WEBVTT 00:04.300 --> 00:06.640 Hi, thanks for coming to my talk. 00:06.640 --> 00:07.640 My name is Matt Smith. 00:07.640 --> 00:19.260 I'm a postdoc from the University of Oxford and today I'm going to talk to you about some research that we did recently where we tried to understand how pilots might react when faced with realistic attacks on their systems. 00:19.860 --> 00:20.880 So who are we? 00:20.880 --> 00:24.980 Well, we're a team of researchers from the University of Oxford and ArmaSwiss. 00:24.980 --> 00:40.200 ArmaSwiss is the research and development part of the Swiss Ministry of Defence and we've been involved in security research now for about eight years, covering topics such as ADS-B and ACARS, more recently broadening some other areas as well. 00:40.200 --> 00:45.000 We've also been involved in founding OpenSky, which is a really great project. 00:45.000 --> 00:49.280 I really recommend you check it out, especially if you're involved in aviation. 00:49.440 --> 00:56.760 It is a research-focused ADS-B MODIS collection network, so really would recommend checking that out. 00:57.360 --> 01:18.480 So the past 10 years has really seen a rise in research from a wide range of groups all around the world, publishing at top-tier conferences, in much more practical security venues like Black Hat and DEFCON, master's theses, all sorts of different bits of research. 01:18.660 --> 01:34.260 And often these papers have proposed really interesting attacks that really, you know, propose something new and focus on the part between the transmission of the signal and getting this onto the aircraft. 01:34.260 --> 01:46.400 And obviously you can kind of predict some effects that this might have on how the aircraft is flown, but it really does raise the question of how well do pilots handle these kind of attacks. 01:47.840 --> 02:06.280 So we think this is a really interesting question because pilots are often assessed on how they handle faults and they usually do this in a flight simulator, and this is a full motion one on the right-hand side here, and they're sort of a last line of defense against these faults because they have this really well-defined procedure, 02:06.280 --> 02:10.780 it's part of their training and, you know, some really key part of their job. 02:11.320 --> 02:27.180 And we started to think about how this fault handling skill might translate to mitigating attacks and also whether you can use flight simulation to actually understand the impact of attacks like you can use it to understand the impact of faults. 02:28.300 --> 02:40.360 So something we really want to focus on at this point and just highlight is the fact that this piece of work is actually interested in the effects of attacks rather than, say, the technical detail of the attacks themselves. 02:40.440 --> 02:54.540 So as we all know, normally the kind of chain of signal to action is there's some sort of legitimate signal from air traffic control or whatever it might be, gets to the aircraft and presents to the pilots somehow. 02:54.740 --> 03:01.700 The pilots act on that and then there's some sort of behavior that comes out of it and that's normal. 03:01.980 --> 03:13.640 As we know, many of these aviation communications are unencrypted, so you know, we have this part that I just talked about where there's been a lot of research, this creation of signals that are transmitted to the aircraft. 03:13.640 --> 03:19.420 But what we're interested in this piece of work is what happens when those signals arrive at the aircraft and are presented to the pilots. 03:19.420 --> 03:20.440 How do they perceive them? 03:20.440 --> 03:21.840 What do they do with them? 03:21.840 --> 03:24.520 Does it affect how the aircraft is flown? 03:25.580 --> 03:35.860 So to do this, we invited 30 tight-rated Airbus A320 pilots to come and fly in our little simulator that we built in our building. 03:35.860 --> 03:44.300 And within that simulator, we implemented some attacks on collision avoidance systems, ground proximity warning systems, and landing systems. 03:44.300 --> 03:52.460 And we're only going to cover two of those today just to keep it focused, but we do have some more info if people are interested in the other one. 03:52.580 --> 04:00.560 We used X-Plane 11, which is a high quality aircraft model, and we had a single pilot set up. 04:00.560 --> 04:06.260 So the experimenter provided some basic flying support in terms of pushing buttons and enabling modes, but nothing more than that. 04:06.260 --> 04:09.240 They didn't actually contribute to decisions made. 04:09.800 --> 04:23.020 In terms of how we actually carried this out, we had a familiarization flight first so the pilots could get used to the route and the controls, and then we had a simulator flight for each of the attacks that implemented the attack. 04:23.120 --> 04:30.780 And after they'd flown it, the pilots debriefed with us to tell us a little bit about what they observed and what they thought had gone on. 04:31.400 --> 04:43.280 We had quite a spread of experience actually, all the way from fairly newly qualified pilots through to people who'd spent pretty much their entire professional career flying. 04:44.920 --> 04:49.240 And so before we carry on, we need to think about what our attacker looks like. 04:49.560 --> 04:51.020 What might they want to achieve? 04:51.020 --> 04:55.760 And obviously the first thing you think about in this situation is, do they want to cause a crash? 04:55.760 --> 05:14.520 And in our kind of experiment, we weren't that interested in that because we had a simulator with some limits, we only had a single pilot in, and the situations in which an attacker would need to be involved in order to cause this kind of kinetic effect would be very extreme, 05:14.520 --> 05:25.980 right at the edge of the pilot's capabilities, and that wouldn't be a fair situation for the pilots in, but it also wouldn't really allow us to actually assess anything because they do have some limits in how they interface with the simulator. 05:25.980 --> 05:31.120 So instead, we're looking at softer effects, but ones that really do have an impact. 05:31.120 --> 05:41.480 So things like triggering go-arounds where the aircraft can't land and so they have to go and take another go at the landing. 05:41.860 --> 05:48.940 Forcing unexpected manoeuvres, this could be any sort of manoeuvre really outside of the intended profile of the aircraft. 05:49.460 --> 06:00.700 Or it could also be to push crew to switch the systems off that they rely on, which is particularly bad when some of these systems are really quite tightly related to safety. 06:00.760 --> 06:08.280 And all of these can have a range of sort of second order effects, if you will, things like causing delay or costing money. 06:08.480 --> 06:13.720 And obviously the worst of these is actually reducing safety, if that's what happens. 06:14.620 --> 06:24.200 The equipment needed for these attacks is fairly typical for this kind of this kind of experiment or this kind of attack, if you will. 06:24.900 --> 06:34.460 And basically here, we're looking at a scientific grade software-defined radio, a high gain amplifier and a directional antenna. 06:34.540 --> 06:42.060 Obviously, this will vary a little bit depending on the type of attack and exactly where the attacker is positioned, but fairly standard for this kind of research. 06:42.640 --> 06:45.840 So the first system that I'm going to talk about is TCAS. 06:46.000 --> 06:53.260 There will be other talks that go into much more detail on TCAS, so I'm not really going to get into the technical detail and specifics. 06:53.620 --> 07:02.820 But really what TCAS is trying to do is stop aircraft colliding into each other by stepping in before they get too close and moving them apart if need be. 07:03.020 --> 07:06.220 So let's say we have some sort of aircraft that's flying along. 07:06.220 --> 07:09.440 Now, TCAS uses Mode S, which you may know about. 07:09.440 --> 07:20.160 This is an air traffic control technology that allows air traffic control on the ground to interrogate the intruder, in this case, and the intruder will respond with some information. 07:21.160 --> 07:30.160 So this is continuously happening, and in the process of an aircraft responding, obviously other aircraft nearby can see that response. 07:30.760 --> 07:40.280 And in this case, the own ship can actually use that information to estimate, roughly speaking, where the intruders or the nearby aircraft might be. 07:40.660 --> 07:43.380 This is presented in the cockpit to the pilots. 07:43.520 --> 07:45.360 And you can see an example on the right-hand side here. 07:45.360 --> 07:56.980 This is what it might look like in an Airbus, with the red dot there being a much higher risk of collision, all the way through to the kind of no threat right at the top there. 07:56.980 --> 08:02.860 And obviously some other information is presented, such as altitude difference and whether that aircraft is climbing or descending. 08:03.480 --> 08:06.900 So let's say these aircraft continue to fly towards each other. 08:07.020 --> 08:12.680 At some point, just passively listening isn't enough, and we move into a phase called active surveillance. 08:12.680 --> 08:19.400 Now, at this point, the ownership in this case is directly interrogating the intruder, as if it's air traffic control. 08:19.700 --> 08:27.040 And if the system is thinking that these aircraft are starting to be too close, something called a traffic advisory will be issued. 08:27.040 --> 08:32.180 And this, in the cockpit, is basically just an annunciation of traffic traffic. 08:32.780 --> 08:42.300 And the pilots will then have to kind of get hands-on controls and be ready in case there are further instructions they need to follow. 08:43.180 --> 08:51.460 So if the aircraft continue to get closer, even after a traffic alert, it looks like at this point they're going to end up with something called a resolution advisory. 08:51.460 --> 08:57.300 And this involves the aircraft actually doing something to move them apart from each other. 08:57.400 --> 09:03.000 So they'll use a form of mode S, called coordination messages, to communicate what they're planning to do . 09:03.000 --> 09:05.160 And this helps maximize the separation. 09:05.460 --> 09:09.740 And once that's been decided, the RAs will be announced in the cockpit. 09:09.740 --> 09:14.000 And these are compulsory instructions and they must be followed usually within about five seconds. 09:14.140 --> 09:17.700 So let's say, in this case, the intruder has to climb and the own ship has to descend. 09:18.240 --> 09:24.540 Now, importantly, TCAS sort of depends on the fact that these aircraft are cooperative and actually don't want to crash into each other. 09:24.940 --> 09:28.360 And so that's something to bear in mind for the attack. 09:28.400 --> 09:31.380 And the attack is really quite simple, at least at a high level. 09:31.380 --> 09:41.180 So mode S has been shown to be insecure and vulnerable to injection by Costin and Schaefer and many others as well over the years. 09:41.340 --> 09:51.360 So if we have some aircraft that's flying along and is issuing a mode S interrogation, we have an attacker who is injecting mode S responses to create a sort of false intruder. 09:51.360 --> 10:00.020 And this false intruder will appear to be flying towards the target aircraft, which will eventually cause a TA and then an RA and require avoiding action. 10:00.220 --> 10:03.700 So in our simulator scenario, we saw this happen multiple times. 10:03.700 --> 10:08.740 And the aim was to see sort of how many resolution advisories pilots would fly. 10:09.520 --> 10:18.660 And we found, generally speaking, that pilots actually, after a handful of these resolution advisories, started to think something was up and something weird was going on. 10:18.660 --> 10:25.900 So we found that 26 of our pilots ended up turning the sensitivity of TCAS down, so it only issued traffic advisories. 10:26.140 --> 10:30.320 And a further 11 of those actually turned the system to standby. 10:30.320 --> 10:34.420 So at that point, they received no TCAS announcements at all. 10:34.420 --> 10:42.000 And this typically happened, the first stage was after about four to five RAs, and the further switch down to standby was after another two to three. 10:42.000 --> 10:45.100 So it took a little while, but eventually, it got there. 10:45.300 --> 10:52.300 So the important thing to remember here is that switching to standby actually causes the loss of TCAS. 10:52.300 --> 10:58.360 And it means that you then shift the burden of keeping your aircraft away from others onto air traffic control. 10:58.460 --> 11:14.660 And this was often done because the pilots felt they had no choice but to do it, there was something going on with But this then means that air traffic control have to keep you further apart from other aircraft, they also have an extra bit of workload on their part in making sure that you're always further away. 11:15.380 --> 11:21.920 On top of that, there was also excess fuel burn by following RAs, you don't really have a choice in that, but you have to do these maneuvers. 11:21.920 --> 11:24.800 And that really does use some of your fuel. 11:25.680 --> 11:32.780 We found that most of the pilots continued on the route, but some of them felt that they needed to make extra maneuvers. 11:32.780 --> 11:37.500 So maybe to climb above clouds or to get out of cloud in some way or other. 11:37.500 --> 11:42.700 So they could see whether there was an intruder nearby, or in some cases actually go back to the departure airport. 11:42.700 --> 11:51.180 And this was just because they felt like they couldn't really fly with TCAS in an inoperative state. 11:51.460 --> 11:59.560 So generally speaking, this suggests that attackers can push pilots to fly these unnecessary RAs or reduce TCAS sensitivity. 12:00.080 --> 12:09.320 And if we look at some of the participant responses in a bit more detail, we found that many participants noted that RAs were actually really rare. 12:09.320 --> 12:14.580 And so this many RAs in close succession suggests something weird is going on. 12:14.580 --> 12:26.040 On top of that, one pilot who had had 17 years of flying experience had only had 10 RAs in his career, or less than 10 RAs even. 12:26.260 --> 12:29.760 And so it really gives you an idea of how rare these really are. 12:30.500 --> 12:39.600 Something that the participants told us was that weather would make attack identification much harder, because you can't just look out the window and see whether anything's flying towards you. 12:40.300 --> 12:46.240 And they also suggested that these sudden repeated RAs might actually affect other aircraft as well. 12:46.240 --> 12:56.980 So 28 of our participants felt that this attack lowered the safety of the aircraft because of this, but also because of things like it moving the passengers about on board. 12:58.360 --> 13:06.940 And finally for this attack, pilots had to reduce sensitivity in the key safety system because of this distraction. 13:07.380 --> 13:09.220 One participant put this really well. 13:09.220 --> 13:23.920 They said that it was a sort of crying wolf effect where, you know, they're trained to listen to this system, do what it tells them to do, and that it's a really important safety system, but they had to doubt that system and it might impact how they respond to TCAS in the future. 13:24.680 --> 13:27.540 So the next system I'll talk about is the instrument landing system. 13:27.540 --> 13:35.500 Again, there's going to be some much more detailed talks on how this works and some technical discussion of attacks on the system. 13:35.500 --> 13:38.900 But for this, we're just going to talk about the glide slope. 13:38.900 --> 13:49.000 So the idea here is that the instrument landing system provides a method to do precision approaches that can be done in a wide range of weather conditions. 13:49.480 --> 13:55.080 And it's really useful for busy air spaces where you need to land a lot of aircraft very accurately, for example. 13:56.540 --> 14:03.640 So generally speaking, the aircraft will follow a glide path down to the touchdown zone of the runway. 14:03.640 --> 14:06.600 The autopilot will help in following this glide path. 14:06.600 --> 14:11.420 And the way it does this is there are two lobes, two signal lobes. 14:11.420 --> 14:15.820 One of them is modulated at 150 hertz and one is modulated at 90 hertz. 14:16.300 --> 14:21.060 And the aircraft will measure the relative signal strength of these two lobes. 14:21.060 --> 14:25.120 And when the signal strength is equal, it is on the correct glide path. 14:25.480 --> 14:31.420 The glide path itself will depend a little bit on the airport and the approach, where usually it's about three degrees. 14:32.060 --> 14:35.380 So the attack is fairly simple because this system is fairly simple. 14:35.380 --> 14:36.600 There's no security in place. 14:36.600 --> 14:48.020 So we have this idea that an attacker transmits a false glide slope from the other side of the far end of the runway, maybe off to the side in some private land rather than actually on the airport. 14:48.940 --> 14:51.080 And they don't introduce a huge difference. 14:51.080 --> 14:53.400 It's 350 feet, 100 meters. 14:53.440 --> 14:59.080 But that's big enough to really make a huge difference in where the aircraft would touch down if it followed it. 14:59.300 --> 15:09.640 And the concept is that the aircraft will intercept either from above or the attacker might be able to overpower the real glide slope. 15:09.640 --> 15:14.360 And this will cause them to follow the false glide slope all the way to the ground. 15:15.200 --> 15:22.240 So as I mentioned, this is very similar to Harshad's attack on the localizer. 15:22.240 --> 15:25.720 So I really encourage you to check that talk out for much more technical detail. 15:25.960 --> 15:34.960 And the kind of overall idea of this attack is to get the aircraft to overshoot the runway and abort the approach or land deep. 15:36.140 --> 15:40.020 Generally speaking, we found that participants had to abort their approach. 15:40.020 --> 15:45.180 So they would arrive at the final stability check around the 1,000 feet in altitude mark. 15:45.520 --> 15:52.040 And they would realize that they were really on the wrong glide slope and had to have another go. 15:52.040 --> 15:56.020 However, in the following attempts, participants really avoided the glide slope. 15:56.020 --> 15:58.720 They used a wide range of different approach methods. 15:58.760 --> 16:07.060 Some just still using some ILS tools, but not glide slope like lock DME, some using RNAV, and some using a visual approach. 16:07.060 --> 16:16.240 Generally speaking, the decision to go around was made about, as I mentioned, the kind of 1,000 feet mark, about one mile to go. 16:16.240 --> 16:18.420 So just over a minute before landing. 16:18.420 --> 16:26.000 So this seems quite late, but it is fairly safe and kind of well within the normal kind of checks, if you will. 16:26.880 --> 16:29.400 But some pilots did choose to land anyway. 16:29.400 --> 16:31.880 When they did, they really had to make a very steep correction. 16:31.880 --> 16:34.840 It was often at the limit of the kind of correction they could make. 16:34.840 --> 16:36.180 So it wouldn't always be possible. 16:36.180 --> 16:38.880 It really would depend on the conditions on the day. 16:40.020 --> 16:50.140 So again, this suggests that, you know, attackers can push pilots to miss an approach in this case, and even abandon using the glide slope completely. 16:51.100 --> 16:58.400 And if we go back to the participant comments on this, they all identified an issue, but they very quickly lost confidence in the glide slope. 16:58.400 --> 17:01.600 So this attack really wouldn't work beyond one approach. 17:01.600 --> 17:06.000 And it might not work for multiple aircraft, because they would realize something weird was going on very quickly. 17:06.780 --> 17:11.200 They also commented that it was really a lot harder to manage this in low fuel situations. 17:11.200 --> 17:22.320 If you only have the fuel to do one more approach and a diversion, you've got a lot of stress and a lot of work to try and figure out what's going on and make sure it doesn't happen again. 17:23.240 --> 17:29.580 Something that we didn't really think about when we were devising this attack is how they might detect something was going on. 17:29.660 --> 17:34.400 And one of the key factors in this was actually the precision path approach indicators, or the PAPIs. 17:34.400 --> 17:36.560 So these are some lights to the side of the runway. 17:36.560 --> 17:39.880 And if you have two red and two white lights, you're on the correct glide slope. 17:40.420 --> 17:46.220 And pilots used this, they said that it was important, they could see very quickly that they were off the glide slope. 17:46.240 --> 17:53.620 But they didn't know that in poor weather, this would be a bit harder to spot, because you obviously have the PAPIs, but you might not be able to see the ground very well. 17:53.620 --> 17:55.880 And so you would lose that visual reference. 17:56.840 --> 18:01.180 Also, experience with glide slope behaving weirdly helps and hinders. 18:01.180 --> 18:15.340 Pilots commented that glide slopes can bend a little bit sometimes, they can behave in weird ways, but that also kind of held them back, because it meant that they sort of allowed the deviation to run for a little while. 18:15.340 --> 18:18.060 They weren't sure if it was just a quirk of the glide slope. 18:18.720 --> 18:22.960 Also, the wide range of secondary approach methods really suggested uncertainty. 18:22.960 --> 18:32.160 There wasn't one clear way of how to actually handle this attack, which is a problem in trying to advise pilots on how to manage this kind of thing. 18:32.480 --> 18:48.440 There was also some concern about this short glide slope, so the diehard approach, if you will, where the glide slope would actually be shifted short of the threshold, and if followed, would lead the aircraft to land not on the runway at all. 18:49.920 --> 18:56.740 That's not something we chose to look at in this case, but for reasons we discussed earlier, but it is a really interesting variant of this attack. 18:57.960 --> 19:00.000 So what did we find overall? 19:00.000 --> 19:06.740 Well, we saw that if attacks can cause spurious alarms, then the system often will just be turned off or ignored. 19:07.440 --> 19:13.420 And this sort of means that attackers are effectively forcing pilots away from systems by attacking them. 19:13.620 --> 19:22.880 On top of that, attacks have real potential for disruption, though it's not always easy to see how that disruption will pan out. 19:22.880 --> 19:24.660 It can be quite hard to predict. 19:24.660 --> 19:30.680 So this also means, in a way, that it can have a wider, more unpredictable system impact. 19:33.180 --> 19:37.820 Participants were very quick to identify unusual behavior, and this was really encouraging to see. 19:37.820 --> 19:46.300 That procedure really helped carry them through and get them to a point where they could figure out something wasn't quite working properly, and they could act on it. 19:46.600 --> 19:51.460 And on top of that, the attack success partly depends on wider system effects. 19:51.460 --> 20:05.740 So we touched on this a little bit, but things like traffic, how busy air traffic control are, how many legs the pilot has flown that day, really has a big impact on whether some of the more obvious attacks might fly under the radar or not. 20:06.680 --> 20:08.260 So where do we go from here? 20:08.260 --> 20:16.160 Well, we've shown that ILS and TCAS both have attacks that can have an impact on how the aircraft is flown. 20:16.580 --> 20:21.120 And these really do have a disruptive effect. 20:21.120 --> 20:23.440 They aren't just a bit of an annoyance. 20:23.440 --> 20:27.540 They cause the aircraft to do something that it really wouldn't normally do. 20:28.560 --> 20:38.940 Larger impacts, though, it really remains to be seen how likely they are, whether it's possible to cause them, whether under some sort of very specific circumstances, this could work. 20:39.140 --> 20:56.440 Our view at the moment is it's very hard to predict what the larger impact might be, and it would be very hard to cause any sort of collision risk or multi-aircraft effect just because of the numerous kind of circumstantial bits that would need to be pieced together for that to happen. 20:57.580 --> 21:03.260 The encouraging thing from this, though, is the existing procedure really is an ideal starting point for how to handle these attacks. 21:03.260 --> 21:05.140 So we're not starting from scratch. 21:05.140 --> 21:11.980 Regulators are already talking about how to incorporate awareness training, and the pilots did really well already. 21:12.100 --> 21:15.380 So there's something really encouraging to build on that. 21:15.880 --> 21:22.820 If you found this talk interesting and you'd like to learn more, we had a full paper on this published earlier this year at NDSS 2020. 21:23.080 --> 21:29.620 We also have another attack in there on the ground proximity warning system and a lot more detail on all sorts of different responses. 21:29.660 --> 21:31.020 So do check that out. 21:31.020 --> 21:32.800 The link is just there on the slide. 21:33.920 --> 21:35.300 And thanks for listening. 21:35.300 --> 21:37.500 I'd be really happy to answer any questions in the chat.