Hackers can fake radio signals to 'hijack' aircraft landing systems

https://www.computing.co.uk/ctg/news/3075890/hackers-aircraft-landing-fake-radio-signals

by wglb • 7 years ago

153 124 7 years ago

computing.co.uk

wglb• 7 years ago

The underlying paper here: https://aanjhan.com/assets/ils_usenix2019.pdf

cjrp• 7 years ago

How powerful would a malicious transmitter need to be in order to overpower the legitimate ILS signal?

NegativeLatency• 7 years ago

If you got it close enough you could probably do it with a pretty low power transmitter. (Radio on a drone or something)

jethro_tell• 7 years ago

You'd need to be out by the transmitter in the middle of the airfield though to truely spoof it.

sciurus• 7 years ago

Ars Technica covers this story much better at https://arstechnica.com/information-technology/2019/05/the-r...

sascha_sl• 7 years ago

This is news?

Def Con in 2012 https://www.youtube.com/watch?v=e1QAjCH_1oU

ryandrake• 7 years ago

A lot of aviation runs on basic radio technology. ILS, VORs, all voice comms with ATC. It’s well known that these frequencies can be jammed or transmitted on by bad actors. If you want to do this, go ahead and roll the dice on having multiple federal agencies come down on you like a ton of bricks. See how it works out.

EDIT: (Since I can’t reply because HN for whatever reason prevents me from posting more than 2-3 replies per day): To clarify, yes I’m arguing that this is not newsworthy.

gruez2• 7 years ago

having multiple federal agencies come down on you like a ton of bricks.

Only if you get caught. How do they catch you if you set up the transmitters and then fled the scene?

maximente• 7 years ago

GP's question asked about newsworthiness. how does this reply address that question?

jimktrains23• 7 years ago

all voice comms with ATC

This, specifically is a feature, and why voice is still done over AM. It allows all planes to be heard by ATC, regardless of their transmission strength relative to other planes. AM signals "add" whereas FM tends to have a "capture" effect, and only receive the strongest signal (or most equally strong signals) at a time.

ILS, VORs

Slightly OT, but I love the simplicity of design in these systems. They've actually inspired me to go, finally, take my HAM license exam. (Probably early next month due to scheduling.)

I sometimes feel like many systems built are just much to over-engineered and don't even attempt to exploit physics to do their job. On the other hand, as this article points out, VORs and ILS aren't authentication.

I still can't believe that there wasn't designed with some kind of authentication built into the ADS-B system. It's newer and deals with transmitting arbitrary data.

lsh123• 7 years ago

1990: https://m.imdb.com/title/tt0099423/

jwilk• 7 years ago

Non-mobile link: https://www.imdb.com/title/tt0099423/

wiml• 7 years ago

1700: https://opencurtains.wordpress.com/2014/04/22/false-lights/ https://en.wikipedia.org/wiki/Wrecking_(shipwreck)

(Fictional, but widely believed to be true, at least for a time)

NeedMoreTea• 7 years ago

1939 and 1940: https://en.wikipedia.org/wiki/Battle_of_the_Beams

Ended when Germany moved the radio gear in preparation for invading Russia.

dontbenebby4• 7 years ago

This is an issue, but I wouldn't be too alarmist. It probably wouldn't crash a plane though, just severely cripple an airport. (Cause all take offs to be cancelled, all incoming flights diverted, and the planes in the air land one by one in order of fuel urgency using line of sight.)

antsar• 7 years ago

(not a pilot) I'd think causing the autopilot to believe it is substantially off-course would induce a sharp bank to correct course. That bank at low altitude can lead to a wing strike. If not, still seems plausible to deviate enough to impact obstacles near the runway.

dontbenebby4• 7 years ago

Possibly? Not a pilot either (but I took multiple human factors courses which talk a lot about air crashes).

I'd hope that the pilot would notice something is off and abort the landing before that. (Eg: visually be like "oh there is something on the runway I thought I was cleared on)

Theoretically even if cleared for landing they should keep an eye out and abort if, say, an errant baggage cart was in the way.

steffan• 7 years ago

No airplane low enough to have a 'wing strike' due to a bank would be on autopilot.

In any other condition, the pilot would see the runway well before the aircraft was at an altitude low enough to touch the ground in any sort of bank or turn.

A commercial airplane operating under Cat IIIa ILS at a Cat IIIa Airport could operate on autoland to the touchdown point

logfromblammo4• 7 years ago

Wouldn't you yaw with rudder and asymmetric engine power when at low speed at a lower altitude, instead of using a bank turn?

If you could potentially cause a wing strike, why wouldn't you just trick the plane into landing on the taxiway, for maximum chaos?

weaksauce• 7 years ago

Drones can cripple an airport this way now.

dontbenebby4• 7 years ago

Good point. Exotic attacks are fun to think up, but the real threats are often much less "cool".

sokoloff2• 7 years ago

The localizer (lateral deviation indication) is going to be harder to spoof due to the beat/squeal that it would introduce when broadcast alongside the legitimate localizer. The pilot (or PNF) will monitor the audio signal for the Morse code that identifies the localizer and the squeal will be apparent.

The glideslope signal (vertical deviation indication) would be easier to spoof. Set that up 1/2 mile short of the runway and aligned to intercept the proper glideslope shortly before the true glideslope intercept point (Maltese cross on the chart). That has a chance of working and going undetected. If you're able to get an aircraft onto the rogue glideslope lobe, even when ATC gets a low altitude alert, the crew is likely to report they're perfectly on glideslope. I'm not sure this is as practical an attack as simply firing on an aircraft on approach, of course.

i_am_proteus• 7 years ago

One could probably simultaneously spoof ADS-B for added chaos.

jcims2• 7 years ago

Easily. I've heard that some systems are using trilateration to reject spoofed ADS-B but am not sure how widespread that is.

Trolling flightradar24 and like services would be easy.

AWildC1824• 7 years ago

And with WAAS, the world is moving towards GPS approaches anyway. Even without careful planning anyone with a mildly powerful VHF radio and a yagi antenna can jam ILS, VORs and ATC comms rather effectively and has been able to since the end of WWII.

I've seen these articles pop up a few times in the past couple days but everyone in aviation already knows that there isn't any security on this stuff. People even jam ATC for giggles sometimes[1]. There's enough redundancy that nothing bad has happened as a result so everyone goes on with life. I think this is just low hanging defcon fruit targeting non aviation-aware readers.

[1] https://www.youtube.com/watch?v=ZvA_-linhg8

monocasa2• 7 years ago

Can't you override GPS too? I thought that was part of the exploit chain that netted Iran a stealth drone.

zymhan2• 7 years ago

Username checks out :)

Ars technica cited a researcher at Northwestern that said GPS isn't necessarily a perfect fallback

One reason: the types of runway misalignments that would be effective in a spoofing attack typically range from about 32 feet to 50 feet, since pilots or air traffic controllers will visually detect anything bigger. It’s extremely difficult for GPS to detect malicious offsets that small. A second reason is that GPS spoofing attacks are relatively easy to carry out.

https://arstechnica.com/information-technology/2019/05/the-r...

dbcurtis3• 7 years ago

People even jam ATC for giggles sometimes.

Or impersonate. One of my pilot friends was planning a trip across the CA Central Valley, and he reported with some bemusement that there was at active NOTAM (NOtice To Air Men) to be on guard about some guy in the Fresno area that was impersonating ATC. Apparently it had been happening for months and nothing much by way of investigation had taken place.

At this point I pretty much concluded that bad Part 15 devices or PG&E power line noise h0rk1ng over my ham radio reception was not going to get any attention, ever, if the FCC can't be bothered to find an ATC impersonator. I mean really, there are hams that do hidden transmitter hunts purely for sport. A posse of them could find that clown easily on any random Saturday morning and not be late for lunch.

jcims2• 7 years ago

Couldn't squeal be minimized by phase matching the localizer then mixing in a doppler offset (assuming you know what you're targeting)? You would still likely get some noise but possibly not sufficient to disrupt the action.

Datenstrom• 7 years ago

harder to spoof

Whenever I hear something like this it reminds me of the favorite talks I attended. The Iridium hacking talk at HOPE XI[1].

"When they talk about security they mainly talk about 'hey this is so complex, no one is able to do this, maybe a state or something like that'. So they say 'it will probably be beyond the reach of all but the most determined attackers.' We went well ok, we are determined."

[1] https://youtu.be/cvKaC4pNvck

cco• 7 years ago

Additionally don't forget to add in the human aspect of this, the attack may be detectible to somebody in a clean room that is expecting it, but the same attack on a real pilot in flight may work because the human is not expecting it, is distracted, a little tired, paying attention to adverse weather etc

madMapper• 7 years ago

Isn't this pretty much the plot to Die Hard 2?

IBCNU• 7 years ago

you read my mind

NikkiA2• 7 years ago

Yes. Exactly it.

wyldfire• 7 years ago

I'm not sure this is as practical an attack as simply firing on an aircraft on approach, of course.

But that would reveal your position. Presumably the above could be executed without even being present: just leave behind the equipment.

Stevvo• 7 years ago

I don't think the attack would work in the wild; even on a Cat III autoland approach, there is still a decision altitude and runway visual range requirements. When the runway never appears it's a go around.

stouset2• 7 years ago

Cat IIIc has no decision height, but there aren’t any airports that are even planning to install this type of system that I’m aware of. Cat IIIa and IIIb have decision heights of 100ft and 50ft, respectively. Those don’t leave much time for a pilot to execute a go-around.

You’d probably have to engineer the flight path to go through a building, power line, or other obstacle, but that in and of itself seems like a difficult proposition since flight paths leading into an airport with this type of system wouldn’t have 100ft obstacles anywhere near the approach direction. You’d have to spoof the localizer to be offset to the side of the runway to accomplish this, but doing it too far will cause instruments to disagree (GPS, VOR) and ATC to yell at you.

Maybe you could aim it at a nearby taxiway, but to do so (per my understanding of the physics of ILS) you’d have to have your equipment in-line with the taxiway. All of this just seems really hard to pull off in practice.

sokoloff2• 7 years ago

If you can get the airplane to descend early to a decision height 200 feet above touchdown zone elevation in an area where local terrain is 150’ above TDZE, you might be able to crash one who initiates the missed approach at the DH.

I agree it’s not a practical attack.

themark• 7 years ago

How about MCAS?

outworlder• 7 years ago

Irrelevant to this discussion.

NikkiA2• 7 years ago

I think the point being made is that this feels an awful lot like a 'hey, don't keep talking about mcas.... look at this huge problem that terrorists might exploit (if they rent die hard 2), look how scary it is, boogaboogaboo'

meatmanek• 7 years ago

ILS works pretty much the same way as the Lorenz/Knickebein system used in WWII by the Germans to guide bombers (described in https://news.ycombinator.com/item?id=19737056), so the attack described in TFA sounds basically the same as the countermeasures deployed by the British.

xvf22• 7 years ago

HFDL and ACARS (encryption is optional) don't have much in the way of protection either.

ChuckMcM3• 7 years ago

Given my sort of 'maker' inclinations, I find these articles amusing. The "3D print a gun!" ones were similar.

Basically they come down to, if you learn how a system works, or how something is made, you can learn to implement or influence that system and/or build that thing. Back in the 60's the click bait was "kid learns how to build an atomic bomb!" This was pretty eye catching but really it is just physics, material science, and a bit of math.

That said, so many people rarely look past the surface of things, seeing something like a cell phone as an opaque magical brick that can do wondrous things. And yet all that the phone does, and how it does it, are knowable if someone chooses to invest the time. (admittedly it is a lot of time if you don't have the basics).

The headline, "People who know how radios work can affect systems that are based on radio." is so much less scary.

wolf550e2• 7 years ago

It is interesting to know whether a system that is important for safety and/or security is susceptible to hijacking by anyone who can build a radio or whether it is protected using secure cryptography (and then, who holds the keys).

If, for example, simply transmitting in the clear on the right frequency can get the airliner to try to land on a virtual runway that is 20 feet below the real one - that is interesting.

bdamm3• 7 years ago

That would actually be pretty hard, since the airliner uses their own altimeter and radar to determine how close they are to the runway.

Much easier would be to put the runway where it doesn't exist, such as at the foot of a cluster of tall buildings or hillside that is a mile from the actual location. A strong transmitter and directional antenna would be effective. It would be a once-only attack, because the FCC, FAA, FBI would all be on maximum alert after that. There's also a good chance it wouldn't work because the airliner is cross checking its position with GPS, ATC is cross checking with radar, and there's a good chance either the pilot or ATC will abort due to confusion over position.

rixed• 7 years ago

That may be interesting, but the fact that airliners could be fooled or even crashed by interfering with the radio signals they rely on is no more a security concern that the fact that airliners can be shoot down with missiles.

ChuckMcM3• 7 years ago

I agree with this basic sentiment, there is a whole class of problems that were "hard" before modern technology made them "easy". It is definitely interesting to look at legacy systems that relied on the 'difficulty' factor as part of their design as a protection against abuse.

For example it was both inspiring and utterly brilliant in the way that Alan Turing broke the Enigma cipher with his Bombe machine, but today anyone who knew how Enigma worked (which England did at the time) with a modern laptop could exhaustively search the keyspace and 'crack' messages in real time.

Software radios have made it possible for curious people to have "read/write" access to the entire spectrum between half a megahertz and six gigahertz. That will continue to be a problem for people who designed systems that depended on how "difficult" it was to build a radio at their particular frequency.

That isn't the case for Aircraft navigation. Anyone who can pass the Amateur "General' class exam in the US has the necessary knowledge for interfering, potentially destructively, with aircraft navigation. I normally would consider that a non-issue except that Asian Airlines flew a plane into the runway at SFO. Is that a system problem? Or one where the pilot should be better trained? Arguments can probably made along those lines. But that interfering with navigation is possible with pretty much "off the shelf" components? Not really a new thing and certainly not something that is an imminent threat to passenger safety.

femto• 7 years ago

A set of encryption keys for a critical system is another point of failure: when there is a problem with the keys the system stops working. I'd posit that the risk of a failure due to a problem with the keys is greater than the risk of a failure due to spoofing, so the safest solution in practise is to leave the encryption out until failures due to spoofing are more common than failure due to keys (meaning it is unlikely that encryption will ever be installed).

tgsovlerkhgsel2• 7 years ago

No encryption whatsoever. The systems are primitive analog systems, about the level of WW2 guidance technology. This is also not news to anyone who bothered to read Wikipedia or Stackexchange.

https://en.wikipedia.org/wiki/Instrument_landing_system and https://aviation.stackexchange.com/a/2661, compare https://en.wikipedia.org/wiki/Battle_of_the_Beams

jonplackett• 7 years ago

The thing I like best about HN is that when a headline looks a bit clickbaity I can just read the first few comments and confirm my suspicions.

No need to actually read this one. Thanks guys.

jlg23• 7 years ago

The headline, "People who know how radios work can affect systems that are based on radio." is so much less scary.

No, it is not. Nobody should be able to influence air traffic in that way just because she/he understands the transport layer.

After spending a night with a friend who just returned from a security audit (lots of cocktails were involved too) 15 years ago, I am convinced that the only reason we have not seen major disruptions yet is because of a pretty strict adherence to hacker ethics: one of the global "airport tech players" was deploying systems that used UDP for ground traffic control.... Having a bus or lorry use an active runway is just a single, malicious UDP packet away...

mopsi3• 7 years ago

Having a bus or lorry use an active runway is just a single, malicious UDP packet away...

There are multiple safeguards in place to avoid single points of failure, such as runway crossing procedures with mandatory call to air traffic control unit for explicit permission before entering a runway. Many ATC recordings on VASAviation Youtube channel show that even rescue services (during emergencies) adhere to that.

Taxiways leading to runways are marked with holding positions that may not be crossed without authorization: https://i.imgur.com/dCF8lFi.jpg For extra visibility in poor weather, many airports are also equipped with runway guard lights paved into the ground or blinking on either side of the taxiway: https://i.imgur.com/dbix1Aw.png

Surface movement radars and transponder-based systems have also become widespread. They trigger alerts when a vehicle is about to enter an active runway: https://i.imgur.com/sJQ94zq.jpg

ChuckMcM3• 7 years ago

No, it is not. Nobody should be able to influence air traffic in that way just because she/he understands the transport layer.

I hear you. But it is the reality of the world. There comes a time when everyone realizes that the boundary between civilized behavior and uncivilized behavior is just a convention. I think of it as the final stage of moving from childhood into adulthood.

For example, you could go into the hardware store and buy a couple of bags of fertilizer, some stump remover, a bag of charcoal for the grill, some food for the roses, and six quarts of motor oil. Are you going to do some gardening and grilling over the weekend or going to blow up someone's house? The materials work for either activity. Maybe you rent a moving van over the holiday weekend. Helping a buddy move? Or mowing down tourists at a crowded venue?

People who choose to be evil will be evil. There isn't anything you can do about them but you can build defense in depth on various other ways.

In the case of air navigation you have a pilot in the cockpit who is supposed to be paying attention. They can takeoff, navigate, and land with nothing more than their eyeballs, a compass, and some paper charts. All the other gizmos help certainly but they aren't essential[1]. When people actively interfere with the other gizmos, whether it is intentionally by transmitting on restricted frequencies, or unintentionally like the delivery truck that shut down Newark Airport because the driver used a GPS jammer to keep the home office from seeing they were taking a break while he watched the planes, it has effects. The rest of the system reacts to minimize damage and risk and the actions themselves bring attention to the people involved.

It is fortunate in my experience that that 90+% of the people in the world are too lazy or simply not wired to be curious about how things work the way they do. You may have noticed from the article that they didn't say how you would interfere with navigation with a "$600 SDR", they just said that you could. Most people reading that will say, "Oh dear that's dreadful! Oh look here's a picture of a funny puppy on the next page."

As I get older and meet more people, it amazes me how rare genuine curiosity really is. The persistence to follow that curiosity in order to develop understanding is rarer still. Life doesn't have a safety net, and trying to give it one to eliminate danger completely is pretty futile.

[1] Ok the pilots in the group are going to jump up and say, without an artificial horizon, an airspeed indicator, and working altimeter and you'll be sorry but even without those you can do pretty well.

inferiorhuman4• 7 years ago

I am convinced that the only reason we have not seen major disruptions yet is because of a pretty strict adherence to hacker ethics

Sure, that and the redundancy and procedure built into an ILS approach. Keep in mind that even airplanes on the wrong part of the tarmac can fuck with the localizer. ILS is imperfect and that's already well known and worked around[1].

1: https://www.pprune.org/rumours-news/616082-air-india-b788-de...

fooker• 7 years ago

Nobody should be able to influence air traffic

That is impossible to prevent. If not anything, it is usually not that difficult to overwhelm any electromagnetic communication with your own powerful signal. Preventing communication is at least as destructive as manipulating communication without avoiding detection.

Haga• 7 years ago

The gods decided that we shall not wield exponential fire less it serves them, thus your smartphone advanced a thousand years, but your cigarettes lighter did not. To contemplate a fusion driven cigarette lighter is heresy. Theire will shall be done, the thought not even contemplated.

kruczek• 7 years ago

Having a bus or lorry use an active runway is just a single, malicious UDP packet away...

Nonsense. It all depends on what is implemented on top of UDP.

OrgNet• 7 years ago

It appears to be a huge problem... perhaps messages sent over the air for such an important system should be crypto-signed?

It reminds me of when the Army's drone was diverted and captured because someone spoofed GPS... It probably isn't possible to capture a drone in the same way anymore because I'm sure that they fixed this flaw.

It's like the HTTP vs HTTPS problem ... but anyone can MITM attack because the signal is wireless (and not encrypted and/or signed).

MindySS• 7 years ago

It’s not surprising that Google prefers reliable sites with a valid server certificate.

In this case, the user can be sure that the site uses encryption of personal data to increase protection and security. However, it must be understood that obtaining a certificate can be a daunting task (which accounts for the additional weight of this factor when ranking).

When a site requests a certificate, the organization that issued the certificate becomes a trusted third party to read more here https://sitechecker.pro/http-vs-https/ and check it. When your browser accesses a site that uses the secure HTTPS protocol, it uses the information contained in the certificate to authenticate the site. A user who understands the difference between HTTP and HTTPS, can safely make purchases, and not be afraid that his data will be stolen.

gcb0• 7 years ago

that's why you flag them and move on.

lutorm• 7 years ago

ILS is ancient.

"Tests of the ILS system began in 1929 in the United States."

It's really just a radio beam. It's no wonder it can be mucked with.

bjt2n3904• 7 years ago

There's too much sensation on this headline. The hacker does not take control of the aircraft, simply gives misleading information to the pilot.

"Hacking" is a bit of a heavy handed word here, too.

mopsi3• 7 years ago

Skimmed over the whitepaper and did not notice any mention of ILS monitoring systems. Modern ILS has continuous automatic monitoring that triggers alerts or shuts off the whole system if disturbance of beam characteristics is detected.

Such monitoring systems date back to 1960s: https://sci-hub.tw/10.1049/ree.1967.0009

sdca2• 7 years ago

Sounds like a single point of failure if the pilots rely on ATC too much. Low visibility landings and such.

mlindner• 7 years ago

This is well known and has been for decades. Unlike attacks based on the internet though it’s trivial to track down people who are doing illegal broadcasts. There isn’t a concern here.

sbhn• 7 years ago

I can see all the politicians lining up now, “ME, ME, ME. Let ME remind the people that they are under attack”, from something they have no control over

Hackers can fake radio signals to 'hijack' aircraft landing systems

Related Stories