start	end	text
6600	13180	Hi everyone and thank you for choosing this talk and watching our presentation.
14620	22160	I hope you are all in good health and the coronavirus pandemic will soon be over.
22160	31860	Also, I want to thank the Aerospace Village team for allowing us to present our research.
32740	38040	My name is Mohammad Reza Zamidi. I'm a cyber security researcher.
38040	45660	I'm mostly interested in cyber physical systems and industrial control systems.
46000	55980	My other two colleagues are Reza, which is a reverse engineer, and Javad, who is working as a
55980	65760	reverse engineer. So, if you are thinking why we are three persons in a 25-minute talk,
67180	74320	and I should say that it was the most time-consuming research we ever had,
74860	82560	because we had to make contact with people in the aviation industry.
82560	91960	And it wasn't easy to find them. And finally, just a flight engineer
93040	101660	answered to our questions. And thanks to him, we have a picture of our work on a real flight
101660	112540	management system. Okay, this talk is divided into six main sections. First of all, I will
112540	120980	talk about our recent cyber attacks against the aviation industry. Also, some basic stuff about
120980	130360	avionics systems, and how these new technologies can turn an airplane into a target for cyber
130360	140160	attacks. Secondly, I will explain what is a flight management system, which is one of the most
140160	150680	important avionic devices that could be found in a modern aircraft. After that, I will discuss
151160	158460	some risk scenarios against flight management systems, and how we can see it from an offensive
159040	169120	perspective. Then, I will explain the process of analyzing an FMS data integrity check mechanism,
169120	182520	and how we found a weakness that allowed us to bypass it. And finally, we have a demo, which is
185560	192500	about bypassing the CRC algorithm and also the malware.
194800	201840	Okay, here are some examples of our recent cyber attacks against the aviation industry.
201840	207160	The first one was a ransomware attack against New York Airport.
208040	216800	Second, the same kind of attack against Albany Airport one year earlier.
217460	230380	And also in 2019, Robin Air Group declared that it had experienced a malicious cyber attack
231440	240060	on the company's IT network the day before, causing it to cancel all its flights.
240060	244880	And in 2018, a ransomware attack turned off the electronic
245800	254460	flight information screens at Bristol Airport. So these are only some examples,
254460	259200	and we want to show that instead of common malware attacks, and especially
259200	266380	designed malware, which is able to target the avionic systems, will be more challenging.
268340	277240	Okay, what is avionic systems? A literal blend of the terms aviation and electronics.
277580	287280	Avionics is a category of electronic systems and equipment, especially designed for use in aviation.
287280	295080	The aviation installed in an aircraft or a spacecraft can include engine control,
296000	305080	flight control system, navigation, communication, flight recorders, lighting systems,
305080	311160	performance monitor, and systems that carry out hundreds of other mission and
312320	318500	flight management tasks. Every modern aircraft, spacecraft, and artificial satellite
319020	325600	uses electronic systems of varying types to perform a range of functions
327820	337460	pertinent to their purpose and mission. A flight management system is a fundamental
337460	346600	component of a modern airliner avionics. In many ways, it is like the GPS in your car,
346600	353120	with waypoints programmed in between the origin and the destination.
353960	361020	You program in where you are going and off it goes. A primary function is in flight management
361020	369720	of the flight plan, using various sensors to determine the aircraft position.
370360	379000	The FMS can guide the aircraft along with the flight plan. The FMS will allow the
379000	386660	airplane to hook up their autopilot and maintain the heating within a few feet.
394070	400830	Okay, typical flight management systems consist of a flight management computer
401410	410530	and console display unit, which enable a display and modification of various parameters,
410530	418770	as well as allowing the flight crew to select the various FMS operation modes. And also,
420770	426330	a data loader is one of its important components.
429580	435960	The flight management computer is the heart of a flight management system,
435960	442780	providing centralized control for navigation and performance management. The FMS accepts
443660	453060	information from numerous navigation sensors, including VOR, distance measuring equipment,
453060	461560	GPS. Data from each sensor is prioritized based on its known percentage of error and
461560	468300	can be blended to provide the most accurate position information.
470310	476870	The flight management computer has a programmable database containing known radio navigation
477430	486150	stations, along with their terminal frequencies, airport, seats, and stars, as well as approach
486150	494170	data for runways. Because of frequent changes, the database requires updating every 28
494910	502990	minutes. This is accomplished by loading electronic media files into some type of data loader,
502990	509630	which can vary from a floppy driver or even a compact disk. In some cases,
509630	518490	the data loader can be used to download diagnostics or FOD data to the same type of electronic media.
520970	528230	The flight plan is generally determined on the ground before departure, either by the
528230	534510	pilot for a smaller aircraft or a professional dispatcher for an airliner. It is entered into
534510	543910	the FMS either by typing it, selecting it from a saved library or common routes,
543910	551120	or via an ACARS data link with the airline dispatch center.
553680	562880	All FMSs contain a navigation database, and the navigation database contains the element from
562880	572860	which the flight plan is constructed. These are defined via the ARINC 424 standard. The navigation
572860	583580	database is normally updated every 28 days to ensure that its contents are current. Each FMS
583580	593620	contains only a subset of the ARINC data relevant to the capabilities of the FMS.
594580	601760	The NDB contains all of the information required for building a flight plan,
601760	611700	consisting of waypoints, airways, airports, and runways. And also, a standard instrument is
611700	618000	departure and terminal arrivals, which in summary, we call them CDN stars, that are
618000	625780	procedures and checkpoints used to enter and leave the airways, airways system by aircraft
625780	636780	operation on the IFR flight plan. Okay, the airliners, airlines have to download NDB updates
636780	645740	from the website of FMS vendors. Then they will extract this NDB file using their specific software
645740	653660	and then we'll copy them into a floppy disk. After that, the technician will upload NDB files
653660	661680	via the data loader to the FMS. The interesting point for us is that the FMS device has the
661680	669520	capability of data integrity check and only accept NDB files which are not manipulated.
669880	675720	Otherwise, the technician will face an error at the time of loading the NDB file.
679040	686240	Okay, so from an offensive standpoint, one of the most likely attack vectors is to manipulate
686240	693240	the NDB file which are willing to be loaded on the FMS device. So the attacker will only need
693240	700480	to bypass the data integrity check mechanism and after that, we'll be able to manipulate some
700480	711220	information which are critical for flight. Data integrity refers to the accuracy and consistency
711220	720740	of data over its lifecycle. Maintaining data integrity is a core focus of many enterprise
720740	727360	security solutions. Data integrity can be compromised in several ways. Each time data
727360	736200	is replicated or transferred, it should remain intact and unaltered between updates.
736580	743460	Error checking methods and validation procedures are typically relied on to ensure the integrity
743460	752420	of data that is transferred or reproduced without the intention of operation.
754060	761900	CRC or cyclic redundancy check is an error detection code. It finds change in data as
761900	770560	it's traveled from one computer to another by adding a code to the end of the data string.
771500	778880	The sending computer creates the code and the receiving computer checks it. If the code checks
778880	785660	out, the data is accurate and if codes don't check out, the data is corrupt.
786460	794080	Okay, so here is a real world example. At the left side, you can see the original message
800740	810220	here, which is going to be transmitted. And at the center, we have
811480	823000	generator polynomial or CRC generator, which is four bits. It's coming from the algorithm.
823100	832560	It can be more bits based on the different CRC algorithms. So the point here is that we should
832560	845780	add one bit less than its actual length at the end of our original message. Okay, so
849780	859460	we have to... this original message should be divided by our CRC generator.
859460	866680	But the division of polynomials differs from an integer division. The underlying
868300	876680	use of an integer... use of arithmetic for CRC calculation is based on the XOR operation.
876680	884120	But I guess many of you have previous knowledge about it. It is very simple and the resulting
884120	903660	bit... let me... and the resulting bit evaluates to one if only exactly one of the bits is set.
904480	912540	Otherwise, when the numbers are the same, the result will be zero. Okay, so
915670	925810	we will continue this operation till the end. And finally, we have here a checksum.
926130	932050	This value is called checksum. We should add this to the end of the original message,
932050	938850	and the data is ready for transfer. Okay, so at the right side,
939630	949690	this is what will happen at the receiver side. If you look, we started here with some zeros and
949690	958470	reached to the checksum. So here, the receiver will start this checksum at the end of our message,
958470	968950	and it must know the CRC generator. So it is the reverse process of our previous
970990	980370	mathematic operation, and it should reach to the zero. And this way, we can ensure that data is
980370	1002690	not outweighed. Okay, so how we can bypass the CRC check process? As you saw at the previous slide,
1002690	1009890	the mathematic operation of CRC calculation is not very complicated and is easy to analyze.
1010530	1016610	After finding the CRC algorithm, we can implement the same thing on our side.
1017530	1025030	The only step which is challenging is to understand the mathematic operation by
1025030	1032470	reading the assembly code at the time of analyzing the CRC in a computer-based environment.
1034310	1041170	Okay, after bypassing the data integrity check, it's time to complete the attack vector. If we
1041170	1051390	ignore the infection process, the attacker only needs to look for a specific NDB file
1051390	1057670	and can manipulate critical data. In addition to common malware attacks against the aviation
1057670	1065580	industry, a malware that is especially designed to target avionics systems could be very challenging.
1066540	1073340	Okay, here is the whole kill chain scenario. We assume that the first step is done via
1073900	1083520	common attack methods like phishing. In the second step, the malware should be able to
1083520	1091700	fetch the hard drive for the NDB files based on the specific NDB file format or file header.
1091700	1098820	Then it's time for changing some data on the navigation database and bypass the file
1098820	1107340	integrity check. At the fourth step, the technician will copy the manipulated NDB file
1107340	1116280	on the floppy disk. Then he or she will update the FMC device with this NDB file.
1116280	1123940	Finally, the pilot will start flying with this altered NDB and will face some risk scenarios.
1124620	1133700	So what are risk scenarios? Frankly speaking, it is not very clear what will happen.
1134000	1141560	But we know that the data from FMS will be sent for many other avionics systems,
1141560	1145840	and this could make some mistakes and challenge for flight.
1146660	1155120	Also, we know that flying with a manipulated FMS is not safe at all,
1155720	1162460	since many real-life incidents originated from FMS data input error.
1164120	1170160	Okay, let's move on to our research on the data integrity check of Honeywell's flight
1170160	1178380	management system. Honeywell is the biggest FMS manufacturer, and its products can be found on
1178380	1186420	every modern aircraft. Okay, the OneNav tool is a desktop application
1186990	1194860	which interprets the binary data format used by Honeywell FMS. And by using this tool,
1194860	1202240	we can see inside a navigation database. OneNav has a wide capability to decode
1203100	1212680	various formats of a navigation database that's produced by Honeywell.
1212680	1222480	Using OneNav, we can perform compare, export, archive, and plot the NavDB contents,
1222480	1230960	and create loadable media for Honeywell FMS. So after some research, we investigated
1231750	1239000	that Honeywell is using a CRC algorithm for its flight integrity check. If we consider
1239630	1248220	the OneNav as the sender, the FMC will be the receiver. It is clear that both the sender and
1248220	1255220	receiver should use the same CRC generator. By reverse engineering the OneNav software,
1255220	1263180	finally we managed to detect the routine which is responsible for calculating the CRC.
1263180	1270080	Because of security concerns, I'm not going to explain the details of this step.
1270080	1277000	Okay, let's see a demo of our work.
1278330	1286780	This is OneNav and I'm going to use engineering mode of this software. So here
1289410	1297480	I'm opening a database and you can see the CRC is correct. Okay, the first report
1300080	1306080	can manipulate its data. For example, let's look at its...
1310940	1320360	this data is related to its location and I will just copy it, notepad.
1327180	1336020	Okay, we can manipulate this NDB file with a text editor.
1337320	1350660	First, we should search for it. Okay, so just a little bit change
1352120	1376600	and saving as a new NDB file. Okay, if we check for CRC, we can see that it's failed
1376600	1386920	because the NDB file is manipulated and this side will not load on FMC device.
1387040	1397520	Okay, so here is our program which is fixed the CRC check.
1418740	1425180	Okay, so if we check this new file, we can see that CRC is okay
1425180	1442760	and back to production version and we can check the location of the previous airport.
1445420	1454600	Let's see what's happening here. Okay, if you look carefully,
1456740	1467360	you can see that the location is changing. This is just an example of changing critical data.
1468360	1476240	An attacker could change many other data, so it was just for showing a demo.
1485230	1495750	Okay, so as I mentioned before, this is not only a weakness in a computer software.
1495970	1505730	If we can bypass the CRC algorithm in the OneLab, it must be possible to do it on a real FMC device.
1506770	1516390	Okay, thanks to our flight engineer friends, we have a picture of loading our NDB file on a real FMC device.
1519040	1528940	And the final part of this research is the malware which is able to target NDB files and flight management system.
1536350	1543630	This is the automating of the previous demo, but using a malware.
1543650	1558720	Okay, you can see the same airport here. I'm running the malware. Okay, so the file has
1559260	1566400	the same name, but I want to keep it in the OneLab, so I'm going to rename it
1567260	1576620	to show you what happened to this file in contrast to this previous one.
1580870	1591650	Okay, so I'm going to open the same airport, and you can see our malware is working.
1598480	1606500	Okay, about one year ago, we reported the vulnerability to the Honeywell PSIR15.
1608890	1619540	And after some months, they told us that they have issued a mitigation and warned their customers.
1621070	1627120	Okay, thank you guys for watching this presentation. Till the end, I hope you
1627530	1633190	find it useful, and please let me know if you have any questions or comments.
1633390	1636150	Thank you again, and have a good time.