Eric Jedermann, Piotr Kulpinski, Martin Strohmeier, Vincent Lenders, Jens Schmitt
8 min
Abstract
The Iridium Low Earth Orbit (LEO) satellite constellation remains a unique provider of global communications for critical industries, governments, and private users, serving over 2.5 million active subscribers despite recent market competition. In contrast to terrestrial wireless standards such as 3GPP, Iridium protocol specifications are proprietary and have not undergone rigorous, public, and systematic security evaluation. In this work, we present the first comprehensive security analysis of Iridium authentication and radio link protocols. We reverse engineer Iridium SIM-based authentication mechanism and demonstrate that the secret key can be extracted from the SIM card, enabling full device cloning and impersonation attacks. Leveraging a month-long dataset of Iridium up- and downlink satellite traffic, we further show that nearly all signaling and radio communication protocols currently in use lack encryption, resulting in the exposure of sensitive information in cleartext over the air such as login credentials and large volumes of personal data. Finally, we develop custom software-defined radio (SDR) tools to carry out spoofing and jamming attacks, revealing that modestly equipped adversaries can inject falsified messages or disrupt the Iridium service locally due to the absence of source authentication. Our findings uncover systemic vulnerabilities in the Iridium radio link and highlight the urgent need for users of critical applications to transition to more secure communication radio links.
Sam: To spot unencrypted data, they measured how random the reassembled payloads looked. Plain text, like emails or GPS coordinates, follows predictable patterns—letters and numbers repeating in ways that aren't truly chaotic. Encrypted data appears far more jumbled, with no obvious repeats. Researchers call this randomness score Shannon entropy: sessions around 4 to 5 bits per byte suggested clear text, while over 7 bits pointed to protected content. The analysis confirmed most traffic fits that low-entropy profile.
Alex: So low randomness flags the plaintext—like spotting a note written in English amid gibberish. And this ties back to those proprietary protocols?
Sam: Yes. Iridium's setup layers signals much like internet protocols: bottom handles raw radio timing with shared time slots, middle manages connections via control words that sync devices, authenticate, or carry voice bits. The top adds a reliable packet system akin to TCP, using numbers to track and confirm data order. Newer Iridium NEXT satellites from 2019 kept this old structure for compatibility but widened channels for faster speeds—yet the core radio link stays exposed.
Alex: Even with hardware upgrades, the over-the-air part remains a weak link in the chain. What did the researchers actually pull from that captured traffic? Were there specific examples of sensitive info just sitting there?
Sam: They analyzed over 186 million frames from a month's downlink captures, sorting them into categories like voice, messaging, or data packets. Most frame types—voice calls, pager alerts, short data bursts—send content without any built-in scrambling. For user data like IP sessions or texts, they checked randomness again: most showed low randomness, pointing to plaintext. They spotted maritime terminals setting up connections with usernames and passwords directly in the packets—no hiding. One session showed HTTP login headers for an Iridium hotspot's web control page, easy to decode. They even reassembled full IP sessions successfully.
Alex: So roughly nine out of ten data frames are readable—like opening unsecured mail. That includes things like login details and patient info from a rescue ship. How close does the attacker need to be?
Sam: Satellites beam down over huge areas, hundreds of kilometers wide, so a ground listener with a decent antenna catches traffic from anywhere in that footprint. Uplink from ships is narrower, needing proximity within 20 to 30 kilometers for reliable grabs, but downlinks dominate the risk. The paper notes this exposes medical distress calls with personal health data, remote controls for infrastructure, or military chatter—all without default protection.
Alex: That range turns passive listening into a broad surveillance tool. Did they test active tricks, like faking signals?
Sam: They did controlled tests in a shielded room using an SDR to transmit. One replayed a real authentication sequence recorded nearby, fooling a device into responding as if talking to the network. Another crafted fake ring alerts from scratch, which the device accepted fully. Jamming used steady noise to block registration, succeeding at low power.
Alex: Replays and fakes work because there's no two-way check. So the network trusts any signal mimicking the format. With all those location details leaking, how does the paper show users getting tracked without even decoding the full content?
Sam: Devices often send their last known position to the network when checking in, and the satellites reply with an estimated current spot based on signal timing. Both get sent in plain view over the air, precise to about a kilometer per axis. Over a week, researchers logged more than 130,000 such pairs from downlinks—plotted on a map, they cluster around hotspots like ships or planes, leaking presence even if you can't link to a specific user right away.
Alex: That's passive tracking at scale. For spoofing, they proved it works end-to-end: an SDR mimicked a satellite fully, tricking a device into authenticating and reacting to fake alerts. What about jamming—did the tests match the power needs?
Sam: Their lab runs confirmed theory: noise overpowering ring alerts drops packet reception to half when the jammer needs just a bit less power than the legit signal. Uplink jamming works at low output, like one milliwatt from ground gear blocking wide areas since satellite signals arrive weak.
Alex: Even modest gear disrupts emergencies over big zones. Why has Iridium stuck with this GSM holdover for so long?
Sam: Early on, around the late 1990s, GSM's setup seemed solid enough—encryption faced export rules plus added delay on slow satellite links. They banked on obscurity: big antennas and rare decoders kept threats low. Backward compatibility locked it in—even Iridium NEXT keeps legacy support for old gear.
Alex: Pulling it all together, what does the paper say about the bigger picture for users relying on this?
Sam: The analysis shows Iridium's radio link matches early-1990s GSM vulnerabilities—keys extract easily, most legacy traffic sends plain, and signals spoof or jam with basic gear. This undercuts any idea that satellite calls stay private or secure, especially for thousands using it in emergencies, news reporting, sailing, flying, or military ops. As cheap tools spread, yesterday's theory turns practical today.
Alex: Well put, Sam. Thanks for breaking down this analysis—it's a clear reminder that even space tech needs regular security checks. Thanks for listening to ResearchPod.