[00:11.840 --> 00:19.440]  Hello. In the previous talk, we saw a demonstration of ILS spoofing and ADSP-DCAS spoofing. In
[00:19.440 --> 00:25.160]  this talk, I'll be going over the fundamental principles and security issues of these systems.
[00:25.160 --> 00:30.060]  The ILS work was done in collaboration with Damian Sherpas and my advisors, Professor
[00:30.060 --> 00:36.200]  Anjan Ranganathan and Professor Guvara Nobir from Northeastern University. Well, yes, the
[00:36.200 --> 00:40.900]  ILS part is very similar to what the bad guys did in Die Hard 2. Actually, that was one
[00:40.900 --> 00:46.480]  of the motivation factors behind this research. Sometimes fiction does turn into reality.
[00:47.940 --> 00:53.060]  In recent years, the aviation industry has seen a significant rise with approximately
[00:53.060 --> 00:59.040]  15,000 flights in the sky at any given time. Of course, with the onset of COVID-19, this
[00:59.040 --> 01:04.220]  has drastically changed, but nevertheless. Atlanta's Hartfield International Airport
[01:04.220 --> 01:09.780]  is considered to be the busiest airport. It itself caters to over 2,500 takeoffs and landings
[01:09.780 --> 01:16.300]  every single day. Right from taxing to the runway for takeoff to arriving and taxing
[01:16.300 --> 01:21.780]  back to destination gate, these flights rely on a plethora of wireless navigation aids.
[01:21.780 --> 01:26.380]  Pilots continuously interact with APC using RF channels. Controllers use surveillance
[01:26.380 --> 01:32.000]  radar for aircraft localization. Automatic dependent surveillance broadcast enables aircraft
[01:32.000 --> 01:37.840]  tracking. Traffic and collision avoidance systems like ACAS and TCAS also relies on
[01:37.840 --> 01:43.560]  these ADS-B packets. Flights use satellite systems for general point-to-point navigation.
[01:43.560 --> 01:48.060]  At the end, instrument landing system gets you safely back on ground even in extreme
[01:48.060 --> 01:55.460]  weather conditions. In recent years, systems like ADS-B and navigation aids like GPS have
[01:55.460 --> 02:00.700]  been found to be vulnerable by the researchers. It is possible to include ghost aircrafts
[02:00.700 --> 02:05.380]  by spoofing ADS-B packets. In the previous talk, we witnessed the effects of spoofing
[02:05.380 --> 02:10.660]  ADS-B packets to disrupt collision avoidance systems. It has been shown multiple times
[02:10.660 --> 02:16.920]  how GPS is vulnerable to spoofing attacks. With the advent of real inexpensive software-defined
[02:16.920 --> 02:22.640]  radio platforms, it has become much easier to fabricate such disturbances. Let's take
[02:22.760 --> 02:28.480]  a look at instrument landing system in detail. Final approach or landing phase is one of
[02:28.480 --> 02:34.320]  the most critical phases. According to a Boeing report, about 59% of all fatal accidents
[02:34.320 --> 02:39.740]  have occurred during the final approach phase. ILS is a de facto landing system used all
[02:39.740 --> 02:45.500]  over the world. It provides precise guidance even in extreme weather conditions. It has
[02:45.500 --> 02:51.620]  three subsystems. First is a localizer. It's a component which provides lateral guidance.
[02:51.620 --> 02:56.620]  Glide slope provides vertical guidance. And marker beacons act as checkpoints during the
[02:56.620 --> 03:03.380]  approach. Let's look at the localizer in detail. Localizer enables the receiver to
[03:03.380 --> 03:08.760]  calculate its location with respect to the runway centerline. The instrument guides the
[03:08.760 --> 03:14.420]  pilot to properly align itself. Antenna array installed at the end of the runway transmits
[03:14.620 --> 03:22.200]  a 25-watt signal. Transmission pattern creates a lobe on each side of the runway. 90-hertz
[03:22.200 --> 03:26.840]  tone dominates the region on the left side of the runway, and 150-hertz tone dominates
[03:26.840 --> 03:31.460]  the region on the right side of the runway. The receiver is configured to interpret the
[03:31.460 --> 03:36.800]  power levels of the tones and guide the pilot. For example, if the aircraft is on the left
[03:36.800 --> 03:41.240]  side of the runway, the needle will point right, indicating that the pilot has to fly
[03:41.240 --> 03:48.800]  right to intercept the centerline. The glide slope helps the pilot to align the aircraft
[03:48.800 --> 03:54.220]  with the prescribed glide path. Usually, it is a 3-degree path, but it depends on the
[03:54.220 --> 04:00.280]  environment. An antenna array located near the touchdown zone transmits an 8-watt signal.
[04:00.520 --> 04:04.760]  The transmitter is similar to that of the localizer. However, it results in a slightly
[04:04.760 --> 04:10.060]  different pattern. 90-hertz tone dominates the region above the glide path angle, and
[04:10.060 --> 04:15.000]  150-hertz tone dominates the region below the glide path. The receiver is configured
[04:15.000 --> 04:20.780]  to interpret the power levels of the tones and guide the pilot. For example, if the aircraft
[04:20.780 --> 04:25.320]  is above the glide path, the needle will point down, indicating that the pilot has to fly
[04:25.320 --> 04:33.900]  down to intercept the glide path angle. In ILS, the localizer uses a VHF carrier, and
[04:33.900 --> 04:38.600]  the glide slope uses a UHF carrier. There are two main components of the ILS signal,
[04:38.740 --> 04:43.640]  a 90-hertz tone and a 150-hertz tone. The unique transmission pattern is a result of
[04:43.640 --> 04:49.000]  elegant analog radio engineering. This unique pattern results in two zones on either side
[04:49.000 --> 04:54.280]  of the runway. This is achieved by implementing space modulation technique. In this technique,
[04:54.280 --> 04:59.560]  the characteristics of a received signal are determined by how two signals add up in space.
[04:59.980 --> 05:06.040]  Thus, they change with respect to the receiver's position. As a direct result, 90-hertz tone
[05:06.040 --> 05:11.780]  dominates the region on the left, and 150-hertz tone dominates the region on the right. Amplitude
[05:11.780 --> 05:19.200]  of these tones is equal on the runway centerline. The signal modulator uses two distinct signals
[05:19.200 --> 05:26.820]  called carrier sideband signal, CSB, and sideband only signal, SBO. For generating the CSB signal,
[05:26.820 --> 05:32.760]  90-hertz tone and 150-hertz tones are added. And for generating the SBO tones, these are
[05:32.760 --> 05:39.880]  added in a slightly different way. Here, 150-hertz tone is inverted, that is, it undergoes a 180-degree
[05:39.880 --> 05:46.640]  phase shift. These waveforms are passed on to a modulator, which generates the final CSB and SBO
[05:46.640 --> 05:54.160]  waveforms. This is the design of the signal modulator, which is responsible for ILS's unique
[05:54.160 --> 06:00.280]  transmission pattern. A CSB modulating tone is modulated with a VHF carrier. To get the desired
[06:00.280 --> 06:05.980]  amplitude modulation form, the carrier is added back to the modulated signal. This results in a
[06:05.980 --> 06:12.220]  conventional amplitude modulated signal with a full carrier and sidebands. Similarly, SBO
[06:12.220 --> 06:17.940]  modulating tone is modulated. Note that the carrier is not added back to the modulated signal. This
[06:17.940 --> 06:23.100]  results in a double sideband suppressed carrier signal. Before feeding these signals to the antenna
[06:23.100 --> 06:28.720]  elements, the SBO signal undergoes specific phase shifts. This is done in order to achieve the
[06:28.720 --> 06:44.560]  desired space modulation. Alternatively, there is a provision of adding Morse code or voice to
[06:44.560 --> 06:50.340]  the CSB signal. It contains a four character run identifier, which can be used by the pilots to
[06:50.340 --> 06:57.640]  identify and verify the runway. As compared to the transmitter, the receiver has a rather simple
[06:57.640 --> 07:03.480]  design. At the receiver, the signal undergoes amplification before it is demodulated. The
[07:03.480 --> 07:09.480]  demodulated signal is passed to a 90 Hertz filter and a 150 Hertz filter. The difference in DC
[07:09.480 --> 07:16.800]  voltage of 90 Hertz and 150 Hertz tone is the difference in depth of modulation. This GDM value
[07:16.800 --> 07:23.960]  is used to calculate the deflection of the instrument's needle. Radio engineering involved
[07:23.960 --> 07:29.480]  in the pure analog instrument landing system is quite remarkable. However, simplistic nature of
[07:29.480 --> 07:34.540]  the system also makes it very vulnerable to attacks. Before software-defined radios came
[07:34.540 --> 07:40.060]  into picture, executing these attacks was extremely difficult, not to mention expensive.
[07:40.260 --> 07:45.820]  Thus, only state actors had the means to carry out such an attack. However, nowadays, even you
[07:45.820 --> 07:50.740]  and I can execute such attacks and can potentially cause quite some damage to the cheap pocket-sized
[07:50.740 --> 07:58.100]  radios. A deeper analysis of the receiver design reveals that the needle deflection is solely based
[07:58.100 --> 08:03.640]  on the power levels of the received tones. In the past, there have been instances of ILS showing
[08:03.640 --> 08:09.280]  weird deflections as a result of an aircraft taxiing near the localizer antenna. Thus,
[08:09.280 --> 08:14.220]  an attacker simply has to transmit a signal which is similar to the real signal. That is,
[08:14.220 --> 08:19.180]  the attacker need not implement complex phase shifts. This is very similar to a not-so-widely
[08:19.180 --> 08:24.300]  used landing system called TLS, or transponder landing system, where the landing system relies
[08:24.300 --> 08:29.220]  on modest transmissions to find the aircraft's position and transmits an ILS-like signal
[08:29.220 --> 08:35.340]  specifically crafted for that aircraft at that particular location. In these attacks,
[08:35.340 --> 08:39.660]  attackers' goal is to force the aircraft to overshoot the runway or completely miss the
[08:39.660 --> 08:45.040]  approach. Given the simplistic nature of the systems, the attacker can manipulate DDM calculations
[08:45.040 --> 08:50.360]  by simply altering the power levels of the received signals. In our work last year, we
[08:50.360 --> 08:55.340]  discussed two attacks. First is the overshot attack, which involves signals with fabricated
[08:55.340 --> 08:59.660]  power levels, and singleton attack, which involves low-power signals to achieve third
[08:59.660 --> 09:07.240]  objectives. With minor changes, the attacks work for the localizer as well as the glide slope.
[09:07.800 --> 09:12.860]  ILS implements basic principles of space modulation, that is, how do signals add up in
[09:12.860 --> 09:18.220]  space. Being a simplex broadcast system, it poses us a fundamental challenge to implement any type
[09:18.220 --> 09:25.040]  of security mechanism, thus making attacks on these systems quite trivial. With overshadow
[09:25.040 --> 09:29.960]  attack, the attacker transmits a high-power pre-crafted ILS signal equivalent to what will
[09:29.960 --> 09:35.900]  be received at a specific location. One important aspect characteristic of a typical wireless
[09:35.900 --> 09:41.160]  receiver is that it will always lock on to the stronger signal. This property is exploited in
[09:41.160 --> 09:46.800]  this attack. Since the receiver has a very simple design, the attacker has to transmit a signal
[09:46.800 --> 09:52.100]  similar to the received signal, even though the legitimate transmitter has quite a complex design.
[09:52.100 --> 09:56.120]  Hence, the attacker needs to only craft the signals with a specific amplitude.
[09:56.260 --> 10:01.640]  For example, in this case, this signal represents the signal that will be received at the
[10:01.640 --> 10:07.000]  runway centerline. Hence, if the attacker wants to cause a deflection, the attacker simply transmits
[10:07.200 --> 10:14.300]  a signal with altered power levels of 90 Hz and 150 Hz. In this case, 90 Hz is dominant,
[10:14.300 --> 10:22.200]  thus the needle will give a fly-right indication. The advantage of this attack
[10:22.200 --> 10:27.620]  is that the attacker has granular control over needle deflections.
[10:28.420 --> 10:32.800]  Even though the overshadow attack requires just a few watts of transmission power,
[10:32.800 --> 10:37.260]  we wanted to find if the attack can be made more efficient and stealthy by reducing the
[10:37.260 --> 10:42.060]  energy footprint. For this, we came up with a single-tone attack. Since the needle deflections
[10:42.060 --> 10:46.660]  depend directly on power levels of the tones, it is enough to transmit just one of the two
[10:46.660 --> 10:51.460]  tones that make up the ILS signal. In this way, the attacker can manipulate the power levels
[10:51.460 --> 10:56.600]  without having to transmit the entire ILS signal. The attacker's signal is similar to a double
[10:56.600 --> 11:01.480]  sideband suppressed scatter signal, which is very well known to be spectrally efficient.
[11:01.720 --> 11:07.920]  In this case, the attacker just transmits the 150 Hz tone. As a result, the amplitude of 150 Hz
[11:07.920 --> 11:14.200]  is greater than that of 90 Hz tone. Thus, the instrument shows a fly-left indication.
[11:15.160 --> 11:19.800]  This attack, as compared to an overshadow attack, has low power requirements. However,
[11:19.800 --> 11:23.880]  this attack is sensitive to phase difference between attacker tone and legitimate tone,
[11:23.880 --> 11:30.060]  which makes it quite complicated. The two attacks may seem quite simple and straightforward.
[11:30.060 --> 11:34.360]  However, there are certain challenges associated with executing these attacks.
[11:34.360 --> 11:39.100]  First is that the aircraft can intercept the localizer from multiple directions.
[11:39.100 --> 11:44.280]  If the attacker is not careful while starting the spoofer, it may result in sudden needle jumps.
[11:44.680 --> 11:48.680]  This results in detection.
[11:50.700 --> 11:56.340]  The second challenge is with a naive overshadow attack. If the attacker simply starts transmitting
[11:56.680 --> 12:02.940]  a pre-crafted signal, it results in a fixed, unreactive offset. This will make it super easy
[12:02.940 --> 12:08.620]  for the pilot to notice something is off and will totally forego ILS or may use some other system to
[12:08.620 --> 12:14.140]  land. To overcome these challenges, we developed two mechanisms, offset correction algorithm and
[12:14.140 --> 12:19.980]  spoofing zone detector. Let's look at them one by one. The offset correction algorithm provides
[12:19.980 --> 12:25.300]  signal corrections in real time. The attacker's signal is adjusted as a function of aircraft's
[12:25.300 --> 12:31.060]  current GPS location. This provides seamless takeover of the on-board instrument. The
[12:31.060 --> 12:37.520]  algorithm calculates the difference between the angle with the legitimate path and the spoof path.
[12:37.520 --> 12:41.760]  This offset is then used to calculate the required amplitude levels of the tones.
[12:42.760 --> 12:47.800]  The spoofing zone detector is responsible for timely and automated triggering of the attack.
[12:47.800 --> 12:52.840]  The aircraft can be vectored in on the final approach in multiple ways. Hence, to prevent
[12:52.840 --> 12:58.280]  any sudden needle jumps, we developed this spoofing zone detector which uses EVANOT algorithm to check
[12:58.280 --> 13:04.540]  if the target aircraft has entered the spoofing region. The zone covers 17.5 degrees on either
[13:04.540 --> 13:10.220]  side of the center line and extends 35 kilometers beyond the touchdown zone. The attacker starts
[13:10.220 --> 13:20.050]  transmitting as soon as the aircraft enters this region. All right, now let's take a look at ADSP.
[13:20.110 --> 13:25.130]  Automatic Dependent Surveillance Broadcast is a reporting technology where an aircraft repeatedly
[13:25.130 --> 13:31.290]  transmits position, velocity, and aircraft identification information. These packets can
[13:31.290 --> 13:37.630]  be received and decoded by MODIS receivers. ADSP is similar to MODIS except it doesn't require
[13:37.630 --> 13:44.230]  specific interrogation messages. As of January 2020, ADSP transponders are made mandatory for
[13:44.230 --> 13:50.630]  aircrafts operating under certain conditions in US airspace. ADSP greatly improves safety and
[13:50.630 --> 13:55.690]  efficiency by providing better situational awareness. It is also spectrally efficient and
[13:55.690 --> 14:01.610]  costs much less than MODIS setups. Collision avoidance systems like ACAS and TCAS leverage
[14:01.610 --> 14:11.310]  ADSP packets. These are the signal characteristics. ADSP uses a carrier frequency of 1090 megahertz.
[14:11.310 --> 14:16.590]  The bandwidth is 50 kilohertz and it uses a simple pulse position modulation technique.
[14:16.590 --> 14:25.570]  Data rate for ADSP data is one megabits per second and two packets are transmitted for every second.
[14:25.570 --> 14:30.790]  Polarization of the transmission antenna is vertical and transmission has a transmission power of
[14:30.790 --> 14:38.390]  about 20 watts. Well, all this is good about ADSP. It improves overall safety by increasing situational
[14:38.390 --> 14:43.490]  awareness, decreases load on the controllers by automated tracking of aircrafts, overall
[14:43.490 --> 14:50.270]  decreases operational costs and all. But what about security? Well, nothing. There's absolutely none.
[14:50.330 --> 14:56.950]  The only thing close to security it has is a checksum. There is no way to know whether a
[14:56.950 --> 15:03.090]  packet is really from the aircraft that it says it is from. Moreover, everything is in clear text,
[15:03.090 --> 15:08.130]  which means any person with $30 to spare can effectively set up a so-called air traffic
[15:08.130 --> 15:13.350]  monitoring center in their homes. This has led to a lot of serious privacy concerns and equal
[15:13.350 --> 15:18.370]  number of oops moments. For example, when the Air Force One was spotted on one of the flight
[15:18.370 --> 15:23.870]  tracking websites. But that's not it. The security community has taken one step ahead
[15:23.870 --> 15:29.990]  and has actually managed to put ghost planes in the sky, which is quite concerning. Think of a
[15:29.990 --> 15:35.650]  scenario where on a busy day ATC screen is flooded with thousands of aircrafts. What's even more
[15:35.650 --> 15:42.230]  concerning is the fact that the same insecure system is used in critical avoidance systems.
[15:42.230 --> 15:47.750]  For example, a demonstration of this was witnessed in the previous talk.
[15:49.570 --> 15:55.590]  These are some notable prior works which have addressed security and privacy issues associated
[15:55.590 --> 16:01.510]  with ADS-B. The research community is now actively looking into security and critical
[16:01.510 --> 16:07.150]  next-generation navigation technologies. OpenStandard Network founded by Stormier et al.
[16:07.150 --> 16:13.750]  is a crowdsourced network of ADS-B sensors located all over the world. This is a key resource in air
[16:13.750 --> 16:22.970]  traffic research. Following issues have been identified by the security research community.
[16:22.970 --> 16:28.950]  ADS-B lacks any kind of authentication. It lacks integrity checks against intentional tampering of
[16:28.950 --> 16:35.470]  messages. Sure, CRC checks can correct errors, but what if the messages, including the CRC checksums,
[16:35.470 --> 16:41.050]  are carefully manipulated over the air? It lacks encryption and temporal identities
[16:42.050 --> 16:48.910]  as it raises a major privacy concern and is a heaven for eavesdroppers. And finally, it lacks
[16:49.090 --> 16:54.910]  a secure handshake protocol for verification, authentication, and validation of data.
[16:55.690 --> 17:02.210]  So, with all these issues, what are the threats that the current aviation ecosystem faces?
[17:02.350 --> 17:07.210]  Well, all these issues give rise to a number of threats, which includes jamming and denial of
[17:07.210 --> 17:13.570]  service attacks. As discussed earlier, flirting the radar screens with thousands of aircrafts.
[17:13.570 --> 17:19.390]  Well, intelligence gathering. There have been researches or there have been incidences where
[17:19.390 --> 17:26.350]  people have inferred or predicted business dealings by simply monitoring flight data,
[17:26.350 --> 17:34.870]  which was, again, made available through services like Flightradar24 and OpenSkyNetwork.
[17:35.150 --> 17:40.930]  Well, there is also threat of message injection and manipulation. Disruption of situational
[17:40.930 --> 17:46.030]  awareness, which is very specific to ACAS and TCAS spoofing. Demonstration of which we saw
[17:46.030 --> 17:50.970]  in the previous talk. And trust me, you really do not want a pissed-off air traffic controller
[17:50.970 --> 17:59.870]  when you fly next. Let's look at the ADS-B transmitter. ADS-B transmits position,
[17:59.870 --> 18:05.410]  velocity, and aircraft identification information. The preamble is used for
[18:05.410 --> 18:10.830]  synchronizing the receiver and for indicating that an ADS-B packet is arriving. The downlink
[18:10.830 --> 18:16.650]  format field is an indication of the type of message that is being transmitted. Capability
[18:16.650 --> 18:22.250]  field defines the subtype of the message being transmitted. Next are 24 bits, which are for
[18:22.250 --> 18:28.530]  aircraft's IKO address. This is followed by actual ADS-B data, which includes altitude, latitude,
[18:28.530 --> 18:34.190]  and longitude. At the end, 24 parity bits are transmitted, which helps the receiver to detect
[18:34.190 --> 18:42.050]  errors. Raw message bits of the prepared frame undergo Manchester encoding. This is a line
[18:42.050 --> 18:47.810]  encoding scheme, which is very similar to binary phase shift keying. The encoded data is then
[18:47.810 --> 18:52.510]  modulated using pulse position modulation technique before being transmitted using the
[18:52.510 --> 19:00.390]  radio frequency front end at 1019 MHz. ADS-B follows a very basic insecure protocol. The
[19:00.390 --> 19:06.230]  encoding and modulation scheme that is used is easy to implement. Actually, there are
[19:06.230 --> 19:11.330]  straightforward functions in MATLAB that can perform the encoding and modulation,
[19:11.330 --> 19:15.330]  thus making it quite trivial to build a transmitter with a couple of hundred dollars
[19:15.330 --> 19:21.030]  worth of equipment. Even better, there are open source tools out there which can do the heavy
[19:21.030 --> 19:27.110]  lifting for you. Lack of security measures and simple design makes the system vulnerable to
[19:27.110 --> 19:32.290]  spoofing attacks. Especially with cheap over-the-shelf equipment like low-cost software-defined
[19:32.290 --> 19:38.970]  radios, amplifiers, and antennas makes it rather easy to generate and transmit malicious ADS-B
[19:38.970 --> 19:46.330]  packets. Well, once you have a transmitter design ready and understood, you can simply
[19:46.330 --> 19:51.410]  code everything and boom, a transmitter is now a fully functional ADS-B spoofer.
[19:53.630 --> 19:59.290]  This is a small spoofing example. Imagine being a controller and seeing this on your
[19:59.290 --> 20:05.310]  display. That would really piss you off. Now that we have seen the security issues
[20:05.310 --> 20:10.510]  associated with ILS and ADS-B, let's go over some potential countermeasures.
[20:11.410 --> 20:21.230]  Recently, GPS-based landing systems are being introduced. They are not yet cleared for Cat2 and
[20:21.230 --> 20:27.950]  Cat3. But we all know how vulnerable GPS is. Signal strength monitoring can be implemented
[20:27.950 --> 20:33.450]  for detecting overshadow attacks. Most of the ILS attacks can be executed from within the
[20:33.450 --> 20:38.930]  aircraft cabin while it is on the final approach. Hence, detecting transmissions from within the
[20:38.930 --> 20:45.250]  cabin may prove to be useful in detecting these attacks. Given the simple analog nature of ILS,
[20:45.250 --> 20:50.410]  it is extremely challenging to develop a feasible countermeasure as it is impossible
[20:50.410 --> 20:57.290]  to encrypt physical characteristics of a signal. Over the years, various countermeasures have been
[20:57.290 --> 21:03.550]  proposed for ADS-B. These include cryptographic solutions, which involves message encryption,
[21:03.550 --> 21:08.650]  message authentication codes, and use of public infrastructure. However, given the widespread
[21:08.650 --> 21:17.310]  use of ADS-B, it is a logistical nightmare to deploy cryptographic solutions as they require
[21:17.310 --> 21:24.110]  overhaul of the entire ADS-B ecosystem. Multilateration uses a network of ground
[21:24.110 --> 21:30.850]  stations which share information. Ghost aircrafts can be easily detected using this technique. ADS-B
[21:30.850 --> 21:35.830]  data can be combined with primary radar for identifying ghost aircrafts as they won't have
[21:36.050 --> 21:42.350]  a radar signature. For preventing ACAS and TCAS spoofing, onboard receivers can deploy distance
[21:42.350 --> 21:47.710]  bounding protocols which can verify the distance between the receiver and the transmitter without
[21:47.710 --> 21:53.550]  relying on position data received from the ADS-B packets. There is widespread use of machine
[21:53.550 --> 22:00.590]  learning and AI for anomaly detection and traffic analysis for detecting spoofed ADS-B packets.
[22:00.710 --> 22:06.690]  Given the simplex broadcast nature or implementation of these systems, it is not
[22:06.690 --> 22:12.290]  trivial to develop countermeasures which can safeguard against a variety of attacks.
[22:13.330 --> 22:17.770]  However, finally, the most important countermeasure is effective pilot training.
[22:18.130 --> 22:23.230]  Pilots should be trained to detect and counter such attacks using instruments at their disposal.
[22:24.550 --> 22:25.870]  Thank you.