start	end	text
4300	8560	Hi, thanks for coming to my talk. My name is Matt Smith. I'm a postdoc from the
8560	11120	University of Oxford and today I'm going to talk to you about
11120	14720	some research that we did recently where we tried to understand how pilots
14720	18180	might react when faced with realistic attacks on
18180	21860	their systems. So who are we? Well, we're a team of
21860	23520	researchers from the University of Oxford
23520	27320	and ArmaSwiss. ArmaSwiss is the research and development part
27320	31220	of the Swiss Ministry of Defence and we've been involved in security
31220	37040	research now for about eight years, covering topics such as ADS-B and ACARS,
37040	40200	more recently broadening some other areas as well.
40200	43420	We've also been involved in founding OpenSky, which is
43860	46820	a really great project. I really recommend you check it out, especially if
46820	51180	you're involved in aviation. It is a research-focused
51940	56760	ADS-B MODIS collection network, so really would recommend checking that out.
57360	64420	So the past 10 years has really seen a rise in research from
65660	68580	a wide range of groups all around the world, publishing at
68580	73540	top-tier conferences, in much more practical security venues like
73540	78480	Black Hat and DEFCON, master's theses, all sorts of different bits of research.
78660	82820	And often these papers have proposed really interesting attacks
83400	87060	that really, you know, propose something new
87060	93060	and focus on the part between the transmission of the signal and
93060	95500	getting this onto the aircraft. And obviously you can kind of predict
95500	99980	some effects that this might have on how the aircraft is flown,
99980	103920	but it really does raise the question of how well do pilots handle
104600	110200	these kind of attacks. So we think this is a really interesting
110200	114020	question because pilots are often assessed on how they handle faults
114020	117320	and they usually do this in a flight simulator,
117320	120020	and this is a full motion one on the right-hand side here,
120020	123980	and they're sort of a last line of defense against these faults
123980	126740	because they have this really well-defined procedure, it's part of
126740	129760	their training and, you know, some really key part of
129760	134780	their job. And we started to think about how
134780	138800	this fault handling skill might translate to mitigating attacks
139360	143420	and also whether you can use flight simulation to actually understand the
143420	147180	impact of attacks like you can use it to understand the impact of faults.
148300	151680	So something we really want to focus on at this point and just highlight is
151680	155260	the fact that this piece of work is actually interested
155260	159460	in the effects of attacks rather than, say, the technical detail of the attacks
159460	162700	themselves. So as we all know, normally the kind of
162700	166660	chain of signal to action is there's some sort
166660	170020	of legitimate signal from air traffic control or whatever it might be,
170580	174540	gets to the aircraft and presents to the pilots somehow.
174740	179420	The pilots act on that and then there's some sort of behavior
179420	183040	that comes out of it and that's normal. As we know,
183040	186240	many of these aviation communications are unencrypted, so
186880	189940	you know, we have this part that I just talked about where there's been a lot of
189940	193640	research, this creation of signals that are transmitted to the aircraft.
193640	197120	But what we're interested in this piece of work is what happens when those
197120	199840	signals arrive at the aircraft and are presented to the pilots. How do they
199840	203200	perceive them? What do they do with them? Does it affect how the aircraft
203200	210780	is flown? So to do this, we invited 30 tight-rated Airbus A320 pilots to
210780	214840	come and fly in our little simulator that we built in our
214840	220700	building. And within that simulator, we implemented some attacks on collision
220700	224300	avoidance systems, ground proximity warning systems, and landing systems.
224300	228360	And we're only going to cover two of those today just to keep it focused,
228360	232460	but we do have some more info if people are interested in the other one.
232580	239380	We used X-Plane 11, which is a high quality aircraft model, and we had a
239380	243680	single pilot set up. So the experimenter provided some basic flying support in
243680	246500	terms of pushing buttons and enabling modes, but nothing more than that. They
246500	249240	didn't actually contribute to decisions made.
249800	253820	In terms of how we actually carried this out, we had a familiarization flight
253820	257400	first so the pilots could get used to the route and the controls, and then we
257400	263020	had a simulator flight for each of the attacks that implemented the attack.
263120	266880	And after they'd flown it, the pilots debriefed with us to tell us a little
266880	270780	bit about what they observed and what they thought had gone on.
271400	275700	We had quite a spread of experience actually, all the way from fairly newly
275700	280640	qualified pilots through to people who'd spent pretty much their entire
281380	283280	professional career flying.
284920	289240	And so before we carry on, we need to think about what our attacker looks like.
289560	292300	What might they want to achieve? And obviously the first thing you think
292300	298280	about in this situation is, do they want to cause a crash? And in our kind of
298280	302300	experiment, we weren't that interested in that because we had a simulator with
302300	306900	some limits, we only had a single pilot in, and the situations in which an
306900	311140	attacker would need to be involved in order to cause this kind of kinetic
311140	316060	effect would be very extreme, right at the edge of the pilot's capabilities,
316060	320200	and that wouldn't be a fair situation for the pilots in, but it also wouldn't
320200	324200	really allow us to actually assess anything because they do have some limits
324200	327840	in how they interface with the simulator. So instead, we're looking at softer
327840	332740	effects, but ones that really do have an impact. So things like triggering
332740	337900	go-arounds where the aircraft can't land and so they have to go and take
339240	344380	another go at the landing. Forcing unexpected manoeuvres, this could be any
344380	348940	sort of manoeuvre really outside of the intended profile of the aircraft.
349460	353960	Or it could also be to push crew to switch the systems off that they rely on,
353960	359020	which is particularly bad when some of these systems are really quite tightly
359020	364500	related to safety. And all of these can have a range of sort of second order
364500	368800	effects, if you will, things like causing delay or costing money. And obviously
368800	373720	the worst of these is actually reducing safety, if that's what happens.
374620	378400	The equipment needed for these attacks is fairly typical for this kind of
378960	381060	this kind of experiment or this kind of
382760	389740	attack, if you will. And basically here, we're looking at a scientific grade
389740	394460	software-defined radio, a high gain amplifier and a directional antenna.
394540	397740	Obviously, this will vary a little bit depending on the type of attack and
397740	401240	exactly where the attacker is positioned, but fairly standard for this kind of
401240	406260	research. So the first system that I'm going to talk about is TCAS. There will
406260	410020	be other talks that go into much more detail on TCAS, so I'm not really going
410020	416020	to get into the technical detail and specifics. But really what TCAS is trying
416020	419920	to do is stop aircraft colliding into each other by stepping in before they
419920	424920	get too close and moving them apart if need be. So let's say we have some sort
424920	429060	of aircraft that's flying along. Now, TCAS uses Mode S, which you may know
429060	433100	about. This is an air traffic control technology that allows air traffic
433100	437620	control on the ground to interrogate the intruder, in this case, and the
437620	442560	intruder will respond with some information. So this is continuously
442560	447520	happening, and in the process of an aircraft responding, obviously other
447520	453220	aircraft nearby can see that response. And in this case, the own ship can
453220	457540	actually use that information to estimate, roughly speaking, where the
457540	462500	intruders or the nearby aircraft might be. This is presented in the cockpit to
462500	465600	the pilots. And you can see an example on the right-hand side here. This is
465600	471440	what it might look like in an Airbus, with the red dot there being a much
471440	475880	higher risk of collision, all the way through to the kind of no threat right
475880	479340	at the top there. And obviously some other information is presented, such as
479340	482860	altitude difference and whether that aircraft is climbing or descending.
483480	488480	So let's say these aircraft continue to fly towards each other. At some point,
488480	492100	just passively listening isn't enough, and we move into a phase called active
492100	496020	surveillance. Now, at this point, the ownership in this case is directly
496020	501660	interrogating the intruder, as if it's air traffic control. And if the system
501660	505140	is thinking that these aircraft are starting to be too close, something
505140	509600	called a traffic advisory will be issued. And this, in the cockpit, is basically
509600	517000	just an annunciation of traffic traffic. And the pilots will then have to kind
517000	521120	of get hands-on controls and be ready in case there are further instructions
521120	526220	they need to follow. So if the aircraft continue to get closer, even after a
526220	529980	traffic alert, it looks like at this point they're going to end up with
529980	534620	something called a resolution advisory. And this involves the aircraft actually
534620	539060	doing something to move them apart from each other. So they'll use a form of
539060	542960	mode S, called coordination messages, to communicate what they're planning to
542960	547620	do. And this helps maximize the separation. And once that's been decided,
547620	550500	the RAs will be announced in the cockpit. And these are compulsory
550500	554180	instructions and they must be followed usually within about five seconds. So
554180	556900	let's say, in this case, the intruder has to climb and the own ship has to
556900	561140	descend. Now, importantly, TCAS sort of depends on the fact that these
561140	564540	aircraft are cooperative and actually don't want to crash into each other.
564940	569200	And so that's something to bear in mind for the attack. And the attack is really
569200	574200	quite simple, at least at a high level. So mode S has been shown to be insecure
574200	580080	and vulnerable to injection by Costin and Schaefer and many others as well
580080	583700	over the years. So if we have some aircraft that's flying along and is
583700	588520	issuing a mode S interrogation, we have an attacker who is injecting mode S
588520	592480	responses to create a sort of false intruder. And this false intruder will
592480	597420	appear to be flying towards the target aircraft, which will eventually cause a
597420	601840	TA and then an RA and require avoiding action. So in our simulator scenario, we
601840	606420	saw this happen multiple times. And the aim was to see sort of how many
606420	611280	resolution advisories pilots would fly. And we found, generally speaking, that
611860	616760	pilots actually, after a handful of these resolution advisories, started to
616760	620120	think something was up and something weird was going on. So we found that 26
620120	623660	of our pilots ended up turning the sensitivity of TCAS down, so it only
623660	629480	issued traffic advisories. And a further 11 of those actually turned the system
629480	634420	to standby. So at that point, they received no TCAS announcements at all.
634420	638720	And this typically happened, the first stage was after about four to five RAs,
638720	642220	and the further switch down to standby was after another two to three. So it
642220	646240	took a little while, but eventually, it got there. So the important thing to
646240	652300	remember here is that switching to standby actually causes the loss of TCAS.
652300	656200	And it means that you then shift the burden of keeping your aircraft away
656200	659780	from others onto air traffic control. And this was often done because the
659780	662960	pilots felt they had no choice but to do it, there was something going on with
662960	667140	But this then means that air traffic control have to keep you further apart
667140	671480	from other aircraft, they also have an extra bit of workload on their part in
671480	676920	making sure that you're always further away. On top of that, there was also
676920	680340	excess fuel burn by following RAs, you don't really have a choice in that, but
680340	684800	you have to do these maneuvers. And that really does use some of your fuel.
685680	689860	We found that most of the pilots continued on the route, but some of them
689860	694880	felt that they needed to make extra maneuvers. So maybe to climb above clouds
694880	698540	or to get out of cloud in some way or other. So they could see whether there
698540	701660	was an intruder nearby, or in some cases actually go back to the departure
701660	705420	airport. And this was just because they felt like they couldn't really
706780	713040	fly with TCAS in an inoperative state. So generally speaking, this suggests
713040	718560	that attackers can push pilots to fly these unnecessary RAs or reduce TCAS
718560	723780	sensitivity. And if we look at some of the participant responses in a bit more
723780	729320	detail, we found that many participants noted that RAs were actually really rare.
729320	734580	And so this many RAs in close succession suggests something weird is going on.
734580	740740	On top of that, one pilot who had had 17 years of flying experience had only
741280	747620	had 10 RAs in his career, or less than 10 RAs even. And so it really gives you
747620	752340	an idea of how rare these really are. Something that the participants told us
752340	755460	was that weather would make attack identification much harder, because you
755460	759600	can't just look out the window and see whether anything's flying towards you.
760300	764220	And they also suggested that these sudden repeated RAs might actually
764220	769040	affect other aircraft as well. So 28 of our participants felt that this
769040	772180	attack lowered the safety of the aircraft because of this, but also because
772180	776980	of things like it moving the passengers about on board.
778360	784540	And finally for this attack, pilots had to reduce sensitivity in the key safety
784540	789220	system because of this distraction. One participant put this really well.
789220	793520	They said that it was a sort of crying wolf effect where, you know, they're
793520	797720	trained to listen to this system, do what it tells them to do, and that it's a
797720	801240	really important safety system, but they had to doubt that system and it might
801240	803920	impact how they respond to TCAS in the future.
804680	807940	So the next system I'll talk about is the instrument landing system. Again,
807940	811660	there's going to be some much more detailed talks on how this works and some
812760	817820	technical discussion of attacks on the system. But for this, we're just going to
817820	821880	talk about the glide slope. So the idea here is that the instrument landing
821880	827460	system provides a method to do precision approaches that can be done in a wide
827460	832100	range of weather conditions. And it's really useful for busy air spaces where
832100	835080	you need to land a lot of aircraft very accurately, for example.
836540	842420	So generally speaking, the aircraft will follow a glide path down to the
842420	845900	touchdown zone of the runway. The autopilot will help in following this
845900	851420	glide path. And the way it does this is there are two lobes, two signal lobes.
851420	855820	One of them is modulated at 150 hertz and one is modulated at 90 hertz.
856300	861060	And the aircraft will measure the relative signal strength of these two lobes.
861060	865120	And when the signal strength is equal, it is on the correct glide path.
865480	869360	The glide path itself will depend a little bit on the airport and the approach,
869360	871420	where usually it's about three degrees.
872060	875380	So the attack is fairly simple because this system is fairly simple.
875380	878540	There's no security in place. So we have this idea that an attacker
878540	883100	transmits a false glide slope from the other side of the far end of the runway,
883100	888020	maybe off to the side in some private land rather than actually on the airport.
888940	893400	And they don't introduce a huge difference. It's 350 feet, 100 meters.
893440	897200	But that's big enough to really make a huge difference in where the aircraft
897200	902840	would touch down if it followed it. And the concept is that the aircraft will
902840	909640	intercept either from above or the attacker might be able to overpower the real glide slope.
909640	914360	And this will cause them to follow the false glide slope all the way to the ground.
915200	922240	So as I mentioned, this is very similar to Harshad's attack on the localizer.
922240	925720	So I really encourage you to check that talk out for much more technical detail.
925960	932260	And the kind of overall idea of this attack is to get the aircraft to overshoot the runway
932260	937900	and abort the approach or land deep. Generally speaking, we found that
937900	942480	participants had to abort their approach. So they would arrive at the final stability check
942480	947980	around the 1,000 feet in altitude mark. And they would realize that they were
947980	952040	really on the wrong glide slope and had to have another go.
952040	956020	However, in the following attempts, participants really avoided the glide slope.
956020	958720	They used a wide range of different approach methods.
958760	963520	Some just still using some ILS tools, but not glide slope like lock DME,
963520	967060	some using RNAV, and some using a visual approach.
967060	972900	Generally speaking, the decision to go around was made about, as I mentioned,
972900	978420	the kind of 1,000 feet mark, about one mile to go. So just over a minute before landing.
978420	982480	So this seems quite late, but it is fairly safe and kind of well within
983100	989400	the normal kind of checks, if you will. But some pilots did choose to land anyway.
989400	993320	When they did, they really had to make a very steep correction. It was often at the limit of
993320	996180	the kind of correction they could make. So it wouldn't always be possible.
996180	998880	It really would depend on the conditions on the day.
1000020	1005080	So again, this suggests that, you know, attackers can push pilots to
1005080	1010140	miss an approach in this case, and even abandon using the glide slope completely.
1011100	1015960	And if we go back to the participant comments on this, they all identified an issue,
1015960	1018400	but they very quickly lost confidence in the glide slope.
1018400	1021600	So this attack really wouldn't work beyond one approach.
1021600	1023460	And it might not work for multiple aircraft,
1023460	1026000	because they would realize something weird was going on very quickly.
1026780	1031200	They also commented that it was really a lot harder to manage this in low fuel situations.
1031200	1035580	If you only have the fuel to do one more approach and a diversion,
1036720	1039760	you've got a lot of stress and a lot of work to try and figure out
1039760	1042320	what's going on and make sure it doesn't happen again.
1043240	1046540	Something that we didn't really think about when we were devising this attack is
1046540	1049580	how they might detect something was going on.
1049660	1051860	And one of the key factors in this was actually
1051860	1054400	the precision path approach indicators, or the PAPIs.
1054400	1056560	So these are some lights to the side of the runway.
1056560	1059880	And if you have two red and two white lights, you're on the correct glide slope.
1060420	1063640	And pilots used this, they said that it was important,
1063640	1066220	they could see very quickly that they were off the glide slope.
1066240	1069480	But they didn't know that in poor weather, this would be a bit harder to spot,
1069480	1073620	because you obviously have the PAPIs, but you might not be able to see the ground very well.
1073620	1075880	And so you would lose that visual reference.
1076840	1081180	Also, experience with glide slope behaving weirdly helps and hinders.
1081180	1085260	Pilots commented that glide slopes can bend a little bit sometimes,
1085260	1088820	they can behave in weird ways, but that also kind of held them back,
1088820	1095340	because it meant that they sort of allowed the deviation to run for a little while.
1095340	1098060	They weren't sure if it was just a quirk of the glide slope.
1098720	1102960	Also, the wide range of secondary approach methods really suggested uncertainty.
1102960	1107860	There wasn't one clear way of how to actually handle this attack,
1107860	1112160	which is a problem in trying to advise pilots on how to manage this kind of thing.
1112480	1115700	There was also some concern about this short glide slope,
1115700	1118180	so the diehard approach, if you will,
1118180	1123200	where the glide slope would actually be shifted short of the threshold,
1123200	1128440	and if followed, would lead the aircraft to land not on the runway at all.
1129920	1132140	That's not something we chose to look at in this case,
1132140	1136740	but for reasons we discussed earlier, but it is a really interesting variant of this attack.
1137960	1140000	So what did we find overall?
1140000	1143800	Well, we saw that if attacks can cause spurious alarms,
1143800	1146740	then the system often will just be turned off or ignored.
1147440	1151240	And this sort of means that attackers are effectively forcing pilots away
1151240	1153420	from systems by attacking them.
1153620	1157020	On top of that, attacks have real potential for disruption,
1157020	1162880	though it's not always easy to see how that disruption will pan out.
1162880	1164660	It can be quite hard to predict.
1164660	1167400	So this also means, in a way,
1167400	1170680	that it can have a wider, more unpredictable system impact.
1173180	1176080	Participants were very quick to identify unusual behavior,
1176080	1177820	and this was really encouraging to see.
1177820	1180920	That procedure really helped carry them through
1180920	1182540	and get them to a point where they could figure out
1182540	1186300	something wasn't quite working properly, and they could act on it.
1186600	1191460	And on top of that, the attack success partly depends on wider system effects.
1191460	1193940	So we touched on this a little bit, but things like traffic,
1193940	1199340	how busy air traffic control are, how many legs the pilot has flown that day,
1199340	1203460	really has a big impact on whether some of the more obvious attacks
1203460	1205740	might fly under the radar or not.
1206680	1208260	So where do we go from here?
1208260	1211960	Well, we've shown that ILS and TCAS both have attacks
1211960	1216160	that can have an impact on how the aircraft is flown.
1216580	1221120	And these really do have a disruptive effect.
1221120	1223440	They aren't just a bit of an annoyance.
1223440	1227540	They cause the aircraft to do something that it really wouldn't normally do.
1228560	1232440	Larger impacts, though, it really remains to be seen how likely they are,
1232440	1234540	whether it's possible to cause them,
1234540	1238940	whether under some sort of very specific circumstances, this could work.
1239140	1241700	Our view at the moment is it's very hard to predict
1241700	1244140	what the larger impact might be,
1244140	1248400	and it would be very hard to cause any sort of collision risk
1248400	1249700	or multi-aircraft effect
1249700	1254240	just because of the numerous kind of circumstantial bits
1254240	1256440	that would need to be pieced together for that to happen.
1257580	1260140	The encouraging thing from this, though, is the existing procedure
1260140	1263260	really is an ideal starting point for how to handle these attacks.
1263260	1265140	So we're not starting from scratch.
1265140	1269580	Regulators are already talking about how to incorporate awareness training,
1269580	1271980	and the pilots did really well already.
1272100	1275380	So there's something really encouraging to build on that.
1275880	1278960	If you found this talk interesting and you'd like to learn more,
1278960	1282820	we had a full paper on this published earlier this year at NDSS 2020.
1283080	1286120	We also have another attack in there on the ground proximity warning system
1286120	1289620	and a lot more detail on all sorts of different responses.
1289660	1292800	So do check that out. The link is just there on the slide.
1293920	1295300	And thanks for listening.
1295300	1297500	I'd be really happy to answer any questions in the chat.