🛰️ Sherlocked Security – Satellite & Radio-Frequency Penetration Testing
Breaking the Airwaves: Security at 30,000 Feet and Beyond
📄 1. Statement of Work (SOW)
Service Name: Satellite & Radio-Frequency Penetration Testing
Client Type: Aerospace Companies, Defense Contractors, Satellite Communication Providers, Maritime Operators, Aviation Vendors
Service Model: Black-box or Collaborative RF Protocol Analysis, Signal Attack Simulation, Ground Station & Uplink Assessment
Compliance Coverage: NIST 800-53, CNSSP-12, DoD STIGs, ESA Security Guidelines, ITU Satellite Regulations
Testing Types:
- Satellite Uplink/Downlink Signal Capture & Analysis
- SDR-based Protocol Reverse Engineering
- Ground Station Infrastructure VAPT
- GNSS Spoofing/Replay (Lab Simulated)
- Telemetry & Command Injection Testing
- Air Interface & Spectrum Layer Security
- RF Denial-of-Service, Jamming Simulation
🧠 2. Our Approach
📡 Decode the Undecodable. Control the Inaccessible.
[Signal Capture] → [Demodulation & Protocol Reverse] → [Ground Station VAPT] → [Command/Control Injection] → [Jamming/DoS Simulation] → [Fix Recommendations]
🧪 3. Methodology
[RF Reconnaissance] → [SDR Signal Capture] → [Demodulation & Analysis] → [Protocol Fuzzing] → [Command Injection Tests] → [Ground Station Security Review] → [Impact Analysis & Report]
📦 4. Deliverables to the Client
- 📜 RF Spectrum Reconnaissance Report
- 📡 Satellite Signal Capture & Analysis Logs
- 🔁 Command Injection / Replay Attack PoCs
- 🔐 Ground Station Infrastructure Findings
- 📶 RF Protocol Reverse Engineering Notes
- 📈 Satellite Comms Threat Model
- 🎥 Optional SDR Attack Demo Videos
- 🧠 Fix Recommendations by Protocol Layer
🤝 5. What We Need from You (Client Requirements)
- ✅ Satellite hardware details or TLE data (if public)
- ✅ Transmission frequency & modulation scheme
- ✅ Ground station architecture (if in-scope)
- ✅ Test environment access (satcom emulator if applicable)
- ✅ RF license permissions for simulated testing (if required)
- ✅ SDR testing clearance or non-disruption consent
🧰 6. Tools & Technology Stack
- 🛰️ SDR Platforms: HackRF One, USRP, LimeSDR
- 📻 Signal Tools: GNURadio, SDR#, gr-satellites, GQRX
- 🔍 Protocol Reverse: Baudline, Inspectrum, DSpectrumGUI
- 🏢 Ground Infra: Nmap, Nessus, Burp Suite, Shodan
- 🔓 SatCom: Open Satellite Project, SatDump
- 🧪 GNSS Spoofing: GPS-SDR-SIM, gr-gnss, BladeRF
🚀 7. Engagement Lifecycle (Lead → Closure)
1. Scope SatCom Asset → 2. RF Recon & Capture → 3. Protocol Demodulation → 4. Ground Infra VAPT → 5. Command Injection Simulation → 6. Jamming/Replay Testing → 7. Reporting & Closure
🌟 8. Why Sherlocked Security? (Our USP)
| Feature | Sherlocked Advantage |
|---|---|
| 📡 Deep SDR Experience | Professionals trained in aerospace & RF security |
| 📶 Full Spectrum Coverage | From L-band to Ku-band & GNSS spoofing |
| 🔍 Custom Protocol Decoding | When no tools exist, we build our own |
| ⚠️ Responsible Disclosure | Non-intrusive test simulations with safety in mind |
| 🔁 Fix Validation Option | We retest post-mitigation |
📚 9. Real-World Case Studies
🛰️ Satellite Downlink Hijack Test
Scenario: DVB-S2 downlink unencrypted
Action: Captured signal → decoded telemetry stream
Impact: Sensitive diagnostics exposed
Fix: Transitioned to AES-encrypted payload stream
🧭 GNSS Spoofing Lab Test
Scenario: Drone navigation spoofed via SDR
Action: Simulated false GPS location feed
Impact: Device shifted trajectory mid-flight
Fix: Implemented multi-band signal authentication
🛡️ 10. SOP – Standard Operating Procedure
- TLE, satellite signal and spectrum review
- SDR-based capture and demodulation
- Ground station and API enumeration
- Command channel injection test
- GNSS spoof / replay validation
- Risk matrix and exploit documentation
- Executive report delivery
- Fix tracking & optional retest
📋 11. Sample RF/SatCom Security Checklist (Preview)
- Identify satellite bands and protocols in use.
- Capture RF traffic using SDR tools.
- Demodulate and decode satellite signals.
- Analyze encryption and signal obfuscation.
- Assess uplink/downlink access controls.
- Test for spoofing and jamming vulnerabilities.
- Review satellite terminal firmware and configs.
- Analyze GPS spoofing and signal injection.
- Test remote management interfaces.
- Document potential national/international impact.