• Latest
  • Trending
  • All
  • News
  • TV/Radio Deals
  • Film partnerships
  • New appointments
  • Production
  • TV Channels
Cyberespionage group Turla exploits satellites for anonymity

Cyberespionage group Turla exploits satellites for anonymity

September 11, 2015
Hispasat and Gilat renew US backhaul contract

Hispasat and Gilat renew US backhaul contract

January 26, 2021
Red Sea International Film Festival announces second edition of Red Sea Lodge

Red Sea International Film Festival announces second edition of Red Sea Lodge

January 26, 2021
Al Qattara to screen Emirati & Israeli short films

Al Qattara to screen Emirati & Israeli short films

January 26, 2021
Sky announces largest content slate for 2021

Sky announces largest content slate for 2021

January 26, 2021
New Acting administrator at NASA

New Acting administrator at NASA

January 26, 2021
Netflix dominates AFI’s awards for 2020

Netflix dominates AFI’s awards for 2020

January 26, 2021
Speedcast to reorganise with Joe Spytek taking on the role of CEO

Speedcast to reorganise with Joe Spytek taking on the role of CEO

January 26, 2021
Hiltron Communications expands portfolio with ESA Microwave

Hiltron Communications expands portfolio with ESA Microwave

January 26, 2021
Eutelsat to launch ESR 24/7 Esports network on Hotbird

Eutelsat to launch ESR 24/7 Esports network on Hotbird

January 26, 2021
GRB Studios kicks off 2021 with multiple global sales

GRB Studios kicks off 2021 with multiple global sales

January 26, 2021
Audinate announces SDK for Dante-embedded platform

Audinate announces SDK for Dante-embedded platform

January 25, 2021
Sennheiser introduces HD 560S headphones for analytical listening

Sennheiser introduces HD 560S headphones for analytical listening

January 25, 2021
  • Advertise
  • Subscribe
  • Magazine Archive
  • Directory
  • Contact
Wednesday, January 27, 2021
BroadcastPro ME
  • News
    • All
    • Analyst Reports
    • AV
    • Film partnerships
    • International News
    • Mergers/Acquisitions
    • New appointments
    • OTT/Video Streaming
    • Production
    • Satellite/Broadcasting
    • Satellite/Comms
    • TV/Radio Deals
    Hispasat and Gilat renew US backhaul contract

    Hispasat and Gilat renew US backhaul contract

    Red Sea International Film Festival announces second edition of Red Sea Lodge

    Red Sea International Film Festival announces second edition of Red Sea Lodge

    Al Qattara to screen Emirati & Israeli short films

    Al Qattara to screen Emirati & Israeli short films

    Sky announces largest content slate for 2021

    Sky announces largest content slate for 2021

    New Acting administrator at NASA

    New Acting administrator at NASA

    Netflix dominates AFI’s awards for 2020

    Netflix dominates AFI’s awards for 2020

    Speedcast to reorganise with Joe Spytek taking on the role of CEO

    Speedcast to reorganise with Joe Spytek taking on the role of CEO

    Hiltron Communications expands portfolio with ESA Microwave

    Hiltron Communications expands portfolio with ESA Microwave

    Eutelsat to launch ESR 24/7 Esports network on Hotbird

    Eutelsat to launch ESR 24/7 Esports network on Hotbird

    GRB Studios kicks off 2021 with multiple global sales

    GRB Studios kicks off 2021 with multiple global sales

    Trending Tags

    • broadcast
    • MENA broadcast
    • ConnecTech2019
  • Tech Features
    • All
    • CASE STUDIES
    • New Media
    • REVIEWS
    • TV/Radio Deals
    Piracy – Unravelling the maze

    Piracy – Unravelling the maze

    Strategies to win the OTT race

    Strategies to win the OTT race

    The OTT journey – Learning from the experts

    The OTT journey – Learning from the experts

    Vox Pop Part One: Visualising the AR roadmap

    Vox Pop Part Two: Visualising the AR roadmap

    Vox Pop Part One: Visualising the AR roadmap

    Vox Pop Part One: Visualising the AR roadmap

    Premier League scraps pay-per-view model following backlash

    Premier League scraps pay-per-view model following backlash

    Shaping audio for broadcast

    Shaping audio for broadcast

    Video Piracy: Separating Fact from Fiction

    Video Piracy: Separating Fact from Fiction

    How to establish an 8K Future

    How to establish an 8K Future

    Demystifying the technology of AR for sports

    Demystifying the technology of AR for sports

    Trending Tags

    • Videos
      OTT Monitoring – Maximize return on your streaming investments

      OTT Monitoring – Maximize return on your streaming investments

      Pierre Tabet on what makes 7 Production tick

      Pierre Tabet on what makes 7 Production tick

      VIDEO: Hear it from Francesco Perta and Danny Bates on Dplay’s launch on StarzPlay

      VIDEO: Hear it from Francesco Perta and Danny Bates on Dplay’s launch on StarzPlay

      Industry experts showcase cinematography equipment at in5 workshop

      Industry experts showcase cinematography equipment at in5 workshop

      StarzPlay’s Maaz Sheikh and Exec Producer Kate Harwood-Baghdad Central premiere

      StarzPlay’s Maaz Sheikh and Exec Producer Kate Harwood-Baghdad Central premiere

      Sony launches PXW-FX9 full-frame 6K sensor camera in Dubai

      Sony launches PXW-FX9 full-frame 6K sensor camera in Dubai

      The Women Executives: Breaking the mould at the BroadcastPro 2019 Summit

      The Women Executives: Breaking the mould at the BroadcastPro 2019 Summit

      Content creators explore where content is heading in the MENA region

      Content creators explore where content is heading in the MENA region

      Envisioning a new media landscape with CEOs at the BroadcastPro 2019 Summit

      Envisioning a new media landscape with CEOs at the BroadcastPro 2019 Summit

    • Opinion
      AVOD: The best model for OTT success?

      AVOD: The best model for OTT success?

      Mobile LTE is key to simple and reliable live video contribution

      Mobile LTE is key to simple and reliable live video contribution

      How entertainment networks are fighting the pandemic

      How entertainment networks are fighting the pandemic

      New normal inspires fresh storylines and alternative filming strategies

      New normal inspires fresh storylines and alternative filming strategies

      Reviewing video content in the wake of Covid-19

      Reviewing video content in the wake of Covid-19

      Made in the UAE – with pride

      Made in the UAE – with pride

      Failing to prepare: Preparing to fail. Again?

      Failing to prepare: Preparing to fail. Again?

      Celebrating growth with BroadcastPro ME’s tenth anniversary

      Celebrating growth with BroadcastPro ME’s tenth anniversary

      Getting to grips with the AV-over-IP stack

      Getting to grips with the AV-over-IP stack

      How are businesses prioritising their expenditures in light of Covid-19?

      How are businesses prioritising their expenditures in light of Covid-19?

    • Interviews
      • All
      • Lounge
      Vox Pop Part One: Visualising the AR roadmap

      Vox Pop Part Two: Visualising the AR roadmap

      Vox Pop Part One: Visualising the AR roadmap

      Vox Pop Part One: Visualising the AR roadmap

      Will Covid-19 drive broadcasters into adopting IP?

      Will Covid-19 drive broadcasters into adopting IP?

      Vox Pop: The Road To IP

      Vox Pop: The Road To IP

      Let’s Tok Business: How TikTok is navigating the Middle East market

      Let’s Tok Business: How TikTok is navigating the Middle East market

      COVID-19: Its impact on the media world – Part II

      COVID-19: Its impact on the media world – Part II

      COVID-19: Its impact on the media world – Part I

      COVID-19: Its impact on the media world – Part I

      OSN: Back with a Bang

      OSN: Back with a Bang

      With Heba Korayem on how Ramadan programming has fared in the face of Covid-19

      With Heba Korayem on how Ramadan programming has fared in the face of Covid-19

      Faisal Hashmi: Crafting A Film Career

      Faisal Hashmi: Crafting A Film Career

    • Products
    • Magazine Archive
    • Events
    • LIVE
    No Result
    View All Result
    BroadcastPro ME
    • News
      • All
      • Analyst Reports
      • AV
      • Film partnerships
      • International News
      • Mergers/Acquisitions
      • New appointments
      • OTT/Video Streaming
      • Production
      • Satellite/Broadcasting
      • Satellite/Comms
      • TV/Radio Deals
      Hispasat and Gilat renew US backhaul contract

      Hispasat and Gilat renew US backhaul contract

      Red Sea International Film Festival announces second edition of Red Sea Lodge

      Red Sea International Film Festival announces second edition of Red Sea Lodge

      Al Qattara to screen Emirati & Israeli short films

      Al Qattara to screen Emirati & Israeli short films

      Sky announces largest content slate for 2021

      Sky announces largest content slate for 2021

      New Acting administrator at NASA

      New Acting administrator at NASA

      Netflix dominates AFI’s awards for 2020

      Netflix dominates AFI’s awards for 2020

      Speedcast to reorganise with Joe Spytek taking on the role of CEO

      Speedcast to reorganise with Joe Spytek taking on the role of CEO

      Hiltron Communications expands portfolio with ESA Microwave

      Hiltron Communications expands portfolio with ESA Microwave

      Eutelsat to launch ESR 24/7 Esports network on Hotbird

      Eutelsat to launch ESR 24/7 Esports network on Hotbird

      GRB Studios kicks off 2021 with multiple global sales

      GRB Studios kicks off 2021 with multiple global sales

      Trending Tags

      • broadcast
      • MENA broadcast
      • ConnecTech2019
    • Tech Features
      • All
      • CASE STUDIES
      • New Media
      • REVIEWS
      • TV/Radio Deals
      Piracy – Unravelling the maze

      Piracy – Unravelling the maze

      Strategies to win the OTT race

      Strategies to win the OTT race

      The OTT journey – Learning from the experts

      The OTT journey – Learning from the experts

      Vox Pop Part One: Visualising the AR roadmap

      Vox Pop Part Two: Visualising the AR roadmap

      Vox Pop Part One: Visualising the AR roadmap

      Vox Pop Part One: Visualising the AR roadmap

      Premier League scraps pay-per-view model following backlash

      Premier League scraps pay-per-view model following backlash

      Shaping audio for broadcast

      Shaping audio for broadcast

      Video Piracy: Separating Fact from Fiction

      Video Piracy: Separating Fact from Fiction

      How to establish an 8K Future

      How to establish an 8K Future

      Demystifying the technology of AR for sports

      Demystifying the technology of AR for sports

      Trending Tags

      • Videos
        OTT Monitoring – Maximize return on your streaming investments

        OTT Monitoring – Maximize return on your streaming investments

        Pierre Tabet on what makes 7 Production tick

        Pierre Tabet on what makes 7 Production tick

        VIDEO: Hear it from Francesco Perta and Danny Bates on Dplay’s launch on StarzPlay

        VIDEO: Hear it from Francesco Perta and Danny Bates on Dplay’s launch on StarzPlay

        Industry experts showcase cinematography equipment at in5 workshop

        Industry experts showcase cinematography equipment at in5 workshop

        StarzPlay’s Maaz Sheikh and Exec Producer Kate Harwood-Baghdad Central premiere

        StarzPlay’s Maaz Sheikh and Exec Producer Kate Harwood-Baghdad Central premiere

        Sony launches PXW-FX9 full-frame 6K sensor camera in Dubai

        Sony launches PXW-FX9 full-frame 6K sensor camera in Dubai

        The Women Executives: Breaking the mould at the BroadcastPro 2019 Summit

        The Women Executives: Breaking the mould at the BroadcastPro 2019 Summit

        Content creators explore where content is heading in the MENA region

        Content creators explore where content is heading in the MENA region

        Envisioning a new media landscape with CEOs at the BroadcastPro 2019 Summit

        Envisioning a new media landscape with CEOs at the BroadcastPro 2019 Summit

      • Opinion
        AVOD: The best model for OTT success?

        AVOD: The best model for OTT success?

        Mobile LTE is key to simple and reliable live video contribution

        Mobile LTE is key to simple and reliable live video contribution

        How entertainment networks are fighting the pandemic

        How entertainment networks are fighting the pandemic

        New normal inspires fresh storylines and alternative filming strategies

        New normal inspires fresh storylines and alternative filming strategies

        Reviewing video content in the wake of Covid-19

        Reviewing video content in the wake of Covid-19

        Made in the UAE – with pride

        Made in the UAE – with pride

        Failing to prepare: Preparing to fail. Again?

        Failing to prepare: Preparing to fail. Again?

        Celebrating growth with BroadcastPro ME’s tenth anniversary

        Celebrating growth with BroadcastPro ME’s tenth anniversary

        Getting to grips with the AV-over-IP stack

        Getting to grips with the AV-over-IP stack

        How are businesses prioritising their expenditures in light of Covid-19?

        How are businesses prioritising their expenditures in light of Covid-19?

      • Interviews
        • All
        • Lounge
        Vox Pop Part One: Visualising the AR roadmap

        Vox Pop Part Two: Visualising the AR roadmap

        Vox Pop Part One: Visualising the AR roadmap

        Vox Pop Part One: Visualising the AR roadmap

        Will Covid-19 drive broadcasters into adopting IP?

        Will Covid-19 drive broadcasters into adopting IP?

        Vox Pop: The Road To IP

        Vox Pop: The Road To IP

        Let’s Tok Business: How TikTok is navigating the Middle East market

        Let’s Tok Business: How TikTok is navigating the Middle East market

        COVID-19: Its impact on the media world – Part II

        COVID-19: Its impact on the media world – Part II

        COVID-19: Its impact on the media world – Part I

        COVID-19: Its impact on the media world – Part I

        OSN: Back with a Bang

        OSN: Back with a Bang

        With Heba Korayem on how Ramadan programming has fared in the face of Covid-19

        With Heba Korayem on how Ramadan programming has fared in the face of Covid-19

        Faisal Hashmi: Crafting A Film Career

        Faisal Hashmi: Crafting A Film Career

      • Products
      • Magazine Archive
      • Events
      • LIVE
      No Result
      View All Result
      BroadcastPro ME
      No Result
      View All Result
      Home BroadcastProME

      Cyberespionage group Turla exploits satellites for anonymity

      Clayton Vallabhan by Clayton Vallabhan
      September 11, 2015
      in BroadcastProME, News, Satellite/Comms
      ShareTweetPostEmail

      As a solution for anonymity, the group uses security weaknesses in global satellite networks

      turlaWhile investigating the Russian-speaking cyberespionage actor Turla, Kaspersky Lab researchers have discovered how it’s evading detection of its activity and physical location. As a solution for anonymity, the group uses security weaknesses in global satellite networks.

      Turla is a sophisticated cyberespionage group that has been active for more than eight years. The attackers behind Turla have infected hundreds of computers in more than 45 countries including Kazakhstan, Russia, China, Vietnam, the United States and Saudi Arabia. Types of organisations that have been affected include government institutions and embassies, as well as military, education, research and pharmaceutical companies. At the initial stage, the Epic  backdoor performs victim profiling.  For only the most high profile targets, the attackers then use an extensive satellite-based communication mechanism in the later stages of the attack, which helps them to hide their traces.

      Satellite communications are known mostly as a tool for TV broadcasting and secure communications; however, they are also used to provide access to the Internet. Such services are mostly used in remote locations where all other types of Internet access are either unstable and slow, or not available at all. One of the most widespread and inexpensive types of satellite-based Internet connection is a so-called downstream-only connection.

      In this case, outgoing requests from a user’s PC are communicated through conventional lines (a wired or GPRS connection), with all the incoming traffic coming from the satellite. This technology allows the user to get a relatively fast download speed. However, it has one big disadvantage: all the downstream traffic comes back to the PC unencrypted. Any rogue user with the right set of inexpensive equipment and software could simply intercept the traffic and get access to all the data that users of these links are downloading.

      The Turla group takes advantage of this weakness in a different way: by using it to hide the location of its Command and Control servers (C&C), one of the most important parts of the malicious infrastructure. The C&C server is essentially a “homebase” for the malware deployed on targeted machines. Discovering the location of such a server can lead investigators to uncover details about the actor behind an operation, so here’s how the Turla group is avoiding such risks:

      1. The group first “listens” to the downstream from the satellite to identify active IP addresses of satellite-based Internet users who are online at that moment.
      2. They then choose an online IP address to be used to mask a C&C server, without the legitimate user’s knowledge.
      3. The machines infected by Turla are then instructed to exfiltrate data towards the chosen IPs of regular satellite-based Internet users. The data travels through conventional lines to the satellite Internet provider’s teleports, then up to the satellite, and finally down from the satellite to the users with the chosen IPs.

      Interestingly, the legitimate user whose IP address has been used by the attackers to receive data from an infected machine, will also receive these packets of data but will barely notice them. This is because the Turla attackers instruct infected machines to send data to ports that, in the majority of cases, are closed by default. So the PC of a legitimate user will simply drop these packets, while the Turla C&C server, which keeps those ports open, will receive and process the exfiltrated data.

      Another interesting thing with the Turla actor tactics is that they tend to use satellite Internet connection providers located in Middle Eastern and African countries. In their research, Kaspersky Lab has spotted the Turla group using IPs of providers located in countries such as Congo, Lebanon, Libya, Niger, Nigeria, Somalia or the UAE.

      Satellite beams that are used by operators in these countries usually do not cover European and North American territories, making it very hard for most of security researchers to investigate such attacks.

      “In the past, we’ve seen at least three different actors using satellite-based Internet links to mask their operations. Of these, the solution developed by the Turla group is the most interesting and unusual. They are able to reach the ultimate level of anonymity by exploiting a widely used technology – one-way satellite Internet. The attackers can be anywhere within range of their chosen satellite, an area that can exceed thousands of square kilometers,” said Stefan Tanase, Senior Security Researcher at Kaspersky Lab. “This makes it almost impossible to track down the attacker. As the use of such methods becomes more popular, it’s important for system administrators to deploy the correct defense strategies to mitigate such attacks.”

      Kaspersky Lab products successfully detect and block the malware used by the Turla threat actor with the following detection names: Backdoor.Win32.Turla., Rootkit.Win32.Turla., HEUR:Trojan.Win32.Epiccosplay.gen, HEUR:Trojan.Win32.Generic.

      Tags: cyberespionageTurla

      Related Posts

      No Content Available

      Related News

      More Related News

      Popular Stories

      • Airbus completes Preliminary Design Review for Skynet 6A

        Airbus completes Preliminary Design Review for Skynet 6A

        772 shares
        Share 309 Tweet 193
      • Radio Television of Djibouti deploys Etere solution

        733 shares
        Share 293 Tweet 183
      • The ASBU BroadcastPro 2020 Awards shortlist is out

        726 shares
        Share 290 Tweet 182
      • Two Arab producers to take part in Rotterdam Lab film training

        718 shares
        Share 287 Tweet 180
      • Cinépolis cinemas set to open in Jeddah and Dammam

        696 shares
        Share 278 Tweet 174

      BroadcastPro ME

      • About
      • Advertise
      • Subscribe
      • Magazine Archive
      • Directory
      • Contact
      • Privacy

      Follow us on Social Media

      No Result
      View All Result
      • News
      • Tech Features
      • Videos
      • Opinion
      • Interviews
      • Products
      • Magazine Archive
      • Events
      • LIVE

      Login to your account below

      Forgotten Password?

      Fill the forms bellow to register

      All fields are required. Log In

      Retrieve your password

      Please enter your username or email address to reset your password.

      Log In