A Black-Box Security Evaluation of the SpaceX Starlink User Terminal
KU Leuven researcher Lennert Wouters demonstrates a custom hardware modchip that executes voltage fault injection on the SpaceX Starlink user terminal to bypass secure boot.
Summary
The Architecture of SpaceX Starlink User Terminals (Dishy)
The Starlink User Terminal (UT) relies on a custom quad-core ARM Cortex-A53 SoC with hardware-enforced verified boot to protect satellite network keys.
Black-Box Hardware Reverse Engineering
Lennert Wouters details tearing down the terminal PCB, decapping shielding, and analyzing power distribution networks and flash memory lines.
Executing Voltage Fault Injection (Glitching)
Wouters demonstrates building a low-cost custom modchip that injects precise voltage glitches into the eMMC and SoC power rails during bootrom execution.
Bypassing Secure Boot to Execute Custom Firmware
The author successfully bypasses bootrom signature verification, obtains root access, and explores Starlink backend satellite communication protocols.
Related talks
Main Stage·53 min
Damian Zabrocki · Alex Matrosov
Hardware security experts execute electromagnetic and voltage fault injection on RISC-V silicon, corrupting trap vectors (MTVEC) to bypass Secure Boot.
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Wireless Village·33 min
Travis Goodspeed
Travis Goodspeed provides an update on the Goodwatch open-source wrist-worn RF radio hacking and packet manipulation platform.