Protecting Galileo at @esa | Ground segment cybersecurity | All your ground stations are belong to us | Previously @SafranElecDef & @ANSSI_FR

Zegema Beach
Joined April 2012
Harvester retweeted
Scoop 🔴 German Federal intelligence services are about to establish their first "intelligence cloud", enabling them to share secret information much quicker. According to our information this system will be bases on an air-gapped version of #Google Cloud: tagesschau.de/investigativ/n…
4
14
2
32
6,621
Harvester retweeted
1/2 Unit 42 reported earlier that we had observed post-compromise activity that we initially thought was related to the PHP2Shell vulnerabilities. What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application.
1
8
1
25
4,030
Starlink, Starshield, GPS, and the Claims About “Hacking”: A Technical Explanation A post accusing Ukraine of “hacking” #Starlink is spreading rapidly on this platform. The technical claims in that post are incorrect. They seem based on a collection of rumors circulating on Telegram, including information from Russian channels. Unfortunately, this post and others like it are receiving an enormous number of likes and reposts. That's why I believe it's important to address these claims with clear technical explanations rather than allow misleading information to spread unchecked. This is a fairly detailed post, but I think the distinction matters. Some of the technical information below comes from my own research and detailed analysis of Starlink terminal firmware, particularly its GPS, PNT, and velocity-processing systems. #⃣ 1. What are Starlink and Starshield? People still frequently confuse the two. Starlink is SpaceX's commercial satellite internet service, designed for consumers, businesses, and other commercial users. Starlink supports operation in motion, but the permitted speed depends on the service plan, equipment, and geographic region. Under commonly available commercial plans, the maximum authorized operating speed is 160 km/h (100 mph). In Ukraine, Starlink terminals are subject to a specific speed restriction: they cannot operate at speeds above approximately 75–80 km/h. This Ukraine-specific restriction was introduced less than a year ago, in coordination with Ukrainian authorities, to prevent Starlink terminals from being used on drones. Starshield is SpaceX's government-focused product and service family, based on Starlink technology and developed for national security applications. It includes secure communications, Earth observation, and hosted payload capabilities. Some Starshield systems involve dedicated government spacecraft and infrastructure. However, Starshield communications services can also use the underlying Starlink satellite network. This distinction is important: Starshield does not necessarily mean a completely separate physical satellite constellation or entirely different user terminal hardware. SpaceX develops and operates the underlying Starlink infrastructure. The U.S. government procures Starshield capabilities through contracts, with ownership and operational control depending on the particular system and arrangement. The division of authority between SpaceX and the U.S. government has become especially relevant following the October 2026 incident. Unlike ordinary commercial Starlink service, Starshield configurations used for military operations in Ukraine have supported substantially higher operating speeds. #⃣ 2. Is Starshield available in Ukraine? Yes. Starshield is operational in Ukraine and is extensively used by the Ukrainian military. Starshield service has been used in Ukraine since approximately mid-2023. Subsequent U.S. government contracts and public reporting also confirm its availability. The United States has procured Starshield services specifically to support Ukrainian military operations. An October 2026 U.S. Senate letter explicitly confirms that Ukraine receives Starshield services procured by the U.S. government. Therefore, the idea that Ukraine is somehow obtaining Starshield capabilities by secretly modifying commercial terminals fundamentally misunderstands how these services are provided. How does the Ukrainian military use these services? The Ukrainian military uses both commercial Starlink and Starshield. Commercial Starlink is widely used because of its availability, relatively low cost, and excellent performance. For stationary installations and many other applications, commercial service is entirely sufficient. Starshield is used for specialized military applications, including drones and other platforms requiring reliable connectivity at higher operating speeds. These are capabilities provided through the Starshield service itself, not necessarily through unauthorized modifications to commercial Starlink hardware. Using Starshield for its intended and authorized military applications is not inherently a violation of its service terms. #⃣ 3. Regarding the October 2026 incident Beginning on October 13–14, Ukrainian military units encountered unexpected speed restrictions affecting Starshield connectivity. Terminals that had previously operated at substantially higher speeds began losing connectivity at approximately 160 km/h, with some reports describing interruptions at even lower speeds. These restrictions disrupted military operations, particularly those involving high-speed unmanned systems. The consequences were serious. Ukrainian officials reported that the restrictions interfered with drone operations, including efforts to intercept russian attack drones. The decision-making process remains disputed. Neither SpaceX nor the U.S. government initially accepted responsibility for imposing the restrictions. Subsequent reporting and statements from U.S. lawmakers raised questions about who authorized the changes and which organization had the ability to implement them. As of October 24, Ukraine's Ministry of Defense has officially reported that Starlink/Starshield connectivity is once again stable at speeds exceeding 400 km/h. #⃣ 4. Does Starshield require separate hardware? Not necessarily. This is one of the most important points in the entire discussion. Starshield is a government-focused service and technology family. In the case of satellite communications provided to Ukraine, existing Starlink terminal hardware can be provisioned to use Starshield service. In December 2024, Bloomberg reported that a Pentagon contract would provide Starshield access to an additional 2,500 Starlink terminals already deployed in Ukraine, on top of 500 terminals previously covered. The contracts therefore provided service for a total of 3,000 terminals. In practice, compatible commercial Starlink hardware can be reassigned to Starshield service through the appropriate authorization and provisioning process. This requires approval. It is not something that a customer can simply enable through the ordinary Starlink application. Are there specialized Starshield terminals? Yes. For example, there is a specialized variant of the Starlink Mini known internally as `mini1_rugged`. Based on my hardware research, this model uses an improved GNSS receiver, the Teseo V, instead of the receiver found in the regular Mini. However, despite having repaired and examined numerous terminals and maintaining contact with people working with this equipment, I have not encountered evidence of this specific variant being supplied to Ukraine. The Starshield terminals I have encountered or received information about in Ukraine are based on regular Starlink hardware. Some terminals arrive already configured for Starshield service. Others can be provisioned for it through the appropriate channels. The key point is simple: A regular Starlink terminal operating under an authorized Starshield service configuration is still a Starshield terminal from the service perspective. It does not need to be physically modified or “hacked” to obtain that service. #⃣ 5. Why does a Starlink/Starshield terminal require GPS? Three years ago, I published an article explaining why GPS is important for Starlink terminals and how to improve GPS reception on the hardware available at that time: olegkutkov.me/2023/11/07/con… Some of the technical details in that article are now outdated, but the fundamental principles remain relevant. A Starlink terminal requires sufficiently accurate position and timing information for network synchronization, beamforming, and other aspects of normal operation. Location information can also be used for geographic service authorization. Invalid or spoofed GPS data may interfere with these processes. Depending on the magnitude of the error and the firmware's ability to detect it, the terminal may lose connectivity or become unable to operate normally. Modern firmware also includes mechanisms to detect suspicious or inconsistent GPS information. When GPS data is considered unreliable, the terminal may attempt to use an alternative source of positioning, navigation, and timing (PNT) information derived from Starlink's own satellite constellation. However, this fallback mechanism is not guaranteed to work reliably under every operating condition. This distinction helps explain why some hardware modifications focus on improving GPS reception or supplying more reliable positioning data, rather than bypassing Starlink's network authorization mechanisms. #⃣ 6. What is Starlink PNT? Starlink PNT is a positioning, navigation, and timing capability that derives information from signals transmitted by Starlink satellites. By combining satellite measurements with known orbital information, a terminal can estimate its position and movement independently of a conventional GPS receiver. Starlink firmware contains the necessary functionality to process these measurements and use them as an alternative positioning source. Initially, this functionality was more of an experimental feature. It was interesting from an engineering perspective, but its accuracy and reliability were limited. Over time, it has improved significantly. Modern implementations can provide useful positioning information, including when a terminal is moving. There are still measurement errors, uncertainties, and limitations, but Starlink-derived PNT can serve as an alternative when GPS is unavailable or unreliable. Nevertheless, conventional GNSS remains an important and generally preferred source of positioning and timing information in current terminal designs. For now. Can the terminal operate without GPS? Under certain conditions, yes. Starlink firmware provides a gRPC request called `dish_inhibit_gps`, which controls whether GPS is used as a position source. When GPS use is inhibited, the firmware can attempt to rely on alternative positioning information. A similar situation occurs when GPS data becomes unavailable because of hardware or communication problems. However, disabling GPS does not guarantee that the alternative positioning solution will be sufficiently accurate or available. It also does not automatically change the terminal's service permissions. #⃣ 7. How does a Starlink terminal determine its moving speed? The GPS receiver is a primary source of position and velocity information. Proprietary NMEA messages, including `TMPV`, carry information the terminal's motion-processing logic uses. The firmware does not necessarily trust these measurements without additional validation. The firmware can filter GPS-derived velocity and compare it with information from other available sources, including Starlink-derived positioning. The terminal also contains an inertial measurement unit (IMU), whose acceleration measurements can help evaluate movement and detect inconsistencies. The firmware applies thresholds and consistency checks to these measurements. These mechanisms run internally and aren't exposed as user-configurable settings. If GPS measurements differ significantly from the expected values or fail validation, the firmware can reject them. However, GPS validation and service-speed enforcement are two different things. Rejecting GPS data does not automatically mean that the terminal has exceeded the permitted operating speed. The terminal's service configuration determines whether operation at a particular speed is authorized. When the relevant speed policy is violated, the terminal may report a condition such as: `MOVING_TOO_FAST_FOR_POLICY` This distinction is essential when evaluating claims about GPS modification. Simply changing GPS-reported velocity does not automatically change the terminal's authorized operating speed or eliminate the firmware's internal validation mechanisms. As explained earlier, appropriately provisioned Starshield service supports high-speed operation without the same restrictions imposed on ordinary commercial configurations. Therefore, no additional “hacking” is required to obtain high-speed capability when that capability is already authorized as part of the service. Reliable GNSS reception remains desirable, however. This is one reason specialized terminal designs may incorporate improved receivers, such as the Teseo V used in the `mini1_rugged` variant. It also explains the existence of solutions intended to improve GPS reception or provide a more reliable PNT input. **Improving positioning reliability is not the same thing as bypassing service authorization.** #⃣ 8. How does Starlink geofencing work? There are two important factors: geographic service authorization and physical RF coverage. Understanding the difference is essential. Geographic service authorization Starlink uses geographic information to determine where service is available and whether a particular terminal is authorized to operate. The system uses logical geographic regions rather than relying exclusively on the physical boundaries of satellite beams. H3 is one geographic indexing system relevant to this discussion. It divides the Earth's surface into hierarchical hexagonal cells that represent geographic locations and regions. Geographic indexing provides a convenient way to manage coverage and service policies, but an H3 cell should not be confused with a physical satellite beam. Network authorization can depend on several factors, including geographic location, service configuration, terminal identity, and applicable restrictions. A terminal may be physically capable of receiving a satellite signal while still being denied access to the service. This is an important distinction when discussing restricted territories, including russia. Receiving a Starlink signal does not necessarily mean the terminal is authorized to connect to the network. Physical RF coverage Satellite beams cannot perfectly follow national borders or the boundaries of geographic indexing cells. An RF beam has a physical footprint determined by the satellite antenna, beam steering, operating conditions, and geometry. Its boundaries are not perfectly sharp. Consequently, a beam may illuminate areas on both sides of a national border even though the service is authorized on only one side. This is a normal characteristic of satellite communications, not evidence that geographic service restrictions have been disabled. The role of GPS in geofencing The terminal's reported location provides another source of information for determining whether it is operating in an authorized region. The network can use terminal positioning information, together with its own authorization rules, to determine whether service should be permitted. When operation is prohibited, the terminal may receive an appropriate disablement code from the network. These mechanisms should be understood as parts of a broader service authorization system, rather than as a single GPS check controlling everything. Can geofencing be bypassed by supplying modified GPS coordinates? This question requires some nuance. Changing the location reported by a GPS receiver may influence positioning-dependent decisions, but it does not automatically override network authorization. Starlink also has other information available to evaluate terminal operation, and its firmware includes mechanisms for detecting inconsistent positioning data. Large discrepancies can disrupt normal positioning and beamforming calculations, trigger validation failures, or cause the terminal to lose connectivity. Most importantly, changing GPS coordinates does not by itself grant a terminal permission to use a service or geographic region for which it is not authorized. #⃣ 9. So what exactly is being called a “Starlink hack”? This is where much of the confusion comes from. The modifications being discussed online are primarily related to improving GPS reception or providing the terminal with reliable positioning and timing information. These are technical solutions intended to improve connectivity and stability, particularly when the terminal is moving or operating in an environment with GPS interference. They do not automatically bypass Starlink's speed restrictions, geographic limitations, or network authorization mechanisms. As explained earlier, regular Starlink hardware can also operate under an officially authorized Starshield service configuration, which supports high-speed military applications. Neither improving GPS reliability nor using an authorized Starshield service constitutes hacking Starlink. It's important to understand these differences before making accusations based on photographs, rumors, or incomplete technical information. #⃣ Conclusion Starlink and Starshield use closely related technologies, but they are different services with different capabilities and restrictions. Regular Starlink hardware can operate under an officially authorized Starshield service configuration. No special hardware modifications are required. Improving GPS reception or providing reliable positioning data does not mean bypassing Starlink's network restrictions. Using Starshield for authorized military operations is not hacking. Neither is improving a terminal's GPS reliability. My goal is simply to explain how these systems work and clear up the confusion surrounding them. Technical accusations should be based on evidence, not rumors. #starlink #starshield #gps
101
351
117
1,144
140,161
Harvester retweeted
People assume that in an AI doing formal verification world, they can take their existing codebase, ask AI to prove it correct, and get either a proof or a bug. Sadly reality has a few bones to pick with this, and one of them is the "existing codebase" part. And that's due to the good ol' halting problem. The short of it is that there is no general purpose algorithm that takes any program and input and correctly determines whether it will terminate or run forever. With a few mathematical flourishes we can extend that to "Rice's theorem" and prove this is true for any nontrivial semantic property, meaning we can't automatically prove arbitrary things about arbitrary programs. Now obviously we can prove some things about some programs, or else formal verification wouldn't exist as a field. The trick is that we write the code in a style suitable for verification. One example of this is totality: in Lean, all functions must be guaranteed to return a value for all inputs. If we want some code that runs forever (like f.ex a server), instead of `while true` we do `while (i < 10^60)` so that it's guaranteed to terminate and return a value (after the end of the universe). (Totality is also why, in Lean, `1/0 == 0`. If you convert your code to Lean without accounting for this, you could have correct lean but incorrect code!) Another "style" we use is state machines. Even if your code doesn't quite fit an SM architecture, if you want to prove it at scale, you're probably going to go with a state machine. State machines are the carcinisation of provable code. Hopefully by now the problem is clearer: even if your codebase is objectively correct, it might not be in the right shape to be proven correct! Okay, just have the AI rewrite your codebase into another form, right? Two problems. One: you don't know if you've introduced errors in the rewrite because you can't prove them equivalent (since one of them is not in a provable shape). Two: making code more verifiable can make it worse on other metrics, like modifiability, performance, and complexity. And now you've got the old bugbear of software engineers, the dreaded tradeoff. Now, don't get me wrong, formal verification has a huge role in the future of software, but it's not going to be a breezy "prove my Ruby thx" Claude prompt. It's still going to take work and expertise on our parts to prove our code, and to strike the right balance between formal verification and other forms of correctness. This is one reason I'm so excited to be working at @AntithesisHQ , which tackles a lot of the same properties as proof methods, but verifies them with "deterministic simulation testing" and fuzzing instead of with a proofs. So it's not as thorough and doesn't give you confidence in all inputs, but it automatically works on pretty much any code shape. I've literally grabbed open source projects off Github, told Claude "check properties XYZ in Antithesis thx", and gotten bug reports back. No state machine rewrites needed.
24
50
5
250
21,004
Harvester retweeted
While everybody is prompting for PHP, recently I ended up having to dump the LSA in a custom way. I have written a short article on the entire LSA decryption stack, with the C implémentation. 💫 Cross posted here blog.advens-c.tf/articles/ls… and here hideandsec.sh/books/windows-…
31
111
4,000
Anyone has checked around Frama-C recently and EACSL automatic annotations for legacy C/C++ codebases ?
A prediction as a result from this post: efforts like Fil-C and "rewrite it all in Rust" will lose steam. Applying FM to legacy software to eliminate and preclude new bugs is much more attractive at this point than rewriting (Rust) or dragging it down with a GC (Fil-C)
55
Harvester retweeted
Anyone still believing in 2026 that "FV doesn't scale to real world code" needs to start updating their priors and pick up a theorem prover asap
New on our Frontier Red Team blog: using Claude to formally verify software at large scale. Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time). With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks. Read our research in full here: anthropic.com/research/forma…
9
6
89
3,323
Audit the Skills you find, you might be surprised.
45
Harvester retweeted
Crazy cool blog I saw on linkedin about an SMB signing bypass technique TLDR: SMB re-auth reuses the original signing key and never checks the new identity matches the old. So you sign a session as a low-priv account you control, re-auth it with a relayed privileged login, and get a privileged session still signed with your original low-priv key, which btw is accepted even where signing is required, with DCs included. blackfield.ch/blog/defeating…
4
56
1
156
8,637
Harvester retweeted
New on our Frontier Red Team blog: using Claude to formally verify software at large scale. Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time). With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks. Read our research in full here: anthropic.com/research/forma…
641
1,066
628
9,716
2,039,043
The GRU hacked into Jared Kushner's iPhone. Dutch military intelligence (MIVD) then recruited a GRU spy who gave them access to the hacked phone. What MIVD discovered was that Kushner had access to two bank accounts --one Azerbaijani, the other Israeli --where Saudi Crown Prince Mohammed bin Salman and Emirati ruler Mohammed bin Zayed deposited money. It sounds like a slightly far-fetched episode of "Slow Horses," but it's real. And it proves just how eye-poppingly corrupt this administration was and continues to be as its "special envoy" decides the fate of tens of millions in Europe in the Middle East. Simply incredible reporting by Matthew Cole, drawn from his new book on Kushner. vanityfair.com/story/jared-k…
1,431
24,220
1,964
76,802
6,114,393
Buy an Apple TV, disable network on the TV, do the firmware updates (if needed) via USB, done.
i own a relatively new (2025) samsung tv. i kept getting weirdly targeted ads. i tried reversing the firmware but it was aes encrypted and no keys unless tear it apart and do uart/jtag magic. zero days it is. root shell on new samsung TVs! discovered PRIVACY HORROR. write up?
1
194
Is he going to nuke the area ?
#BREAKING US embassy staff and families ordered to leave Saudi Arabia, with families of embassy staff in the United Arab Emirates, Jordan, Qatar and Bahrain also ordered to leave, diplomatic source tells AFP
2
110
BREAKING: "Speculative data center debt is being repackaged and sold to pension and retirement funds, university endowments, and other institutional investors in a manner eerily reminiscent of the subprime bubble," per AFR
696
4,681
1,271
32,781
2,077,413
📖 L'éditeur Boréal a annoncé mercredi mettre fin à sa collaboration avec Thélyson Orélien qui a bien, selon la maison d'édition canadienne, utilisé l'intelligence artificielle pour écrire son roman "C'était ça ou mourir" contrairement à ce qu'il assurait.
128
253
152
611
239,129
Harvester retweeted
Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )
Readers added context they thought people might want to know
The PHP 8.5.12 release fixes the two specific CVEs (via state/bailout changes) detailed in official advisories; referenced "surviving paths" (e.g. var_destroy UAF) are separate pre-existing unserialize issues unrelated to this patch. php.net/archive/2026.p… github.com/php/php-src/se… github.com/php/php-src/se… github.com/dinosn/php-8.5…
77
365
146
2,587
500,651
Harvester retweeted
Replying to @chainguard_dev
"On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure." thephp.foundation/blog/2026/…
21
99
25
583
64,677