VSAT Ground Segment Assessment
7 CRITICAL FINDINGS
VSAT · TR-069 · RF
313-BIND ANCHORED
A full ground segment security sweep of a Ku-band VSAT installation targeting 192.168.100.1/24 using the Shadow313 VSAT Tactical Security Suite v5.0 Ultra.
Findings
| Severity | Finding | Host | Remediation |
|---|---|---|---|
| CRITICAL | Telnet (Port 23) OPEN | 192.168.100.1 | Disable telnet; deploy SSH (Ed25519) |
| CRITICAL | FTP Anonymous Write (Port 21) | 192.168.100.15 | Disable FTP; deploy SFTP chroot |
| CRITICAL | CVE-2026-3392 TR-069 CWMP | 192.168.100.1 | Disable CWMP or enforce mutual TLS |
| CRITICAL | Unsigned Firmware Accepted | 192.168.100.1 | Enable firmware signature verification |
| CRITICAL | UART/JTAG Unauthenticated | 192.168.100.1 | Physically secure debug headers |
| HIGH | SNR 5.9 dB / Clock Skew +55.1 Hz | RF Link | Resync GPS/NTP; inspect OCXO |
| CRITICAL | QKD BB84 QBER 40% — Eavesdropper | QKD Link | Abort key exchange; investigate RF path |
313-BIND Receipt: 313-VSAT-A4F2C1 · IPFS: QmX7k9... · Chain: INTACT
APT29 Lateral Movement Emulation
8/8 DETECTED
APT29 · MITRE ATT&CK
313-BIND ANCHORED
Full APT29-style kill chain emulation across a simulated enterprise environment. Shadow313 NEXUS detected all 8 attack stages using the FIX-12 through IDENTITY-8 detector stack.
Kill Chain Coverage
| Stage | Technique | TID | Result |
|---|---|---|---|
| Initial Access | Spearphishing Attachment | T1566.001 | ✅ DETECTED (score: 0.89) |
| Execution | PowerShell Encoded Command | T1059.001 | ✅ DETECTED (score: 0.92) |
| Credential Access | LSASS Memory Dump | T1003.001 | ✅ DETECTED (score: 0.95) |
| Lateral Movement | Pass-the-Hash via WMI | T1550.002 | ✅ DETECTED (score: 0.87) |
| Privilege Escalation | PrintNightmare (T1068) | T1068 | ✅ DETECTED (score: 0.91) |
| Credential Access | DCSync | T1003.006 | ✅ DETECTED (score: 0.88) |
| Collection | Data from Local System | T1005 | ✅ DETECTED (score: 0.79) |
| Exfiltration | DNS Tunneling | T1048 | ✅ DETECTED (score: 0.84) |
Post-Quantum Migration Assessment
12/14 PATCHED
FIPS 203/204/205
DW-1/DW-2 PENDING
Complete CRQC attack surface analysis and migration assessment for a security platform transitioning from RSA/ECDSA to post-quantum algorithms.
Migration Status
| Item | Algorithm | Status | Timeline |
|---|---|---|---|
| CRQC-001 plugin_signer.py | ECDSA → ML-DSA-65 | ✅ PATCHED | v4.0.0 |
| CRQC-002 temporal chain | SHA-256 → SHA3-512 | ✅ PATCHED | v4.0.0 |
| CRQC-003 cosign ECDSA | ECDSA → SLH-DSA | ✅ PATCHED | v4.0.0 |
| CRQC-007 crypto_store | RSA → ML-KEM-768 | ✅ PATCHED | v4.0.0 |
| CRQC-012 pyspx fallback | HMAC → SLH-DSA | ✅ PATCHED | v4.0.0 |
| DW-1 liboqs ML-DSA | HMAC proxy → real ML-DSA | 🔄 PLANNED | Q4 2026 |
| DW-2 HSM key storage | In-memory → Azure Key Vault HSM | 🔄 PLANNED | Q1 2027 |