Value chain · CLM-0757
In plain terms
In its own report on the February 2022 attack, Viasat says the attacker got in through a misconfigured VPN device, reached the network management system, and then sent the network's own ordinary management commands to tens of thousands of customer modems at once, wiping enough of their memory to knock them off the network without permanently breaking them.
The claim as recorded
Viasat's own incident report on the 24 February 2022 attack on its KA-SAT network states that subsequent investigation and forensic analysis identified a ground-based network intrusion by an attacker exploiting a misconfiguration in a VPN appliance to gain remote access to the trusted management segment, who moved laterally to a specific segment used to manage and operate the network and then used that network access to execute legitimate, targeted management commands on a large number of residential modems simultaneously, with those destructive commands overwriting key data in flash memory and rendering the modems unable to access the network but not permanently unusable; the report times the opening denial-of-service traffic at approximately 0302 UTC from SurfBeam2 and SurfBeam 2+ modems located within Ukraine, records larger numbers of modems across much of Europe exiting the network from approximately 0415 UTC over the course of about 45 minutes, states the impact as several thousand customers in Ukraine plus tens of thousands of other fixed broadband customers across Europe, and reports the network largely stabilised within hours and fully stabilised within several days with nearly 30,000 replacement modems shipped.
Scope and limits
The affected operator's own account, published five weeks after the event while, in its own words, "That investigation is still ongoing", and it is evidence of what Viasat stated on 30 March 2022 rather than an independent finding of fact. Viasat states it will not share specific technical details of its mitigation actions publicly, so the report is incomplete by design. It concerns a consumer broadband service partition operated on Viasat's behalf by a third party under a transition agreement, not a power-delivery system, and no SBSP system is evidenced as having this vulnerability. Viasat's statement that the modems were not permanently unusable was later qualified by third-party analysis of wiper malware - see CLM-0760.
What it assumes
No assumptions are recorded against this claim.
Where it comes from
, verbatim: "...a ground-based network intrusion by an attacker exploiting a misconfiguration in a VPN appliance... used this network access to execute legitimate, targeted management commands on a large number of residential modems simultaneously... these destructive commands overwrote key data in flash memory... rendering the modems unable to access the network, but not permanently unusable." Timeline, verbatim: "At approximately 0302 UTC on 24 February 2022, high volumes of focused, malicious traffic were detected emanating from several SurfBeam2 and SurfBeam 2+ modems and/or associated customer premise equipment (CPE) physically located within Ukraine". Verbatim: "until approximately 0415 UTC, when Viasat and Skylogic observed larger numbers of modems across much of Europe exiting the network over the course of about 45 minutes". Impact, verbatim: "the cyber-attack did impact several thousand customers located in Ukraine and tens of thousands of other fixed broadband customers across Europe". Recovery, verbatim: "the network was largely stabilized within hours and fully stabilized within several days"; "Viasat has already shipped nearly 30,000 modems to distributors to bring customers back online"; "The modems can be fully restored via a factory reset."
Basis: incident timeline in UTC; modem counts; attack mechanism, qualitative
Related records
- Answers question
- QST-011 not published in this release
- Contradicts
- CLM-0230 A 2019 US study warns that large solar power satellites could be more at risk as more countries...
Cite this
energyaperture.com/c/clm-0757
CLM-0757, Energy Aperture, as of 2022-03-30.
Connected records
Other published records linked to this one. A list, not a judgement.
- Also from SRC-230
- CLM-0758Viasat's own report, about five weeks after the attack, says it had found no evidence that the satellite itself or its main ground stations...CLM-0765Searching all fourteen security and defence sources for anything about insurance or liability turns up no premium, no cover limit and no...
- Contradicted by
- CLM-0230A 2019 US study warns that large solar power satellites could be more at risk as more countries build anti-satellite weapons, and suggests...