At the Black Hat USA 2023, Mark Colaluca , Craig Miller , Nick Saunders , Michael Sutton , Kristina Walter from Viasat presented a talk named “Lessons Learned from the KA-SAT Cyberattack: Response, Mitigation and Information Sharing<\/a>“. This presentation will provide the most detailed public presentation of the KA-SAT event. Viasat will share the story of how it responded and performed a rapid forensic on several impacted terminals. This presentation will explain details around the forensic analysis that have not previously been publicly shared by Viasat, as well as the process of reverse engineering the malicious toolkit to verify it would produce the observed flash memory effects. Both Viasat and NSA will offer their lessons learned from the cyberattack and advise on how commercial and government organizations can follow this model to partner both in response to and preparation for future attacks.<\/p>\n In this article, we will go through the Viasat cyber attack that occured on 24 February, 2022. The goal is to do a modelisation of this attack based on the MITRE ATT&CK framework.<\/p>\n The first question will be to explain why to use the MITRE ATT&CK framework to do this analysis while there are others frameworks and methodologies that can be used for the space sector.<\/p>\n The next work will be to identify Tactics, Techniques and Procedures (TTPs) from the MITRE ATT&CK matrix that have been used by the hackers during the Viasat attack. To learn more about the MITRE ATT&CK framework, you can go to this article<\/a> about the ATT&Ck v13 release.<\/p>\n Once TTP identified, we will map the TTPs on the ATT&CK Navigator<\/a> in order to have the complete attack chain as a cyber kill chain.<\/p>\n The Viasat hack was a cyberattack on American communications company Viasat affecting their KA-SAT network, on 24 February, 2022.<\/p>\n Thousands of Viasat modems got hacked by a “deliberate … cyber event”. Thousands of customers in Europe have been without internet for a month since. During the same time, remote control of 5,800 wind turbines belonging to Enercon in Central Europe was affected.<\/p>\n According to Viasat, the attacker used a poorly configured virtual private network appliance to gain access to the trusted management part of the KA-SAT network. The attackers then issued commands to overwrite part of the flash memory in modems, making them unable to access the network, but not permanently damaged. The satellite itself and its ground infrastructure were not directly affected.<\/p>\n Viasat is an American communications company based in Carlsbad, California, with additional operations across the United States and worldwide. Viasat is a provider of high-speed satellite broadband services and secure networking systems covering military and commercial markets<\/p>\n The first question is which framework to use to do this analysis ? At this time, there are 5 frameworks and methodologies that can be used for the space sector :<\/p>\n I did a quick comparaison in this article<\/a>, of all the released Cybersecurity Frameworks for Space Sector<\/p>\n SPARTA is a framework but for spacecraft and space missions. SPARTA doesn’t cover ground segment.\u00a0The entire Viasat attack took place on Earth, on a ground-based network and on a conventional information system. So, there is no reason to use SPARTA, SPACE-SHIELD or TREKS. MITRE ATT&CK is a great framework, well suited for this analysis. To be more precise, we used the MITRE ATT&CK – Enterprise Matrix<\/a>.<\/p>\n What is the Cyber Kill Chain?<\/strong><\/p>\n “The cyber security kill chain model explains the typical procedure that hackers take when performing a successful cyber attack. It is a framework developed by Lockheed Martin derived from military attack models and transposed over to the digital world to help teams understand, detect, and prevent persistent cyber threats. While not all cyber attacks will utilize all seven steps of the cyber security kill chain model, the vast majority of attacks use most of them, often spanning Step 2 to Step 6.”<\/em> (source : netskope.com<\/a>)<\/p>\n What is in the MITRE ATT&CK Matrix?<\/strong><\/p>\n “The MITRE ATT&CK matrix contains a set of techniques used by adversaries to accomplish a specific objective. Those objectives are categorized as tactics in the ATT&CK Matrix. The objectives are presented linearly from the point of reconnaissance to the final goal of exfiltration or impact.”<\/em> (source : trellix.com<\/a>)<\/p>\n Comparaison between the Cyber Kill Chain and the MITRE ATT&CK matrix<\/strong><\/p>\n The table below compares the stages of the Cyber Kill Chain with those of the MITRE ATT&CK matrix<\/p>\nIntroduction<\/h2>\n
About the Viasat hack in brief<\/h2>\n
About Viasat<\/h2>\n
![\"\"](\"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2023\/10\/Viasat-logo-300x119.jpg\"){kind=logo}
<\/a><\/p>\nWhich framework using ?<\/h2>\n
\n
Quick overview and comparaison between MITRE ATT&CK and the Cyber Kill Chain<\/h2>\n
![\"\"](\"https:\/\/www.spacesecurity.info\/wp-content\/uploads\/2023\/09\/Viasat-Attack-Life-cycle.jpg\")
<\/a>