (and hence don’t actually understand IP packets much less decode and store them), the email server is local so I would be very surprised if any satellites were involved at all.

  3. Man, with an error like this some poor guy somewhere might get a cell phone bill for like $9,329,465.21! Try convincing the cell carrier that it was a sat. error that caused this. Good luck with that, ha ha.

    1. I read that Airbus(?) will be incorporating a floating “Black Box” with satcomm/GPS capability on future aircraft,
      in addition to existing “Black Boxes”. It will be released from the fuselage several meters belong the surface.

  4. The signal was coming out on the satellite’s normal downlink frequency, not the cell phone band, so interference with the cell network wasn’t going to happen. They had to build a downconverter to get a usable signal for the phone.

    1. Ima get a South Korean cell plan, put an antenna on a drone to hook an over the horizon satellite, run it through a down convertor and get 6G speed unlimited interwebs for $15 a month…

      1. With a couple of thousand miles between the endpoints, the delay just from the satellite link will make this considerably slower unless you use a network compressor or some similar hack…

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.