Hello. In the previous talk, we saw a demonstration of ILS spoofing and ADSP-DCAS spoofing. In
this talk, I'll be going over the fundamental principles and security issues of these systems.
The ILS work was done in collaboration with Damian Sherpas and my advisors, Professor
Anjan Ranganathan and Professor Guvara Nobir from Northeastern University. Well, yes, the
ILS part is very similar to what the bad guys did in Die Hard 2. Actually, that was one
of the motivation factors behind this research. Sometimes fiction does turn into reality.
In recent years, the aviation industry has seen a significant rise with approximately
15,000 flights in the sky at any given time. Of course, with the onset of COVID-19, this
has drastically changed, but nevertheless. Atlanta's Hartfield International Airport
is considered to be the busiest airport. It itself caters to over 2,500 takeoffs and landings
every single day. Right from taxing to the runway for takeoff to arriving and taxing
back to destination gate, these flights rely on a plethora of wireless navigation aids.
Pilots continuously interact with APC using RF channels. Controllers use surveillance
radar for aircraft localization. Automatic dependent surveillance broadcast enables aircraft
tracking. Traffic and collision avoidance systems like ACAS and TCAS also relies on
these ADS-B packets. Flights use satellite systems for general point-to-point navigation.
At the end, instrument landing system gets you safely back on ground even in extreme
weather conditions. In recent years, systems like ADS-B and navigation aids like GPS have
been found to be vulnerable by the researchers. It is possible to include ghost aircrafts
by spoofing ADS-B packets. In the previous talk, we witnessed the effects of spoofing
ADS-B packets to disrupt collision avoidance systems. It has been shown multiple times
how GPS is vulnerable to spoofing attacks. With the advent of real inexpensive software-defined
radio platforms, it has become much easier to fabricate such disturbances. Let's take
a look at instrument landing system in detail. Final approach or landing phase is one of
the most critical phases. According to a Boeing report, about 59% of all fatal accidents
have occurred during the final approach phase. ILS is a de facto landing system used all
over the world. It provides precise guidance even in extreme weather conditions. It has
three subsystems. First is a localizer. It's a component which provides lateral guidance.
Glide slope provides vertical guidance. And marker beacons act as checkpoints during the
approach. Let's look at the localizer in detail. Localizer enables the receiver to
calculate its location with respect to the runway centerline. The instrument guides the
pilot to properly align itself. Antenna array installed at the end of the runway transmits
a 25-watt signal. Transmission pattern creates a lobe on each side of the runway. 90-hertz
tone dominates the region on the left side of the runway, and 150-hertz tone dominates
the region on the right side of the runway. The receiver is configured to interpret the
power levels of the tones and guide the pilot. For example, if the aircraft is on the left
side of the runway, the needle will point right, indicating that the pilot has to fly
right to intercept the centerline. The glide slope helps the pilot to align the aircraft
with the prescribed glide path. Usually, it is a 3-degree path, but it depends on the
environment. An antenna array located near the touchdown zone transmits an 8-watt signal.
The transmitter is similar to that of the localizer. However, it results in a slightly
different pattern. 90-hertz tone dominates the region above the glide path angle, and
150-hertz tone dominates the region below the glide path. The receiver is configured
to interpret the power levels of the tones and guide the pilot. For example, if the aircraft
is above the glide path, the needle will point down, indicating that the pilot has to fly
down to intercept the glide path angle. In ILS, the localizer uses a VHF carrier, and
the glide slope uses a UHF carrier. There are two main components of the ILS signal,
a 90-hertz tone and a 150-hertz tone. The unique transmission pattern is a result of
elegant analog radio engineering. This unique pattern results in two zones on either side
of the runway. This is achieved by implementing space modulation technique. In this technique,
the characteristics of a received signal are determined by how two signals add up in space.
Thus, they change with respect to the receiver's position. As a direct result, 90-hertz tone
dominates the region on the left, and 150-hertz tone dominates the region on the right. Amplitude
of these tones is equal on the runway centerline. The signal modulator uses two distinct signals
called carrier sideband signal, CSB, and sideband only signal, SBO. For generating the CSB signal,
90-hertz tone and 150-hertz tones are added. And for generating the SBO tones, these are
added in a slightly different way. Here, 150-hertz tone is inverted, that is, it undergoes a 180-degree
phase shift. These waveforms are passed on to a modulator, which generates the final CSB and SBO
waveforms. This is the design of the signal modulator, which is responsible for ILS's unique
transmission pattern. A CSB modulating tone is modulated with a VHF carrier. To get the desired
amplitude modulation form, the carrier is added back to the modulated signal. This results in a
conventional amplitude modulated signal with a full carrier and sidebands. Similarly, SBO
modulating tone is modulated. Note that the carrier is not added back to the modulated signal. This
results in a double sideband suppressed carrier signal. Before feeding these signals to the antenna
elements, the SBO signal undergoes specific phase shifts. This is done in order to achieve the
desired space modulation. Alternatively, there is a provision of adding Morse code or voice to
the CSB signal. It contains a four character run identifier, which can be used by the pilots to
identify and verify the runway. As compared to the transmitter, the receiver has a rather simple
design. At the receiver, the signal undergoes amplification before it is demodulated. The
demodulated signal is passed to a 90 Hertz filter and a 150 Hertz filter. The difference in DC
voltage of 90 Hertz and 150 Hertz tone is the difference in depth of modulation. This GDM value
is used to calculate the deflection of the instrument's needle. Radio engineering involved
in the pure analog instrument landing system is quite remarkable. However, simplistic nature of
the system also makes it very vulnerable to attacks. Before software-defined radios came
into picture, executing these attacks was extremely difficult, not to mention expensive.
Thus, only state actors had the means to carry out such an attack. However, nowadays, even you
and I can execute such attacks and can potentially cause quite some damage to the cheap pocket-sized
radios. A deeper analysis of the receiver design reveals that the needle deflection is solely based
on the power levels of the received tones. In the past, there have been instances of ILS showing
weird deflections as a result of an aircraft taxiing near the localizer antenna. Thus,
an attacker simply has to transmit a signal which is similar to the real signal. That is,
the attacker need not implement complex phase shifts. This is very similar to a not-so-widely
used landing system called TLS, or transponder landing system, where the landing system relies
on modest transmissions to find the aircraft's position and transmits an ILS-like signal
specifically crafted for that aircraft at that particular location. In these attacks,
attackers' goal is to force the aircraft to overshoot the runway or completely miss the
approach. Given the simplistic nature of the systems, the attacker can manipulate DDM calculations
by simply altering the power levels of the received signals. In our work last year, we
discussed two attacks. First is the overshot attack, which involves signals with fabricated
power levels, and singleton attack, which involves low-power signals to achieve third
objectives. With minor changes, the attacks work for the localizer as well as the glide slope.
ILS implements basic principles of space modulation, that is, how do signals add up in
space. Being a simplex broadcast system, it poses us a fundamental challenge to implement any type
of security mechanism, thus making attacks on these systems quite trivial. With overshadow
attack, the attacker transmits a high-power pre-crafted ILS signal equivalent to what will
be received at a specific location. One important aspect characteristic of a typical wireless
receiver is that it will always lock on to the stronger signal. This property is exploited in
this attack. Since the receiver has a very simple design, the attacker has to transmit a signal
similar to the received signal, even though the legitimate transmitter has quite a complex design.
Hence, the attacker needs to only craft the signals with a specific amplitude.
For example, in this case, this signal represents the signal that will be received at the
runway centerline. Hence, if the attacker wants to cause a deflection, the attacker simply transmits
a signal with altered power levels of 90 Hz and 150 Hz. In this case, 90 Hz is dominant,
thus the needle will give a fly-right indication. The advantage of this attack
is that the attacker has granular control over needle deflections.
Even though the overshadow attack requires just a few watts of transmission power,
we wanted to find if the attack can be made more efficient and stealthy by reducing the
energy footprint. For this, we came up with a single-tone attack. Since the needle deflections
depend directly on power levels of the tones, it is enough to transmit just one of the two
tones that make up the ILS signal. In this way, the attacker can manipulate the power levels
without having to transmit the entire ILS signal. The attacker's signal is similar to a double
sideband suppressed scatter signal, which is very well known to be spectrally efficient.
In this case, the attacker just transmits the 150 Hz tone. As a result, the amplitude of 150 Hz
is greater than that of 90 Hz tone. Thus, the instrument shows a fly-left indication.
This attack, as compared to an overshadow attack, has low power requirements. However,
this attack is sensitive to phase difference between attacker tone and legitimate tone,
which makes it quite complicated. The two attacks may seem quite simple and straightforward.
However, there are certain challenges associated with executing these attacks.
First is that the aircraft can intercept the localizer from multiple directions.
If the attacker is not careful while starting the spoofer, it may result in sudden needle jumps.
This results in detection.
The second challenge is with a naive overshadow attack. If the attacker simply starts transmitting
a pre-crafted signal, it results in a fixed, unreactive offset. This will make it super easy
for the pilot to notice something is off and will totally forego ILS or may use some other system to
land. To overcome these challenges, we developed two mechanisms, offset correction algorithm and
spoofing zone detector. Let's look at them one by one. The offset correction algorithm provides
signal corrections in real time. The attacker's signal is adjusted as a function of aircraft's
current GPS location. This provides seamless takeover of the on-board instrument. The
algorithm calculates the difference between the angle with the legitimate path and the spoof path.
This offset is then used to calculate the required amplitude levels of the tones.
The spoofing zone detector is responsible for timely and automated triggering of the attack.
The aircraft can be vectored in on the final approach in multiple ways. Hence, to prevent
any sudden needle jumps, we developed this spoofing zone detector which uses EVANOT algorithm to check
if the target aircraft has entered the spoofing region. The zone covers 17.5 degrees on either
side of the center line and extends 35 kilometers beyond the touchdown zone. The attacker starts
transmitting as soon as the aircraft enters this region. All right, now let's take a look at ADSP.
Automatic Dependent Surveillance Broadcast is a reporting technology where an aircraft repeatedly
transmits position, velocity, and aircraft identification information. These packets can
be received and decoded by MODIS receivers. ADSP is similar to MODIS except it doesn't require
specific interrogation messages. As of January 2020, ADSP transponders are made mandatory for
aircrafts operating under certain conditions in US airspace. ADSP greatly improves safety and
efficiency by providing better situational awareness. It is also spectrally efficient and
costs much less than MODIS setups. Collision avoidance systems like ACAS and TCAS leverage
ADSP packets. These are the signal characteristics. ADSP uses a carrier frequency of 1090 megahertz.
The bandwidth is 50 kilohertz and it uses a simple pulse position modulation technique.
Data rate for ADSP data is one megabits per second and two packets are transmitted for every second.
Polarization of the transmission antenna is vertical and transmission has a transmission power of
about 20 watts. Well, all this is good about ADSP. It improves overall safety by increasing situational
awareness, decreases load on the controllers by automated tracking of aircrafts, overall
decreases operational costs and all. But what about security? Well, nothing. There's absolutely none.
The only thing close to security it has is a checksum. There is no way to know whether a
packet is really from the aircraft that it says it is from. Moreover, everything is in clear text,
which means any person with $30 to spare can effectively set up a so-called air traffic
monitoring center in their homes. This has led to a lot of serious privacy concerns and equal
number of oops moments. For example, when the Air Force One was spotted on one of the flight
tracking websites. But that's not it. The security community has taken one step ahead
and has actually managed to put ghost planes in the sky, which is quite concerning. Think of a
scenario where on a busy day ATC screen is flooded with thousands of aircrafts. What's even more
concerning is the fact that the same insecure system is used in critical avoidance systems.
For example, a demonstration of this was witnessed in the previous talk.
These are some notable prior works which have addressed security and privacy issues associated
with ADS-B. The research community is now actively looking into security and critical
next-generation navigation technologies. OpenStandard Network founded by Stormier et al.
is a crowdsourced network of ADS-B sensors located all over the world. This is a key resource in air
traffic research. Following issues have been identified by the security research community.
ADS-B lacks any kind of authentication. It lacks integrity checks against intentional tampering of
messages. Sure, CRC checks can correct errors, but what if the messages, including the CRC checksums,
are carefully manipulated over the air? It lacks encryption and temporal identities
as it raises a major privacy concern and is a heaven for eavesdroppers. And finally, it lacks
a secure handshake protocol for verification, authentication, and validation of data.
So, with all these issues, what are the threats that the current aviation ecosystem faces?
Well, all these issues give rise to a number of threats, which includes jamming and denial of
service attacks. As discussed earlier, flirting the radar screens with thousands of aircrafts.
Well, intelligence gathering. There have been researches or there have been incidences where
people have inferred or predicted business dealings by simply monitoring flight data,
which was, again, made available through services like Flightradar24 and OpenSkyNetwork.
Well, there is also threat of message injection and manipulation. Disruption of situational
awareness, which is very specific to ACAS and TCAS spoofing. Demonstration of which we saw
in the previous talk. And trust me, you really do not want a pissed-off air traffic controller
when you fly next. Let's look at the ADS-B transmitter. ADS-B transmits position,
velocity, and aircraft identification information. The preamble is used for
synchronizing the receiver and for indicating that an ADS-B packet is arriving. The downlink
format field is an indication of the type of message that is being transmitted. Capability
field defines the subtype of the message being transmitted. Next are 24 bits, which are for
aircraft's IKO address. This is followed by actual ADS-B data, which includes altitude, latitude,
and longitude. At the end, 24 parity bits are transmitted, which helps the receiver to detect
errors. Raw message bits of the prepared frame undergo Manchester encoding. This is a line
encoding scheme, which is very similar to binary phase shift keying. The encoded data is then
modulated using pulse position modulation technique before being transmitted using the
radio frequency front end at 1019 MHz. ADS-B follows a very basic insecure protocol. The
encoding and modulation scheme that is used is easy to implement. Actually, there are
straightforward functions in MATLAB that can perform the encoding and modulation,
thus making it quite trivial to build a transmitter with a couple of hundred dollars
worth of equipment. Even better, there are open source tools out there which can do the heavy
lifting for you. Lack of security measures and simple design makes the system vulnerable to
spoofing attacks. Especially with cheap over-the-shelf equipment like low-cost software-defined
radios, amplifiers, and antennas makes it rather easy to generate and transmit malicious ADS-B
packets. Well, once you have a transmitter design ready and understood, you can simply
code everything and boom, a transmitter is now a fully functional ADS-B spoofer.
This is a small spoofing example. Imagine being a controller and seeing this on your
display. That would really piss you off. Now that we have seen the security issues
associated with ILS and ADS-B, let's go over some potential countermeasures.
Recently, GPS-based landing systems are being introduced. They are not yet cleared for Cat2 and
Cat3. But we all know how vulnerable GPS is. Signal strength monitoring can be implemented
for detecting overshadow attacks. Most of the ILS attacks can be executed from within the
aircraft cabin while it is on the final approach. Hence, detecting transmissions from within the
cabin may prove to be useful in detecting these attacks. Given the simple analog nature of ILS,
it is extremely challenging to develop a feasible countermeasure as it is impossible
to encrypt physical characteristics of a signal. Over the years, various countermeasures have been
proposed for ADS-B. These include cryptographic solutions, which involves message encryption,
message authentication codes, and use of public infrastructure. However, given the widespread
use of ADS-B, it is a logistical nightmare to deploy cryptographic solutions as they require
overhaul of the entire ADS-B ecosystem. Multilateration uses a network of ground
stations which share information. Ghost aircrafts can be easily detected using this technique. ADS-B
data can be combined with primary radar for identifying ghost aircrafts as they won't have
a radar signature. For preventing ACAS and TCAS spoofing, onboard receivers can deploy distance
bounding protocols which can verify the distance between the receiver and the transmitter without
relying on position data received from the ADS-B packets. There is widespread use of machine
learning and AI for anomaly detection and traffic analysis for detecting spoofed ADS-B packets.
Given the simplex broadcast nature or implementation of these systems, it is not
trivial to develop countermeasures which can safeguard against a variety of attacks.
However, finally, the most important countermeasure is effective pilot training.
Pilots should be trained to detect and counter such attacks using instruments at their disposal.
Thank you.