1 00:00:06,600 --> 00:00:13,180 Hi everyone and thank you for choosing this talk and watching our presentation. 2 00:00:14,620 --> 00:00:22,160 I hope you are all in good health and the coronavirus pandemic will soon be over. 3 00:00:22,160 --> 00:00:31,860 Also, I want to thank the Aerospace Village team for allowing us to present our research. 4 00:00:32,740 --> 00:00:35,400 My name is Mohammad Reza Zamidi. 5 00:00:35,400 --> 00:00:38,040 I'm a cyber security researcher. 6 00:00:38,040 --> 00:00:45,660 I'm mostly interested in cyber physical systems and industrial control systems. 7 00:00:46,000 --> 00:00:56,940 My other two colleagues are Reza, which is a reverse engineer, and Javad, who is working as a reverse engineer. 8 00:00:56,940 --> 00:01:22,560 So, if you are thinking why we are three persons in a 25-minute talk, and I should say that it was the most time-consuming research we ever had, because we had to make contact with people in the aviation industry. 9 00:01:22,560 --> 00:01:27,020 And it wasn't easy to find them. 10 00:01:27,020 --> 00:01:35,080 And finally, just a flight engineer answered to our questions. 11 00:01:35,080 --> 00:01:43,300 And thanks to him, we have a picture of our work on a real flight management system. 12 00:01:44,720 --> 00:01:51,180 Okay, this talk is divided into six main sections. 13 00:01:51,180 --> 00:01:58,100 First of all, I will talk about our recent cyber attacks against the aviation industry. 14 00:01:58,100 --> 00:02:11,620 Also, some basic stuff about avionics systems, and how these new technologies can turn an airplane into a target for cyber attacks. 15 00:02:11,860 --> 00:02:27,920 Secondly, I will explain what is a flight management system, which is one of the most important avionic devices that could be found in a modern aircraft. 16 00:02:29,120 --> 00:02:40,540 After that, I will discuss some risk scenarios against flight management systems, and how we can see it from an offensive perspective. 17 00:02:40,960 --> 00:02:57,040 Then, I will explain the process of analyzing an FMS data integrity check mechanism, and how we found a weakness that allowed us to bypass it. 18 00:02:57,040 --> 00:03:02,520 And finally, we have a demo, which is 19 00:03:05,560 --> 00:03:12,500 about bypassing the CRC algorithm and also the malware. 20 00:03:14,800 --> 00:03:21,840 Okay, here are some examples of our recent cyber attacks against the aviation industry. 21 00:03:21,840 --> 00:03:27,160 The first one was a ransomware attack against New York Airport. 22 00:03:28,040 --> 00:03:36,800 Second, the same kind of attack against Albany Airport one year earlier. 23 00:03:37,460 --> 00:04:00,060 And also in 2019, Robin Air Group declared that it had experienced a malicious cyber attack on the company's IT network the day before, causing it to cancel all its flights. 24 00:04:00,060 --> 00:04:10,500 And in 2018, a ransomware attack turned off the electronic flight information screens at Bristol Airport. 25 00:04:10,840 --> 00:04:26,380 So these are only some examples, and we want to show that instead of common malware attacks, and especially designed malware, which is able to target the avionic systems, will be more challenging. 26 00:04:28,340 --> 00:04:32,220 Okay, what is avionic systems? 27 00:04:32,220 --> 00:04:37,240 A literal blend of the terms aviation and electronics. 28 00:04:37,580 --> 00:04:47,280 Avionics is a category of electronic systems and equipment, especially designed for use in aviation. 29 00:04:47,280 --> 00:05:14,400 The aviation installed in an aircraft or a spacecraft can include engine control, flight control system, navigation, communication, flight recorders, lighting systems, performance monitor, and systems that carry out hundreds of other mission and flight management tasks. 30 00:05:14,400 --> 00:05:31,960 Every modern aircraft, spacecraft, and artificial satellite uses electronic systems of varying types to perform a range of functions pertinent to their purpose and mission. 31 00:05:34,960 --> 00:05:41,060 A flight management system is a fundamental component of a modern airliner avionics. 32 00:05:41,060 --> 00:05:53,120 In many ways, it is like the GPS in your car, with waypoints programmed in between the origin and the destination. 33 00:05:53,960 --> 00:05:57,960 You program in where you are going and off it goes. 34 00:05:57,960 --> 00:06:09,720 A primary function is in flight management of the flight plan, using various sensors to determine the aircraft position. 35 00:06:10,360 --> 00:06:16,440 The FMS can guide the aircraft along with the flight plan. 36 00:06:16,680 --> 00:06:26,660 The FMS will allow the airplane to hook up their autopilot and maintain the heating within a few feet. 37 00:06:34,070 --> 00:06:57,490 Okay, typical flight management systems consist of a flight management computer and console display unit, which enable a display and modification of various parameters, as well as allowing the flight crew to select the various FMS operation modes. 38 00:06:57,490 --> 00:07:06,330 And also, a data loader is one of its important components. 39 00:07:09,580 --> 00:07:21,980 The flight management computer is the heart of a flight management system, providing centralized control for navigation and performance management. 40 00:07:21,980 --> 00:07:34,440 The FMS accepts information from numerous navigation sensors, including VOR, distance measuring equipment, GPS. 41 00:07:34,440 --> 00:07:48,300 Data from each sensor is prioritized based on its known percentage of error and can be blended to provide the most accurate position information. 42 00:07:50,310 --> 00:08:08,510 The flight management computer has a programmable database containing known radio navigation stations, along with their terminal frequencies, airport, seats, and stars, as well as approach data for runways. 43 00:08:08,510 --> 00:08:15,870 Because of frequent changes, the database requires updating every 28 minutes. 44 00:08:15,870 --> 00:08:28,070 This is accomplished by loading electronic media files into some type of data loader, which can vary from a floppy driver or even a compact disk. 45 00:08:28,410 --> 00:08:38,490 In some cases, the data loader can be used to download diagnostics or FOD data to the same type of electronic media. 46 00:08:40,970 --> 00:08:53,050 The flight plan is generally determined on the ground before departure, either by the pilot for a smaller aircraft or a professional dispatcher for an airliner. 47 00:08:53,050 --> 00:09:11,120 It is entered into the FMS either by typing it, selecting it from a saved library or common routes, or via an ACARS data link with the airline dispatch center. 48 00:09:13,680 --> 00:09:25,780 All FMSs contain a navigation database, and the navigation database contains the element from which the flight plan is constructed. 49 00:09:26,100 --> 00:09:32,200 These are defined via the ARINC 424 standard. 50 00:09:32,260 --> 00:09:42,960 The navigation database is normally updated every 28 days to ensure that its contents are current. 51 00:09:42,960 --> 00:09:53,620 Each FMS contains only a subset of the ARINC data relevant to the capabilities of the FMS. 52 00:09:54,580 --> 00:10:09,160 The NDB contains all of the information required for building a flight plan, consisting of waypoints, airways, airports, and runways. 53 00:10:09,160 --> 00:10:30,860 And also, a standard instrument is departure and terminal arrivals, which in summary, we call them CDN stars, that are procedures and checkpoints used to enter and leave the airways, airways system by aircraft operation on the IFR flight plan. 54 00:10:32,120 --> 00:10:40,080 Okay, the airliners, airlines have to download NDB updates from the website of FMS vendors. 55 00:10:40,080 --> 00:10:49,460 Then they will extract this NDB file using their specific software and then we'll copy them into a floppy disk. 56 00:10:49,460 --> 00:10:56,880 After that, the technician will upload NDB files via the data loader to the FMS. 57 00:10:56,880 --> 00:11:09,520 The interesting point for us is that the FMS device has the capability of data integrity check and only accept NDB files which are not manipulated. 58 00:11:09,880 --> 00:11:15,720 Otherwise, the technician will face an error at the time of loading the NDB file. 59 00:11:19,040 --> 00:11:31,480 Okay, so from an offensive standpoint, one of the most likely attack vectors is to manipulate the NDB file which are willing to be loaded on the FMS device. 60 00:11:31,480 --> 00:11:46,140 So the attacker will only need to bypass the data integrity check mechanism and after that, we'll be able to manipulate some information which are critical for flight. 61 00:11:47,080 --> 00:11:54,240 Data integrity refers to the accuracy and consistency of data over its lifecycle. 62 00:11:54,240 --> 00:12:02,360 Maintaining data integrity is a core focus of many enterprise security solutions. 63 00:12:02,360 --> 00:12:06,460 Data integrity can be compromised in several ways. 64 00:12:06,460 --> 00:12:16,200 Each time data is replicated or transferred, it should remain intact and unaltered between updates. 65 00:12:16,580 --> 00:12:32,420 Error checking methods and validation procedures are typically relied on to ensure the integrity of data that is transferred or reproduced without the intention of operation. 66 00:12:34,060 --> 00:12:39,580 CRC or cyclic redundancy check is an error detection code. 67 00:12:39,580 --> 00:12:50,560 It finds change in data as it's traveled from one computer to another by adding a code to the end of the data string. 68 00:12:51,500 --> 00:12:58,000 The sending computer creates the code and the receiving computer checks it. 69 00:12:58,000 --> 00:13:05,660 If the code checks out, the data is accurate and if codes don't check out, the data is corrupt. 70 00:13:06,460 --> 00:13:10,460 Okay, so here is a real world example. 71 00:13:10,580 --> 00:13:14,080 At the left side, you can see the original message 72 00:13:20,740 --> 00:13:27,480 here, which is going to be transmitted. 73 00:13:28,040 --> 00:13:38,700 And at the center, we have generator polynomial or CRC generator, which is four bits. 74 00:13:39,160 --> 00:13:43,000 It's coming from the algorithm. 75 00:13:43,100 --> 00:13:48,960 It can be more bits based on the different CRC algorithms. 76 00:13:48,960 --> 00:14:04,700 So the point here is that we should add one bit less than its actual length at the end of our original message. 77 00:14:04,700 --> 00:14:05,780 Okay, so 78 00:14:09,780 --> 00:14:19,460 we have to... this original message should be divided by our CRC generator. 79 00:14:19,460 --> 00:14:25,620 But the division of polynomials differs from an integer division. 80 00:14:25,820 --> 00:14:36,680 The underlying use of an integer... use of arithmetic for CRC calculation is based on the XOR operation. 81 00:14:36,680 --> 00:14:40,840 But I guess many of you have previous knowledge about it. 82 00:14:40,840 --> 00:15:03,660 It is very simple and the resulting bit... let me... and the resulting bit evaluates to one if only exactly one of the bits is set. 83 00:15:04,480 --> 00:15:11,800 Otherwise, when the numbers are the same, the result will be zero. 84 00:15:11,800 --> 00:15:12,540 Okay, so 85 00:15:15,670 --> 00:15:21,070 we will continue this operation till the end. 86 00:15:21,070 --> 00:15:25,810 And finally, we have here a checksum. 87 00:15:26,130 --> 00:15:28,170 This value is called checksum. 88 00:15:28,170 --> 00:15:36,490 We should add this to the end of the original message, and the data is ready for transfer. 89 00:15:36,650 --> 00:15:44,450 Okay, so at the right side, this is what will happen at the receiver side. 90 00:15:44,450 --> 00:15:52,050 If you look, we started here with some zeros and reached to the checksum. 91 00:15:52,050 --> 00:16:03,750 So here, the receiver will start this checksum at the end of our message, and it must know the CRC generator. 92 00:16:03,750 --> 00:16:17,270 So it is the reverse process of our previous mathematic operation, and it should reach to the zero. 93 00:16:17,270 --> 00:16:22,530 And this way, we can ensure that data is not outweighed. 94 00:16:22,530 --> 00:16:25,950 Okay, so 95 00:16:32,210 --> 00:16:39,150 how we can bypass the CRC check process? 96 00:16:39,150 --> 00:16:49,890 As you saw at the previous slide, the mathematic operation of CRC calculation is not very complicated and is easy to analyze. 97 00:16:50,530 --> 00:16:56,610 After finding the CRC algorithm, we can implement the same thing on our side. 98 00:16:57,530 --> 00:17:12,470 The only step which is challenging is to understand the mathematic operation by reading the assembly code at the time of analyzing the CRC in a computer-based environment. 99 00:17:14,310 --> 00:17:20,490 Okay, after bypassing the data integrity check, it's time to complete the attack vector. 100 00:17:20,530 --> 00:17:34,230 If we ignore the infection process, the attacker only needs to look for a specific NDB file and can manipulate critical data. 101 00:17:34,230 --> 00:17:45,580 In addition to common malware attacks against the aviation industry, a malware that is especially designed to target avionics systems could be very challenging. 102 00:17:46,540 --> 00:17:50,100 Okay, here is the whole kill chain scenario. 103 00:17:50,100 --> 00:17:57,960 We assume that the first step is done via common attack methods like phishing. 104 00:17:58,320 --> 00:18:11,700 In the second step, the malware should be able to fetch the hard drive for the NDB files based on the specific NDB file format or file header. 105 00:18:11,700 --> 00:18:20,520 Then it's time for changing some data on the navigation database and bypass the file integrity check. 106 00:18:20,560 --> 00:18:29,460 At the fourth step, the technician will copy the manipulated NDB file on the floppy disk. 107 00:18:29,460 --> 00:18:36,280 Then he or she will update the FMC device with this NDB file. 108 00:18:36,280 --> 00:18:43,940 Finally, the pilot will start flying with this altered NDB and will face some risk scenarios. 109 00:18:44,620 --> 00:18:47,560 So what are risk scenarios? 110 00:18:47,760 --> 00:18:53,700 Frankly speaking, it is not very clear what will happen. 111 00:18:54,000 --> 00:19:05,840 But we know that the data from FMS will be sent for many other avionics systems, and this could make some mistakes and challenge for flight. 112 00:19:06,660 --> 00:19:22,460 Also, we know that flying with a manipulated FMS is not safe at all, since many real-life incidents originated from FMS data input error. 113 00:19:24,120 --> 00:19:31,980 Okay, let's move on to our research on the data integrity check of Honeywell's flight management system. 114 00:19:31,980 --> 00:19:40,640 Honeywell is the biggest FMS manufacturer, and its products can be found on every modern aircraft. 115 00:19:42,820 --> 00:19:52,860 Okay, the OneNav tool is a desktop application which interprets the binary data format used by Honeywell FMS. 116 00:19:52,860 --> 00:19:58,080 And by using this tool, we can see inside a navigation database. 117 00:19:58,080 --> 00:20:12,680 OneNav has a wide capability to decode various formats of a navigation database that's produced by Honeywell. 118 00:20:12,680 --> 00:20:26,340 Using OneNav, we can perform compare, export, archive, and plot the NavDB contents, and create loadable media for Honeywell FMS. 119 00:20:26,660 --> 00:20:37,540 So after some research, we investigated that Honeywell is using a CRC algorithm for its flight integrity check. 120 00:20:37,840 --> 00:20:45,400 If we consider the OneNav as the sender, the FMC will be the receiver. 121 00:20:45,400 --> 00:20:51,920 It is clear that both the sender and receiver should use the same CRC generator. 122 00:20:51,940 --> 00:21:03,180 By reverse engineering the OneNav software, finally we managed to detect the routine which is responsible for calculating the CRC. 123 00:21:03,180 --> 00:21:10,080 Because of security concerns, I'm not going to explain the details of this step. 124 00:21:10,080 --> 00:21:17,000 Okay, let's see a demo of our work. 125 00:21:18,330 --> 00:21:25,720 This is OneNav and I'm going to use engineering mode of this software. 126 00:21:26,060 --> 00:21:34,820 So here I'm opening a database and you can see the CRC is correct. 127 00:21:35,060 --> 00:21:43,120 Okay, the first report can manipulate its data. 128 00:21:43,120 --> 00:21:46,080 For example, let's look at its... 129 00:21:50,940 --> 00:22:00,360 this data is related to its location and I will just copy it, notepad. 130 00:22:07,180 --> 00:22:16,020 Okay, we can manipulate this NDB file with a text editor. 131 00:22:17,320 --> 00:22:21,520 First, we should search for it. 132 00:22:27,320 --> 00:22:37,900 Okay, so just a little bit change and saving as a new NDB file. 133 00:22:51,600 --> 00:23:06,920 Okay, if we check for CRC, we can see that it's failed because the NDB file is manipulated and this side will not load on FMC device. 134 00:23:07,040 --> 00:23:17,520 Okay, so here is our program which is fixed the CRC check. 135 00:23:38,740 --> 00:24:02,760 Okay, so if we check this new file, we can see that CRC is okay and back to production version and we can check the location of the previous airport. 136 00:24:05,420 --> 00:24:08,840 Let's see what's happening here. 137 00:24:09,340 --> 00:24:19,960 Okay, if you look carefully, you can see that the location is changing. 138 00:24:20,140 --> 00:24:27,360 This is just an example of changing critical data. 139 00:24:28,360 --> 00:24:36,240 An attacker could change many other data, so it was just for showing a demo. 140 00:24:45,230 --> 00:24:55,750 Okay, so as I mentioned before, this is not only a weakness in a computer software. 141 00:24:55,970 --> 00:25:05,730 If we can bypass the CRC algorithm in the OneLab, it must be possible to do it on a real FMC device. 142 00:25:06,770 --> 00:25:16,390 Okay, thanks to our flight engineer friends, we have a picture of loading our NDB file on a real FMC device. 143 00:25:19,040 --> 00:25:28,940 And the final part of this research is the malware which is able to target NDB files and flight management system. 144 00:25:36,350 --> 00:25:43,630 This is the automating of the previous demo, but using a malware. 145 00:25:43,650 --> 00:25:47,330 Okay, you can see the same airport here. 146 00:25:47,330 --> 00:25:49,130 I'm running the malware. 147 00:25:50,290 --> 00:25:51,650 Okay, 148 00:25:56,380 --> 00:26:16,620 so the file has the same name, but I want to keep it in the OneLab, so I'm going to rename it to show you what happened to this file in contrast to this previous one. 149 00:26:20,870 --> 00:26:31,650 Okay, so I'm going to open the same airport, and you can see our malware is working. 150 00:26:38,480 --> 00:26:46,500 Okay, about one year ago, we reported the vulnerability to the Honeywell PSIR15. 151 00:26:48,890 --> 00:26:59,540 And after some months, they told us that they have issued a mitigation and warned their customers. 152 00:27:01,070 --> 00:27:05,170 Okay, thank you guys for watching this presentation. 153 00:27:05,170 --> 00:27:13,190 Till the end, I hope you find it useful, and please let me know if you have any questions or comments. 154 00:27:13,390 --> 00:27:16,150 Thank you again, and have a good time.