WEBVTT 00:11.840 --> 00:13.060 Hello. 00:13.060 --> 00:19.140 In the previous talk, we saw a demonstration of ILS spoofing and ADSP-DCAS spoofing. 00:19.140 --> 00:25.160 In this talk, I'll be going over the fundamental principles and security issues of these systems. 00:25.160 --> 00:34.720 The ILS work was done in collaboration with Damian Sherpas and my advisors, Professor Anjan Ranganathan and Professor Guvara Nobir from Northeastern University. 00:34.820 --> 00:39.980 Well, yes, the ILS part is very similar to what the bad guys did in Die Hard 2. 00:39.980 --> 00:43.920 Actually, that was one of the motivation factors behind this research. 00:43.920 --> 00:46.480 Sometimes fiction does turn into reality. 00:47.940 --> 00:56.520 In recent years, the aviation industry has seen a significant rise with approximately 15,000 flights in the sky at any given time. 00:56.520 --> 01:01.880 Of course, with the onset of COVID-19, this has drastically changed, but nevertheless. 01:02.140 --> 01:06.580 Atlanta's Hartfield International Airport is considered to be the busiest airport. 01:06.580 --> 01:11.480 It itself caters to over 2,500 takeoffs and landings every single day. 01:12.300 --> 01:21.780 Right from taxing to the runway for takeoff to arriving and taxing back to destination gate, these flights rely on a plethora of wireless navigation aids. 01:21.780 --> 01:25.300 Pilots continuously interact with APC using RF channels. 01:25.300 --> 01:28.780 Controllers use surveillance radar for aircraft localization. 01:28.780 --> 01:32.920 Automatic dependent surveillance broadcast enables aircraft tracking. 01:32.920 --> 01:39.660 Traffic and collision avoidance systems like ACAS and TCAS also relies on these ADS-B packets. 01:39.700 --> 01:43.560 Flights use satellite systems for general point-to-point navigation. 01:43.560 --> 01:49.600 At the end, instrument landing system gets you safely back on ground even in extreme weather conditions. 01:50.180 --> 01:58.280 In recent years, systems like ADS-B and navigation aids like GPS have been found to be vulnerable by the researchers. 01:58.280 --> 02:02.700 It is possible to include ghost aircrafts by spoofing ADS-B packets. 02:02.700 --> 02:09.000 In the previous talk, we witnessed the effects of spoofing ADS-B packets to disrupt collision avoidance systems. 02:09.000 --> 02:13.760 It has been shown multiple times how GPS is vulnerable to spoofing attacks. 02:13.760 --> 02:21.880 With the advent of real inexpensive software-defined radio platforms, it has become much easier to fabricate such disturbances. 02:21.880 --> 02:25.180 Let's take a look at instrument landing system in detail. 02:25.980 --> 02:29.960 Final approach or landing phase is one of the most critical phases. 02:29.960 --> 02:36.940 According to a Boeing report, about 59% of all fatal accidents have occurred during the final approach phase. 02:37.220 --> 02:40.720 ILS is a de facto landing system used all over the world. 02:40.720 --> 02:44.760 It provides precise guidance even in extreme weather conditions. 02:45.160 --> 02:47.300 It has three subsystems. 02:47.300 --> 02:48.660 First is a localizer. 02:48.660 --> 02:51.620 It's a component which provides lateral guidance. 02:51.620 --> 02:54.020 Glide slope provides vertical guidance. 02:54.020 --> 02:57.600 And marker beacons act as checkpoints during the approach. 02:57.800 --> 03:00.640 Let's look at the localizer in detail. 03:01.160 --> 03:07.480 Localizer enables the receiver to calculate its location with respect to the runway centerline. 03:07.480 --> 03:11.160 The instrument guides the pilot to properly align itself. 03:11.160 --> 03:16.240 Antenna array installed at the end of the runway transmits a 25-watt signal. 03:16.240 --> 03:20.120 Transmission pattern creates a lobe on each side of the runway. 03:21.260 --> 03:28.920 90-hertz tone dominates the region on the left side of the runway, and 150-hertz tone dominates the region on the right side of the runway. 03:29.000 --> 03:34.140 The receiver is configured to interpret the power levels of the tones and guide the pilot. 03:34.200 --> 03:43.580 For example, if the aircraft is on the left side of the runway, the needle will point right, indicating that the pilot has to fly right to intercept the centerline. 03:45.400 --> 03:50.580 The glide slope helps the pilot to align the aircraft with the prescribed glide path. 03:50.580 --> 03:55.180 Usually, it is a 3-degree path, but it depends on the environment. 03:55.480 --> 04:00.280 An antenna array located near the touchdown zone transmits an 8-watt signal. 04:00.520 --> 04:03.340 The transmitter is similar to that of the localizer. 04:03.340 --> 04:06.080 However, it results in a slightly different pattern. 04:06.200 --> 04:13.280 90-hertz tone dominates the region above the glide path angle, and 150-hertz tone dominates the region below the glide path. 04:13.280 --> 04:19.020 The receiver is configured to interpret the power levels of the tones and guide the pilot. 04:19.020 --> 04:28.040 For example, if the aircraft is above the glide path, the needle will point down, indicating that the pilot has to fly down to intercept the glide path angle. 04:30.240 --> 04:36.160 In ILS, the localizer uses a VHF carrier, and the glide slope uses a UHF carrier. 04:36.160 --> 04:41.240 There are two main components of the ILS signal, a 90-hertz tone and a 150-hertz tone. 04:41.240 --> 04:45.920 The unique transmission pattern is a result of elegant analog radio engineering. 04:46.000 --> 04:50.040 This unique pattern results in two zones on either side of the runway. 04:50.040 --> 04:53.320 This is achieved by implementing space modulation technique. 04:53.320 --> 04:59.560 In this technique, the characteristics of a received signal are determined by how two signals add up in space. 04:59.980 --> 05:03.180 Thus, they change with respect to the receiver's position. 05:03.940 --> 05:11.400 As a direct result, 90-hertz tone dominates the region on the left, and 150-hertz tone dominates the region on the right. 05:11.400 --> 05:15.420 Amplitude of these tones is equal on the runway centerline. 05:16.240 --> 05:24.060 The signal modulator uses two distinct signals called carrier sideband signal, CSB, and sideband only signal, SBO. 05:24.600 --> 05:29.960 For generating the CSB signal, 90-hertz tone and 150-hertz tones are added. 05:30.360 --> 05:34.860 And for generating the SBO tones, these are added in a slightly different way. 05:35.100 --> 05:41.040 Here, 150-hertz tone is inverted, that is, it undergoes a 180-degree phase shift. 05:41.040 --> 05:48.040 These waveforms are passed on to a modulator, which generates the final CSB and SBO waveforms. 05:49.040 --> 05:55.500 This is the design of the signal modulator, which is responsible for ILS's unique transmission pattern. 05:55.500 --> 05:59.420 A CSB modulating tone is modulated with a VHF carrier. 05:59.420 --> 06:05.080 To get the desired amplitude modulation form, the carrier is added back to the modulated signal. 06:05.080 --> 06:10.260 This results in a conventional amplitude modulated signal with a full carrier and sidebands. 06:10.980 --> 06:14.400 Similarly, SBO modulating tone is modulated. 06:14.400 --> 06:17.780 Note that the carrier is not added back to the modulated signal. 06:17.780 --> 06:21.260 This results in a double sideband suppressed carrier signal. 06:21.400 --> 06:26.940 Before feeding these signals to the antenna elements, the SBO signal undergoes specific phase shifts. 06:26.940 --> 06:30.340 This is done in order to achieve the desired space modulation. 06:40.220 --> 06:45.820 Alternatively, there is a provision of adding Morse code or voice to the CSB signal. 06:45.820 --> 06:52.700 It contains a four character run identifier, which can be used by the pilots to identify and verify the runway. 06:54.120 --> 06:58.660 As compared to the transmitter, the receiver has a rather simple design. 06:58.680 --> 07:03.200 At the receiver, the signal undergoes amplification before it is demodulated. 07:03.300 --> 07:08.420 The demodulated signal is passed to a 90 Hertz filter and a 150 Hertz filter. 07:08.420 --> 07:15.900 The difference in DC voltage of 90 Hertz and 150 Hertz tone is the difference in depth of modulation. 07:15.940 --> 07:21.560 This GDM value is used to calculate the deflection of the instrument's needle. 07:22.400 --> 07:27.740 Radio engineering involved in the pure analog instrument landing system is quite remarkable. 07:27.740 --> 07:32.920 However, simplistic nature of the system also makes it very vulnerable to attacks. 07:32.920 --> 07:40.060 Before software-defined radios came into picture, executing these attacks was extremely difficult, not to mention expensive. 07:40.260 --> 07:44.100 Thus, only state actors had the means to carry out such an attack. 07:44.100 --> 07:51.760 However, nowadays, even you and I can execute such attacks and can potentially cause quite some damage to the cheap pocket-sized radios. 07:52.920 --> 08:00.400 A deeper analysis of the receiver design reveals that the needle deflection is solely based on the power levels of the received tones. 08:00.400 --> 08:08.360 In the past, there have been instances of ILS showing weird deflections as a result of an aircraft taxiing near the localizer antenna. 08:08.520 --> 08:13.620 Thus, an attacker simply has to transmit a signal which is similar to the real signal. 08:13.620 --> 08:17.120 That is, the attacker need not implement complex phase shifts. 08:17.120 --> 08:33.440 This is very similar to a not-so-widely used landing system called TLS, or transponder landing system, where the landing system relies on modest transmissions to find the aircraft's position and transmits an ILS-like signal specifically crafted for that aircraft at that particular location. 08:33.940 --> 08:40.580 In these attacks, attackers' goal is to force the aircraft to overshoot the runway or completely miss the approach. 08:40.660 --> 08:48.680 Given the simplistic nature of the systems, the attacker can manipulate DDM calculations by simply altering the power levels of the received signals. 08:48.680 --> 08:51.680 In our work last year, we discussed two attacks. 08:51.680 --> 09:00.920 First is the overshot attack, which involves signals with fabricated power levels, and singleton attack, which involves low-power signals to achieve third objectives. 09:01.500 --> 09:07.240 With minor changes, the attacks work for the localizer as well as the glide slope. 09:07.800 --> 09:13.540 ILS implements basic principles of space modulation, that is, how do signals add up in space. 09:13.540 --> 09:22.980 Being a simplex broadcast system, it poses us a fundamental challenge to implement any type of security mechanism, thus making attacks on these systems quite trivial. 09:23.940 --> 09:32.380 With overshadow attack, the attacker transmits a high-power pre-crafted ILS signal equivalent to what will be received at a specific location. 09:32.600 --> 09:39.600 One important aspect characteristic of a typical wireless receiver is that it will always lock on to the stronger signal. 09:39.600 --> 09:42.200 This property is exploited in this attack. 09:42.340 --> 09:52.100 Since the receiver has a very simple design, the attacker has to transmit a signal similar to the received signal, even though the legitimate transmitter has quite a complex design. 09:52.100 --> 09:56.120 Hence, the attacker needs to only craft the signals with a specific amplitude. 09:56.260 --> 10:02.940 For example, in this case, this signal represents the signal that will be received at the runway centerline. 10:02.940 --> 10:11.380 Hence, if the attacker wants to cause a deflection, the attacker simply transmits a signal with altered power levels of 90 Hz and 150 Hz. 10:11.380 --> 10:19.420 In this case, 90 Hz is dominant, thus the needle will give a fly-right indication. 10:20.260 --> 10:27.620 The advantage of this attack is that the attacker has granular control over needle deflections. 10:28.420 --> 10:38.420 Even though the overshadow attack requires just a few watts of transmission power, we wanted to find if the attack can be made more efficient and stealthy by reducing the energy footprint. 10:38.420 --> 10:40.900 For this, we came up with a single-tone attack. 10:40.900 --> 10:48.720 Since the needle deflections depend directly on power levels of the tones, it is enough to transmit just one of the two tones that make up the ILS signal. 10:48.720 --> 10:54.280 In this way, the attacker can manipulate the power levels without having to transmit the entire ILS signal. 10:54.320 --> 11:01.480 The attacker's signal is similar to a double sideband suppressed scatter signal, which is very well known to be spectrally efficient. 11:01.720 --> 11:05.060 In this case, the attacker just transmits the 150 Hz tone. 11:05.060 --> 11:11.500 As a result, the amplitude of 150 Hz is greater than that of 90 Hz tone. 11:11.500 --> 11:14.200 Thus, the instrument shows a fly-left indication. 11:15.160 --> 11:19.160 This attack, as compared to an overshadow attack, has low power requirements. 11:19.160 --> 11:25.760 However, this attack is sensitive to phase difference between attacker tone and legitimate tone, which makes it quite complicated. 11:26.640 --> 11:30.060 The two attacks may seem quite simple and straightforward. 11:30.060 --> 11:34.360 However, there are certain challenges associated with executing these attacks. 11:34.360 --> 11:39.100 First is that the aircraft can intercept the localizer from multiple directions. 11:39.100 --> 11:44.280 If the attacker is not careful while starting the spoofer, it may result in sudden needle jumps. 11:44.680 --> 11:48.680 This results in detection. 11:50.700 --> 11:54.480 The second challenge is with a naive overshadow attack. 11:54.480 --> 12:01.520 If the attacker simply starts transmitting a pre-crafted signal, it results in a fixed, unreactive offset. 12:01.520 --> 12:09.280 This will make it super easy for the pilot to notice something is off and will totally forego ILS or may use some other system to land. 12:09.280 --> 12:15.420 To overcome these challenges, we developed two mechanisms, offset correction algorithm and spoofing zone detector. 12:15.420 --> 12:17.580 Let's look at them one by one. 12:17.720 --> 12:22.040 The offset correction algorithm provides signal corrections in real time. 12:22.040 --> 12:26.880 The attacker's signal is adjusted as a function of aircraft's current GPS location. 12:26.980 --> 12:30.340 This provides seamless takeover of the on-board instrument. 12:30.860 --> 12:37.520 The algorithm calculates the difference between the angle with the legitimate path and the spoof path. 12:37.520 --> 12:41.760 This offset is then used to calculate the required amplitude levels of the tones. 12:42.760 --> 12:47.800 The spoofing zone detector is responsible for timely and automated triggering of the attack. 12:47.800 --> 12:51.780 The aircraft can be vectored in on the final approach in multiple ways. 12:51.960 --> 13:01.820 Hence, to prevent any sudden needle jumps, we developed this spoofing zone detector which uses EVANOT algorithm to check if the target aircraft has entered the spoofing region. 13:01.820 --> 13:09.320 The zone covers 17.5 degrees on either side of the center line and extends 35 kilometers beyond the touchdown zone. 13:09.320 --> 13:13.740 The attacker starts transmitting as soon as the aircraft enters this region. 13:16.190 --> 13:20.050 All right, now let's take a look at ADSP. 13:20.110 --> 13:30.310 Automatic Dependent Surveillance Broadcast is a reporting technology where an aircraft repeatedly transmits position, velocity, and aircraft identification information. 13:30.310 --> 13:34.490 These packets can be received and decoded by MODIS receivers. 13:34.490 --> 13:39.870 ADSP is similar to MODIS except it doesn't require specific interrogation messages. 13:39.870 --> 13:48.330 As of January 2020, ADSP transponders are made mandatory for aircrafts operating under certain conditions in US airspace. 13:48.570 --> 13:53.830 ADSP greatly improves safety and efficiency by providing better situational awareness. 13:53.830 --> 13:58.370 It is also spectrally efficient and costs much less than MODIS setups. 13:58.370 --> 14:03.290 Collision avoidance systems like ACAS and TCAS leverage ADSP packets. 14:04.470 --> 14:07.190 These are the signal characteristics. 14:07.390 --> 14:11.310 ADSP uses a carrier frequency of 1090 megahertz. 14:11.310 --> 14:16.590 The bandwidth is 50 kilohertz and it uses a simple pulse position modulation technique. 14:16.590 --> 14:25.570 Data rate for ADSP data is one megabits per second and two packets are transmitted for every second. 14:25.570 --> 14:32.590 Polarization of the transmission antenna is vertical and transmission has a transmission power of about 20 watts. 14:33.850 --> 14:35.850 Well, all this is good about ADSP. 14:35.850 --> 14:45.490 It improves overall safety by increasing situational awareness, decreases load on the controllers by automated tracking of aircrafts, overall decreases operational costs and all. 14:45.490 --> 14:47.110 But what about security? 14:47.270 --> 14:48.650 Well, nothing. 14:48.650 --> 14:50.270 There's absolutely none. 14:50.330 --> 14:54.530 The only thing close to security it has is a checksum. 14:54.530 --> 15:00.490 There is no way to know whether a packet is really from the aircraft that it says it is from. 15:00.550 --> 15:09.930 Moreover, everything is in clear text, which means any person with $30 to spare can effectively set up a so-called air traffic monitoring center in their homes. 15:09.930 --> 15:15.070 This has led to a lot of serious privacy concerns and equal number of oops moments. 15:15.070 --> 15:19.970 For example, when the Air Force One was spotted on one of the flight tracking websites. 15:19.970 --> 15:21.090 But that's not it. 15:21.090 --> 15:28.970 The security community has taken one step ahead and has actually managed to put ghost planes in the sky, which is quite concerning. 15:28.990 --> 15:34.810 Think of a scenario where on a busy day ATC screen is flooded with thousands of aircrafts. 15:34.810 --> 15:42.230 What's even more concerning is the fact that the same insecure system is used in critical avoidance systems. 15:42.230 --> 15:47.750 For example, a demonstration of this was witnessed in the previous talk. 15:49.570 --> 15:56.950 These are some notable prior works which have addressed security and privacy issues associated with ADS-B. 15:56.950 --> 16:04.010 The research community is now actively looking into security and critical next-generation navigation technologies. 16:04.470 --> 16:07.150 OpenStandard Network founded by Stormier et al. 16:07.150 --> 16:12.050 is a crowdsourced network of ADS-B sensors located all over the world. 16:12.050 --> 16:15.250 This is a key resource in air traffic research. 16:17.990 --> 16:22.970 Following issues have been identified by the security research community. 16:22.970 --> 16:25.710 ADS-B lacks any kind of authentication. 16:25.710 --> 16:29.870 It lacks integrity checks against intentional tampering of messages. 16:29.870 --> 16:38.250 Sure, CRC checks can correct errors, but what if the messages, including the CRC checksums, are carefully manipulated over the air? 16:38.450 --> 16:47.470 It lacks encryption and temporal identities as it raises a major privacy concern and is a heaven for eavesdroppers. 16:47.550 --> 16:54.910 And finally, it lacks a secure handshake protocol for verification, authentication, and validation of data. 16:55.690 --> 17:02.210 So, with all these issues, what are the threats that the current aviation ecosystem faces? 17:02.350 --> 17:08.210 Well, all these issues give rise to a number of threats, which includes jamming and denial of service attacks. 17:08.210 --> 17:13.570 As discussed earlier, flirting the radar screens with thousands of aircrafts. 17:13.570 --> 17:15.270 Well, intelligence gathering. 17:15.330 --> 17:34.870 There have been researches or there have been incidences where people have inferred or predicted business dealings by simply monitoring flight data, which was, again, made available through services like Flightradar24 and OpenSkyNetwork. 17:35.150 --> 17:39.930 Well, there is also threat of message injection and manipulation. 17:39.930 --> 17:44.470 Disruption of situational awareness, which is very specific to ACAS and TCAS spoofing. 17:44.470 --> 17:47.490 Demonstration of which we saw in the previous talk. 17:47.530 --> 17:52.670 And trust me, you really do not want a pissed-off air traffic controller when you fly next. 17:54.730 --> 17:57.590 Let's look at the ADS-B transmitter. 17:58.110 --> 18:02.890 ADS-B transmits position, velocity, and aircraft identification information. 18:03.410 --> 18:10.270 The preamble is used for synchronizing the receiver and for indicating that an ADS-B packet is arriving. 18:10.290 --> 18:15.890 The downlink format field is an indication of the type of message that is being transmitted. 18:16.050 --> 18:20.110 Capability field defines the subtype of the message being transmitted. 18:20.130 --> 18:24.210 Next are 24 bits, which are for aircraft's IKO address. 18:24.210 --> 18:29.790 This is followed by actual ADS-B data, which includes altitude, latitude, and longitude. 18:29.830 --> 18:35.390 At the end, 24 parity bits are transmitted, which helps the receiver to detect errors. 18:36.350 --> 18:41.130 Raw message bits of the prepared frame undergo Manchester encoding. 18:41.130 --> 18:46.170 This is a line encoding scheme, which is very similar to binary phase shift keying. 18:46.290 --> 18:55.970 The encoded data is then modulated using pulse position modulation technique before being transmitted using the radio frequency front end at 1019 MHz. 18:56.390 --> 19:00.130 ADS-B follows a very basic insecure protocol. 19:00.130 --> 19:04.770 The encoding and modulation scheme that is used is easy to implement. 19:05.190 --> 19:16.990 Actually, there are straightforward functions in MATLAB that can perform the encoding and modulation, thus making it quite trivial to build a transmitter with a couple of hundred dollars worth of equipment. 19:17.010 --> 19:22.450 Even better, there are open source tools out there which can do the heavy lifting for you. 19:22.650 --> 19:28.310 Lack of security measures and simple design makes the system vulnerable to spoofing attacks. 19:28.310 --> 19:40.030 Especially with cheap over-the-shelf equipment like low-cost software-defined radios, amplifiers, and antennas makes it rather easy to generate and transmit malicious ADS-B packets. 19:41.570 --> 19:51.410 Well, once you have a transmitter design ready and understood, you can simply code everything and boom, a transmitter is now a fully functional ADS-B spoofer. 19:53.630 --> 19:56.890 This is a small spoofing example. 19:56.890 --> 19:59.910 Imagine being a controller and seeing this on your display. 19:59.910 --> 20:01.950 That would really piss you off. 20:02.950 --> 20:10.510 Now that we have seen the security issues associated with ILS and ADS-B, let's go over some potential countermeasures. 20:11.410 --> 20:14.710 Recently, GPS-based landing systems are being introduced. 20:14.710 --> 20:22.110 They are not yet cleared for Cat2 and Cat3. 20:22.110 --> 20:25.810 But we all know how vulnerable GPS is. 20:25.870 --> 20:30.510 Signal strength monitoring can be implemented for detecting overshadow attacks. 20:30.550 --> 20:36.790 Most of the ILS attacks can be executed from within the aircraft cabin while it is on the final approach. 20:36.790 --> 20:42.430 Hence, detecting transmissions from within the cabin may prove to be useful in detecting these attacks. 20:42.610 --> 20:53.590 Given the simple analog nature of ILS, it is extremely challenging to develop a feasible countermeasure as it is impossible to encrypt physical characteristics of a signal. 20:53.590 --> 20:59.110 Over the years, various countermeasures have been proposed for ADS-B. 20:59.110 --> 21:06.970 These include cryptographic solutions, which involves message encryption, message authentication codes, and use of public infrastructure. 21:07.290 --> 21:21.010 However, given the widespread use of ADS-B, it is a logistical nightmare to deploy cryptographic solutions as they require overhaul of the entire ADS-B ecosystem. 21:21.730 --> 21:26.610 Multilateration uses a network of ground stations which share information. 21:26.610 --> 21:30.450 Ghost aircrafts can be easily detected using this technique. 21:30.450 --> 21:37.490 ADS-B data can be combined with primary radar for identifying ghost aircrafts as they won't have a radar signature. 21:37.690 --> 21:51.730 For preventing ACAS and TCAS spoofing, onboard receivers can deploy distance bounding protocols which can verify the distance between the receiver and the transmitter without relying on position data received from the ADS-B packets. 21:51.730 --> 22:00.590 There is widespread use of machine learning and AI for anomaly detection and traffic analysis for detecting spoofed ADS-B packets. 22:00.710 --> 22:12.290 Given the simplex broadcast nature or implementation of these systems, it is not trivial to develop countermeasures which can safeguard against a variety of attacks. 22:13.330 --> 22:17.770 However, finally, the most important countermeasure is effective pilot training. 22:18.130 --> 22:23.230 Pilots should be trained to detect and counter such attacks using instruments at their disposal. 22:24.550 --> 22:25.870 Thank you.