start	end	text
11840	19440	Hello. In the previous talk, we saw a demonstration of ILS spoofing and ADSP-DCAS spoofing. In
19440	25160	this talk, I'll be going over the fundamental principles and security issues of these systems.
25160	30060	The ILS work was done in collaboration with Damian Sherpas and my advisors, Professor
30060	36200	Anjan Ranganathan and Professor Guvara Nobir from Northeastern University. Well, yes, the
36200	40900	ILS part is very similar to what the bad guys did in Die Hard 2. Actually, that was one
40900	46480	of the motivation factors behind this research. Sometimes fiction does turn into reality.
47940	53060	In recent years, the aviation industry has seen a significant rise with approximately
53060	59040	15,000 flights in the sky at any given time. Of course, with the onset of COVID-19, this
59040	64220	has drastically changed, but nevertheless. Atlanta's Hartfield International Airport
64220	69780	is considered to be the busiest airport. It itself caters to over 2,500 takeoffs and landings
69780	76300	every single day. Right from taxing to the runway for takeoff to arriving and taxing
76300	81780	back to destination gate, these flights rely on a plethora of wireless navigation aids.
81780	86380	Pilots continuously interact with APC using RF channels. Controllers use surveillance
86380	92000	radar for aircraft localization. Automatic dependent surveillance broadcast enables aircraft
92000	97840	tracking. Traffic and collision avoidance systems like ACAS and TCAS also relies on
97840	103560	these ADS-B packets. Flights use satellite systems for general point-to-point navigation.
103560	108060	At the end, instrument landing system gets you safely back on ground even in extreme
108060	115460	weather conditions. In recent years, systems like ADS-B and navigation aids like GPS have
115460	120700	been found to be vulnerable by the researchers. It is possible to include ghost aircrafts
120700	125380	by spoofing ADS-B packets. In the previous talk, we witnessed the effects of spoofing
125380	130660	ADS-B packets to disrupt collision avoidance systems. It has been shown multiple times
130660	136920	how GPS is vulnerable to spoofing attacks. With the advent of real inexpensive software-defined
136920	142640	radio platforms, it has become much easier to fabricate such disturbances. Let's take
142760	148480	a look at instrument landing system in detail. Final approach or landing phase is one of
148480	154320	the most critical phases. According to a Boeing report, about 59% of all fatal accidents
154320	159740	have occurred during the final approach phase. ILS is a de facto landing system used all
159740	165500	over the world. It provides precise guidance even in extreme weather conditions. It has
165500	171620	three subsystems. First is a localizer. It's a component which provides lateral guidance.
171620	176620	Glide slope provides vertical guidance. And marker beacons act as checkpoints during the
176620	183380	approach. Let's look at the localizer in detail. Localizer enables the receiver to
183380	188760	calculate its location with respect to the runway centerline. The instrument guides the
188760	194420	pilot to properly align itself. Antenna array installed at the end of the runway transmits
194620	202200	a 25-watt signal. Transmission pattern creates a lobe on each side of the runway. 90-hertz
202200	206840	tone dominates the region on the left side of the runway, and 150-hertz tone dominates
206840	211460	the region on the right side of the runway. The receiver is configured to interpret the
211460	216800	power levels of the tones and guide the pilot. For example, if the aircraft is on the left
216800	221240	side of the runway, the needle will point right, indicating that the pilot has to fly
221240	228800	right to intercept the centerline. The glide slope helps the pilot to align the aircraft
228800	234220	with the prescribed glide path. Usually, it is a 3-degree path, but it depends on the
234220	240280	environment. An antenna array located near the touchdown zone transmits an 8-watt signal.
240520	244760	The transmitter is similar to that of the localizer. However, it results in a slightly
244760	250060	different pattern. 90-hertz tone dominates the region above the glide path angle, and
250060	255000	150-hertz tone dominates the region below the glide path. The receiver is configured
255000	260780	to interpret the power levels of the tones and guide the pilot. For example, if the aircraft
260780	265320	is above the glide path, the needle will point down, indicating that the pilot has to fly
265320	273900	down to intercept the glide path angle. In ILS, the localizer uses a VHF carrier, and
273900	278600	the glide slope uses a UHF carrier. There are two main components of the ILS signal,
278740	283640	a 90-hertz tone and a 150-hertz tone. The unique transmission pattern is a result of
283640	289000	elegant analog radio engineering. This unique pattern results in two zones on either side
289000	294280	of the runway. This is achieved by implementing space modulation technique. In this technique,
294280	299560	the characteristics of a received signal are determined by how two signals add up in space.
299980	306040	Thus, they change with respect to the receiver's position. As a direct result, 90-hertz tone
306040	311780	dominates the region on the left, and 150-hertz tone dominates the region on the right. Amplitude
311780	319200	of these tones is equal on the runway centerline. The signal modulator uses two distinct signals
319200	326820	called carrier sideband signal, CSB, and sideband only signal, SBO. For generating the CSB signal,
326820	332760	90-hertz tone and 150-hertz tones are added. And for generating the SBO tones, these are
332760	339880	added in a slightly different way. Here, 150-hertz tone is inverted, that is, it undergoes a 180-degree
339880	346640	phase shift. These waveforms are passed on to a modulator, which generates the final CSB and SBO
346640	354160	waveforms. This is the design of the signal modulator, which is responsible for ILS's unique
354160	360280	transmission pattern. A CSB modulating tone is modulated with a VHF carrier. To get the desired
360280	365980	amplitude modulation form, the carrier is added back to the modulated signal. This results in a
365980	372220	conventional amplitude modulated signal with a full carrier and sidebands. Similarly, SBO
372220	377940	modulating tone is modulated. Note that the carrier is not added back to the modulated signal. This
377940	383100	results in a double sideband suppressed carrier signal. Before feeding these signals to the antenna
383100	388720	elements, the SBO signal undergoes specific phase shifts. This is done in order to achieve the
388720	404560	desired space modulation. Alternatively, there is a provision of adding Morse code or voice to
404560	410340	the CSB signal. It contains a four character run identifier, which can be used by the pilots to
410340	417640	identify and verify the runway. As compared to the transmitter, the receiver has a rather simple
417640	423480	design. At the receiver, the signal undergoes amplification before it is demodulated. The
423480	429480	demodulated signal is passed to a 90 Hertz filter and a 150 Hertz filter. The difference in DC
429480	436800	voltage of 90 Hertz and 150 Hertz tone is the difference in depth of modulation. This GDM value
436800	443960	is used to calculate the deflection of the instrument's needle. Radio engineering involved
443960	449480	in the pure analog instrument landing system is quite remarkable. However, simplistic nature of
449480	454540	the system also makes it very vulnerable to attacks. Before software-defined radios came
454540	460060	into picture, executing these attacks was extremely difficult, not to mention expensive.
460260	465820	Thus, only state actors had the means to carry out such an attack. However, nowadays, even you
465820	470740	and I can execute such attacks and can potentially cause quite some damage to the cheap pocket-sized
470740	478100	radios. A deeper analysis of the receiver design reveals that the needle deflection is solely based
478100	483640	on the power levels of the received tones. In the past, there have been instances of ILS showing
483640	489280	weird deflections as a result of an aircraft taxiing near the localizer antenna. Thus,
489280	494220	an attacker simply has to transmit a signal which is similar to the real signal. That is,
494220	499180	the attacker need not implement complex phase shifts. This is very similar to a not-so-widely
499180	504300	used landing system called TLS, or transponder landing system, where the landing system relies
504300	509220	on modest transmissions to find the aircraft's position and transmits an ILS-like signal
509220	515340	specifically crafted for that aircraft at that particular location. In these attacks,
515340	519660	attackers' goal is to force the aircraft to overshoot the runway or completely miss the
519660	525040	approach. Given the simplistic nature of the systems, the attacker can manipulate DDM calculations
525040	530360	by simply altering the power levels of the received signals. In our work last year, we
530360	535340	discussed two attacks. First is the overshot attack, which involves signals with fabricated
535340	539660	power levels, and singleton attack, which involves low-power signals to achieve third
539660	547240	objectives. With minor changes, the attacks work for the localizer as well as the glide slope.
547800	552860	ILS implements basic principles of space modulation, that is, how do signals add up in
552860	558220	space. Being a simplex broadcast system, it poses us a fundamental challenge to implement any type
558220	565040	of security mechanism, thus making attacks on these systems quite trivial. With overshadow
565040	569960	attack, the attacker transmits a high-power pre-crafted ILS signal equivalent to what will
569960	575900	be received at a specific location. One important aspect characteristic of a typical wireless
575900	581160	receiver is that it will always lock on to the stronger signal. This property is exploited in
581160	586800	this attack. Since the receiver has a very simple design, the attacker has to transmit a signal
586800	592100	similar to the received signal, even though the legitimate transmitter has quite a complex design.
592100	596120	Hence, the attacker needs to only craft the signals with a specific amplitude.
596260	601640	For example, in this case, this signal represents the signal that will be received at the
601640	607000	runway centerline. Hence, if the attacker wants to cause a deflection, the attacker simply transmits
607200	614300	a signal with altered power levels of 90 Hz and 150 Hz. In this case, 90 Hz is dominant,
614300	622200	thus the needle will give a fly-right indication. The advantage of this attack
622200	627620	is that the attacker has granular control over needle deflections.
628420	632800	Even though the overshadow attack requires just a few watts of transmission power,
632800	637260	we wanted to find if the attack can be made more efficient and stealthy by reducing the
637260	642060	energy footprint. For this, we came up with a single-tone attack. Since the needle deflections
642060	646660	depend directly on power levels of the tones, it is enough to transmit just one of the two
646660	651460	tones that make up the ILS signal. In this way, the attacker can manipulate the power levels
651460	656600	without having to transmit the entire ILS signal. The attacker's signal is similar to a double
656600	661480	sideband suppressed scatter signal, which is very well known to be spectrally efficient.
661720	667920	In this case, the attacker just transmits the 150 Hz tone. As a result, the amplitude of 150 Hz
667920	674200	is greater than that of 90 Hz tone. Thus, the instrument shows a fly-left indication.
675160	679800	This attack, as compared to an overshadow attack, has low power requirements. However,
679800	683880	this attack is sensitive to phase difference between attacker tone and legitimate tone,
683880	690060	which makes it quite complicated. The two attacks may seem quite simple and straightforward.
690060	694360	However, there are certain challenges associated with executing these attacks.
694360	699100	First is that the aircraft can intercept the localizer from multiple directions.
699100	704280	If the attacker is not careful while starting the spoofer, it may result in sudden needle jumps.
704680	708680	This results in detection.
710700	716340	The second challenge is with a naive overshadow attack. If the attacker simply starts transmitting
716680	722940	a pre-crafted signal, it results in a fixed, unreactive offset. This will make it super easy
722940	728620	for the pilot to notice something is off and will totally forego ILS or may use some other system to
728620	734140	land. To overcome these challenges, we developed two mechanisms, offset correction algorithm and
734140	739980	spoofing zone detector. Let's look at them one by one. The offset correction algorithm provides
739980	745300	signal corrections in real time. The attacker's signal is adjusted as a function of aircraft's
745300	751060	current GPS location. This provides seamless takeover of the on-board instrument. The
751060	757520	algorithm calculates the difference between the angle with the legitimate path and the spoof path.
757520	761760	This offset is then used to calculate the required amplitude levels of the tones.
762760	767800	The spoofing zone detector is responsible for timely and automated triggering of the attack.
767800	772840	The aircraft can be vectored in on the final approach in multiple ways. Hence, to prevent
772840	778280	any sudden needle jumps, we developed this spoofing zone detector which uses EVANOT algorithm to check
778280	784540	if the target aircraft has entered the spoofing region. The zone covers 17.5 degrees on either
784540	790220	side of the center line and extends 35 kilometers beyond the touchdown zone. The attacker starts
790220	800050	transmitting as soon as the aircraft enters this region. All right, now let's take a look at ADSP.
800110	805130	Automatic Dependent Surveillance Broadcast is a reporting technology where an aircraft repeatedly
805130	811290	transmits position, velocity, and aircraft identification information. These packets can
811290	817630	be received and decoded by MODIS receivers. ADSP is similar to MODIS except it doesn't require
817630	824230	specific interrogation messages. As of January 2020, ADSP transponders are made mandatory for
824230	830630	aircrafts operating under certain conditions in US airspace. ADSP greatly improves safety and
830630	835690	efficiency by providing better situational awareness. It is also spectrally efficient and
835690	841610	costs much less than MODIS setups. Collision avoidance systems like ACAS and TCAS leverage
841610	851310	ADSP packets. These are the signal characteristics. ADSP uses a carrier frequency of 1090 megahertz.
851310	856590	The bandwidth is 50 kilohertz and it uses a simple pulse position modulation technique.
856590	865570	Data rate for ADSP data is one megabits per second and two packets are transmitted for every second.
865570	870790	Polarization of the transmission antenna is vertical and transmission has a transmission power of
870790	878390	about 20 watts. Well, all this is good about ADSP. It improves overall safety by increasing situational
878390	883490	awareness, decreases load on the controllers by automated tracking of aircrafts, overall
883490	890270	decreases operational costs and all. But what about security? Well, nothing. There's absolutely none.
890330	896950	The only thing close to security it has is a checksum. There is no way to know whether a
896950	903090	packet is really from the aircraft that it says it is from. Moreover, everything is in clear text,
903090	908130	which means any person with $30 to spare can effectively set up a so-called air traffic
908130	913350	monitoring center in their homes. This has led to a lot of serious privacy concerns and equal
913350	918370	number of oops moments. For example, when the Air Force One was spotted on one of the flight
918370	923870	tracking websites. But that's not it. The security community has taken one step ahead
923870	929990	and has actually managed to put ghost planes in the sky, which is quite concerning. Think of a
929990	935650	scenario where on a busy day ATC screen is flooded with thousands of aircrafts. What's even more
935650	942230	concerning is the fact that the same insecure system is used in critical avoidance systems.
942230	947750	For example, a demonstration of this was witnessed in the previous talk.
949570	955590	These are some notable prior works which have addressed security and privacy issues associated
955590	961510	with ADS-B. The research community is now actively looking into security and critical
961510	967150	next-generation navigation technologies. OpenStandard Network founded by Stormier et al.
967150	973750	is a crowdsourced network of ADS-B sensors located all over the world. This is a key resource in air
973750	982970	traffic research. Following issues have been identified by the security research community.
982970	988950	ADS-B lacks any kind of authentication. It lacks integrity checks against intentional tampering of
988950	995470	messages. Sure, CRC checks can correct errors, but what if the messages, including the CRC checksums,
995470	1001050	are carefully manipulated over the air? It lacks encryption and temporal identities
1002050	1008910	as it raises a major privacy concern and is a heaven for eavesdroppers. And finally, it lacks
1009090	1014910	a secure handshake protocol for verification, authentication, and validation of data.
1015690	1022210	So, with all these issues, what are the threats that the current aviation ecosystem faces?
1022350	1027210	Well, all these issues give rise to a number of threats, which includes jamming and denial of
1027210	1033570	service attacks. As discussed earlier, flirting the radar screens with thousands of aircrafts.
1033570	1039390	Well, intelligence gathering. There have been researches or there have been incidences where
1039390	1046350	people have inferred or predicted business dealings by simply monitoring flight data,
1046350	1054870	which was, again, made available through services like Flightradar24 and OpenSkyNetwork.
1055150	1060930	Well, there is also threat of message injection and manipulation. Disruption of situational
1060930	1066030	awareness, which is very specific to ACAS and TCAS spoofing. Demonstration of which we saw
1066030	1070970	in the previous talk. And trust me, you really do not want a pissed-off air traffic controller
1070970	1079870	when you fly next. Let's look at the ADS-B transmitter. ADS-B transmits position,
1079870	1085410	velocity, and aircraft identification information. The preamble is used for
1085410	1090830	synchronizing the receiver and for indicating that an ADS-B packet is arriving. The downlink
1090830	1096650	format field is an indication of the type of message that is being transmitted. Capability
1096650	1102250	field defines the subtype of the message being transmitted. Next are 24 bits, which are for
1102250	1108530	aircraft's IKO address. This is followed by actual ADS-B data, which includes altitude, latitude,
1108530	1114190	and longitude. At the end, 24 parity bits are transmitted, which helps the receiver to detect
1114190	1122050	errors. Raw message bits of the prepared frame undergo Manchester encoding. This is a line
1122050	1127810	encoding scheme, which is very similar to binary phase shift keying. The encoded data is then
1127810	1132510	modulated using pulse position modulation technique before being transmitted using the
1132510	1140390	radio frequency front end at 1019 MHz. ADS-B follows a very basic insecure protocol. The
1140390	1146230	encoding and modulation scheme that is used is easy to implement. Actually, there are
1146230	1151330	straightforward functions in MATLAB that can perform the encoding and modulation,
1151330	1155330	thus making it quite trivial to build a transmitter with a couple of hundred dollars
1155330	1161030	worth of equipment. Even better, there are open source tools out there which can do the heavy
1161030	1167110	lifting for you. Lack of security measures and simple design makes the system vulnerable to
1167110	1172290	spoofing attacks. Especially with cheap over-the-shelf equipment like low-cost software-defined
1172290	1178970	radios, amplifiers, and antennas makes it rather easy to generate and transmit malicious ADS-B
1178970	1186330	packets. Well, once you have a transmitter design ready and understood, you can simply
1186330	1191410	code everything and boom, a transmitter is now a fully functional ADS-B spoofer.
1193630	1199290	This is a small spoofing example. Imagine being a controller and seeing this on your
1199290	1205310	display. That would really piss you off. Now that we have seen the security issues
1205310	1210510	associated with ILS and ADS-B, let's go over some potential countermeasures.
1211410	1221230	Recently, GPS-based landing systems are being introduced. They are not yet cleared for Cat2 and
1221230	1227950	Cat3. But we all know how vulnerable GPS is. Signal strength monitoring can be implemented
1227950	1233450	for detecting overshadow attacks. Most of the ILS attacks can be executed from within the
1233450	1238930	aircraft cabin while it is on the final approach. Hence, detecting transmissions from within the
1238930	1245250	cabin may prove to be useful in detecting these attacks. Given the simple analog nature of ILS,
1245250	1250410	it is extremely challenging to develop a feasible countermeasure as it is impossible
1250410	1257290	to encrypt physical characteristics of a signal. Over the years, various countermeasures have been
1257290	1263550	proposed for ADS-B. These include cryptographic solutions, which involves message encryption,
1263550	1268650	message authentication codes, and use of public infrastructure. However, given the widespread
1268650	1277310	use of ADS-B, it is a logistical nightmare to deploy cryptographic solutions as they require
1277310	1284110	overhaul of the entire ADS-B ecosystem. Multilateration uses a network of ground
1284110	1290850	stations which share information. Ghost aircrafts can be easily detected using this technique. ADS-B
1290850	1295830	data can be combined with primary radar for identifying ghost aircrafts as they won't have
1296050	1302350	a radar signature. For preventing ACAS and TCAS spoofing, onboard receivers can deploy distance
1302350	1307710	bounding protocols which can verify the distance between the receiver and the transmitter without
1307710	1313550	relying on position data received from the ADS-B packets. There is widespread use of machine
1313550	1320590	learning and AI for anomaly detection and traffic analysis for detecting spoofed ADS-B packets.
1320710	1326690	Given the simplex broadcast nature or implementation of these systems, it is not
1326690	1332290	trivial to develop countermeasures which can safeguard against a variety of attacks.
1333330	1337770	However, finally, the most important countermeasure is effective pilot training.
1338130	1343230	Pilots should be trained to detect and counter such attacks using instruments at their disposal.
1344550	1345870	Thank you.