Viasat spills on the Russian attack, warns of continued risks

It turns out the only thing Russian forces needed to knock thousands of Ukrainian satellite broadband customers offline was a misconfigured VPN. Viasat, whose Ukrainian satellite broadband service was knocked offline the day Russia invaded Ukraine, said its analysis of the attack revealed a poorly configured VPN appliance was …

[bpfh]

Finally some details

I pinged this to El Reg a month ago. A friend is still waiting for his new modem, his went down on the same day Russia launched their attack on Ukraine. I wonder how long in advance that "someone" knew about this and had had their attack set up and ready to go within minutes of the tanks rolling?

[stiine]

where did they get spares....

with all of the supply chain issues recently, and orders of computer and network equipment with lead times already in double-digit months?

[Knoydart]

Re: where did they get spares....

Maybe they shifted stock from new customers, to existing customers with their bricked devices?

[Down not across]

Re: where did they get spares....

Not sure they necessarily need spares as such.. sounds like a case of reflashing (possibly with help of JTAG or something).

[Snake]

Err...

...poorly configured VPN appliance was used by the attacker to access the trusted management section of the KA-SAT satellite network.

The attacker gained access to the segment of the network used to manage and operate it..."

What does that sound like to me?

"Some PFY / BOFH left the default admin login on the VPN gateway active. We have fixed the problem by relegating him to the 'mailroom'.

May his soul find [eventual] redemption."

[naive]

Funny how life became a James Bond movie

Always those Russians and the baddie Vladimir Blofeld,

[Mikehhh]

Joe Saward, a F1 Journalist who lives in France was affected by this too, so it was definitely more widespread than just Ukrainian access.

https://joesaward.wordpress.com/2022/03/05/apologies-for-being-quiet/

"I live in rural bliss in France. The mobile phone coverage is non-existent. Sadly, Mr Putin and his chums took out the satellite I use to get Internet access (strange but true).

Thus life is a bit complicated until a new service provider get things up and running.

(This was written on an iPhone, while I sat in the dark under a mobile phone tower… I’m off home now…)"

[bpfh]

Same story from France too

The French government did a press conference on this and was reported that something like 10 000 modems got wholloped across Europe, and not just Ukraine, with reports from France, Germany, Spain, UK and others, although there was no official comment other than what the local ISP's were willing to say on the phone but not write down. Orange was telling clients "It was Putin" on support calls end of February so they knew what had happened more or less, but were being economical with the info, even if the army seemed to have a bit more knowledge, but were not saying much more than a hack happened.