start	end	text
5920	9720	Hi everyone and welcome to this introduction to ACARS.
10900	15400	I'm an aeronautical engineer, pilot and hacker at Pentest Partners in the UK
16320	21680	and I lead our aerospace work and research program. I've had the honor of working in all
21680	27240	sorts of environments from government networks and consumer IoT through to planes, trains and
27240	33440	automobiles. What we're going to be talking about is an avionics system called ACARS,
33440	38660	which is really just a way of sending text messages between ground and airborne stations.
39280	42400	This is a light touch on the topic but I'll cover the history of it,
42400	48100	how it's transmitted, what it's used for and current airline ops, how to decode and decipher
48100	54880	it and explore where the potential security issues with it are. Really what ACARS is now
54880	59060	is a data link and this has become really important in keeping up the efficiency and
59060	67300	safety of modern aircraft. So the start of the jet age of commercial passenger flying in the 1960s,
67300	73640	communication was pretty basic. It was voice only between aircraft and the ground. Airlines did,
73640	79080	and still do, pay their flight crews by block time, which is the moment from the doors closing
79080	83960	and the aircraft taxiing now to the moment the doors open again at the arrival gate.
84140	88140	I think it's probably derived from when the ground crew pull the chocks or blocks out
88140	94780	from the wheels to allow the aircraft to move. In the 1960s and 70s, crews would radio their off-block
94780	99500	times to a human on the ground, who would transcribe that into a teletype machine
99500	105940	and send that onto the airline's base. Remember that airlines routinely fly into airports
105940	110880	where there's no direct representation of that airline on the ground, so some form of remote
110880	116840	communication is needed back to HQ. Looking for efficiency, I guess a euphemism for not paying
116840	121400	crews any more than they need to. ACARS was developed as a kind of automatic time clock
121400	129040	system, sending the details of the out, off, on, and in times by radio. Because radio is line of
129040	134220	sight only, ARINC, those who developed the standard, built out a network of ground-based
134220	139380	transmitters to send, receive, and reload those messages around. And this whole concept hasn't
139380	147420	really changed much to this day. So here we are today then. Plain old ACARS is broadly what it
147420	153500	was back in 1978. It uses a VHF radio and a network of ground transmitters to send these messages
153500	161480	around. A later evolution is ACARS over Aviation VHF Link Control, which is a terrible mashup of
161480	168220	acronyms. IT being aerospace. This still uses a VHF line of sight radios, but on a different
168220	174820	frequency to give a slightly higher bandwidth. For areas outside of direct ground contact,
174820	181530	like over the Atlantic, High Frequency Data Link, HFTL, can also be used, but it's very slow.
182300	186760	Nowadays we have SATCOM, which is increasingly the transmission mode of choice for many airlines
186760	192840	and aircraft. There is some experimentation with using the cellular GSM networks as an ACARS
192840	199400	platform too, but it's only in use for one European carrier, to my knowledge. There are
199400	205460	several classes of load, I suppose you would call them, in the ACARS network. The aircraft themselves
205460	210580	and ground stations like the airlines and air traffic control, as we'll see later.
210860	217120	In order to route a message from an aircraft flying over, let's say Spain, back to the airline
217120	223820	HQ in the UK, a Data Link Service Provider is paid to pick up, route, and deliver these messages.
224320	231560	You have two Data Link Service Providers, DSPs, to choose from, CITA and Rockwell. Rockwell bought
231560	238240	ARINC Inc., including the ACARS network, back in 2013, so you might see ARINC slash Rockwell
238240	239880	used interchangeably.
241780	249240	So as we've said, the original plain old ACARS, and ACARS over ABLC, used VHF radios, so a new
249240	254580	direct line of sight. And that includes the earth being round, of course, to a ground station.
254940	260360	Aircraft are often flying pretty high up, 35,000 feet or more, so actually the range of a single
260360	265860	transmitter is still quite large. But you can see from CITA's coverage map here, there are lots of
265860	273040	gaps over oceans, Africa, and places aircraft tend not to fly very much, like northern Canada.
273660	277280	Running all of these transmitters and maintaining the communications links between them
277280	282780	is pretty expensive. Satellite coverage is also dependent on where you are in the world,
282780	288540	although to a lesser degree. InMarsat have coverage between plus and minus 80 degrees latitude,
288540	295860	although Iridium have more lower satellites and can offer polar coverage too.
296040	302240	There are only 15 high frequency transmitters in the world. They have long reach and are located
302240	309260	for polar and oceanic coverage. The costs are a bit opaque, but one Asian carrier was paying
309260	316620	the equivalent of a thousand dollars per megabyte on their HF service. AOA and POA are still not home
316620	322220	broadband prices though, and there is a bit of an old adage in that for aviation you add another
322220	329220	zero onto the end of what seems a reasonable price for anything. Original ACARS uses a signal
329220	334780	with each bit encoded as a half bit sine wave on top of the carrier, which you can see in this nice
334780	340840	waterfall image that most software-defined radio signals will generate for you. The modem will
340840	346160	briefly listen to avoid transmitting at the same time as others and send a starting tone
346620	353070	and then the serial data. And you can hear this as a fairly distinctive old-school style modem noise.
354800	359990	As is VHF, a line-of-sight, each geographic region uses a different frequency.
360360	367280	And this is per data link service provider as well. So ARINC, Rockwell, in Europe is a different
367280	373080	frequency to CITER in Europe. And the aircraft's modem will usually automatically switch frequencies
373080	382540	between them based on its known position. VHF Data Link 2, so AI, is an enhancement that uses
383080	388860	phase shift keying modulation to give a slightly higher bandwidth throughput. It also uses the
388860	394600	X25 routing protocol to send messages between data terminals. And I guess this sort of matches
394600	401980	up with the lowest three layers of the OSI model, but this X25 predates TCPIP by some considerable
401980	410180	time. Because of the use of X25, there is a global single frequency, but as with planar ACARS, it's
410180	419100	VHF and so still line-of-sight. So several satellite communication service providers offer
419620	426660	ACARS, including Inmarsat and Iridium, both have global coverage. But as Inmarsat has
426660	431180	geostationary satellites, there is no reception between plus and minus 80 degrees latitude,
431180	436740	as we can see in their coverage map. Iridium has a larger constellation of lower flying birds
436740	442580	to give complete coverage even over polar regions. There are different bandwidth and frequency
442580	447960	options and services from each provider, but certain frequencies are better at penetrating
447960	454780	water. Although aircraft tend to fly above clouds and weather, and this is not usually a problem,
454780	462000	but in the tropics, humid air can block signals. It is possible to intercept ground-to-air,
462000	467180	that is ground-to-satellite-to-aircraft communications using a suitable antenna and
467180	473360	software, as a signal is transmitted to the ground over a wide area. But you will not be able to see
473360	480480	aircraft to ground, as you're not in a middle position unless you're in space. The data is
480480	485820	relayed from the ground stations back into the DSP networks and then on to its destination.
486640	492280	Classic aero services are quite bandwidth-limited, but we've probably all been on aircraft with
492280	499440	in-flight Wi-Fi by now, so SATCOM program actually can be quite decent, and it's this latter capability
499440	505400	that is now being used in modern E&A aircraft to collect huge amounts of live data for analysis
505400	512680	and predictive maintenance. There are also options to transmit ACARS over long-wave,
512680	517540	high-frequency transmitters, and this is reserved for oceanic and polar regions.
517540	522520	There are actually only 15 transmitter sites and speeds are incredibly slow,
522520	526440	and this probably also explains the very high costs of using these services.
528580	533740	There is an early test of using the CELIN networks to provide ACARS services in Europe.
533740	538720	This actually uses a piece of equipment found on many aircraft already, which is a wireless
538720	545340	quick access recorder or wireless digital flight data acquisition unit. These devices capture lots
545340	550000	of data in flight and then relay it back to the airline once they're on the ground over a 3G
550000	557080	network. This same unit can be upgraded to provide a wireless link and route ACARS over that instead.
559490	564090	Aircraft will often maintain multiple communication links, and for a transatlantic
564090	570650	flight an aircraft may actually have and use all three options at various stages of the flight.
570970	576970	A communications management unit, CMU, is used to route ACARS traffic between the various avionics
576970	583550	systems and these physical links. An airline may also change the cost preferences depending on how
583550	589850	much they pay for various services. This CMU has access to lots of important avionics including
589850	596170	display unit the pilot interacts with, the flight management computer for reporting location,
596170	600790	and for setting height or heading as we'll see later, and for acquiring lots of maintenance
600790	605970	data. And believe it or not there are actual genuine printers on the flight deck too.
608250	614590	A brief segue on to cell call. During transatlantic or polar flights where radio
614590	620350	communication is intermittent and to avoid crews from having to monitor radios for a long period,
620350	625490	cell call was introduced where the air traffic controller can trigger an alert light or sound
625490	631010	or both in the cockpit and the crew then jump on the radio to listen for the actual message.
631470	638190	Each aircraft is assigned a four-digit code and the first pair of letters sent as a tone and then
638190	644290	the second, which I guess is a bit like DTMF dialing tones. As you can see there aren't that
644290	650130	many possible combinations so there is reuse and it's really important that crews verify the
650130	656950	transmission was really meant for them. Similarly now when there is an ACARS message the crew will
656950	662750	hear a chime noise and a data link message will appear on the displays which they can then go and
662750	670930	read. ACARS at its basis is simply a text message service between two parties and this concept is
670930	676250	now being used in air traffic control. Rather than a controller using voice radios to instruct pilots
676250	682770	on what to do this is sent by a ACARS message. This has the benefits of efficiency which means
682770	688130	more aircraft can be accommodated in a given space but also safety you know there is no confusion in
688130	694570	hearing about what altitude to fly to or heading etc. Both Boeing and Airbus developed their own
694570	701810	standards but these were merged and gave rise to the FANS 1A standard as we have today. A FANS
701810	707690	installation on aircraft requires certification and a minimum latency requirement. Messages will
707690	714830	be automatically rejected after 30 seconds if no confirmation is made. FANS is comprised of
714830	721450	two important services which are both sent over ACARS and that could be either VHF or SATCOM.
721470	729710	Controller Pilot Data Link Communication CPDLC and Automatic Dependent Surveillance Contract ADSC.
731850	737950	So for CPDLC, air traffic can send pilots instructions to climb to a particular altitude
737950	743490	or steer a heading. Before this can happen, pilots log on to a specific controller which
743490	749690	then shows that the data link is ready. Every instruction sent by ATC requires a positive
749690	755310	confirmation by the pilot. You cannot simply send a message and remote control your plane.
756030	761890	Different regions still have different CPDLC adoption levels. So Europe has on-route services
761890	768830	whereas parts of the USA only have pre-departure at airports. And this latter is really useful
768830	773170	because if you've ever had to note down and read back a complicated departure clearance,
773170	778230	you'll realize how useful this is in not only time saving but in making sure it's correct.
779810	786650	You might be familiar with ADS-B which is the position notification signal sent out on 1090
786650	792530	megahertz which contains GPS position and altitude. And this is picked up by services
792530	800130	like Flight Radar 24 and ADS-B Exchange. These are periodically sent out by the aircraft when
800130	807770	it's illuminated by primary radar. But for fans, we need more granularity and information. So ADSC
807770	814830	is used instead. Air traffic can request an aircraft report its position or time when
814830	820970	passing a certain altitude or a given waypoint. ADSC will also show what waypoints the aircraft
820970	826890	is currently programmed to fly to. So controllers can better understand and more efficiently
826890	834190	sequence traffic for arrivals into busy airports. So now we know that more ACARS is useful in broad
834190	840150	terms, let's have a closer look at how the messages are formatted. In plain old ACARS,
840150	845130	all messages are broadcast to all devices, or those that are in range of the same transmitter
845130	851130	at least. So there is a header that lists the destination aircraft registration. The receiver
851130	857110	on an aircraft will discard any messages that are not destined for it. In the header,
857730	862310	there is a two-character label field which indicates the type of data that the whole
862310	869350	message contains. There's no specific standard but there are some common ones like C1 which is
869430	874530	a message for the onboard printer and indeed some airlines will use different labels to indicate
874530	881010	the same types of data. The bulk of the transmission is taken up by the message text itself
881010	888050	up to a maximum of 220 characters. The character set is basic ASCII alphanumerics and some special
888050	894370	characters only and no unicode. These could just be standard free text type messages or they could
894370	899330	be engineering and maintenance data and frankly more often than not it's the latter and are quite
899330	908230	dull as a result. Sequential messages are sent with an incrementing number in the header so C01,
908230	915390	C02 for example. Because of the 220 character limit, larger messages like our maintenance data
915390	921210	can be split across multiple ACOLs transmissions or with a letter suffix to note their position
921210	929190	in the multi-part message. So for example U10A, U10B, U10C etc. The next separate message
929190	936090	from this particular aircraft would then be U11A and so on. The last part of the message
936090	943590	is a simple checksum either ATM32 which is a modified form of Fletcher's checksum or a CRC.
943590	949090	The CDU on an aircraft will discard any message without a valid checksum and ask for a retransmit
949090	955710	if possible. The checksum is designed to protect against distortion of the message in transit only.
955990	961430	Given we are talking about radio data links here often over long distances there is potential for
961430	968070	garbled. You'll probably have noticed by now that all of the examples of message I've shown are
968070	973430	actually human readable and that's because there's no encryption of the data in standard ACOLs at all.
974150	980110	Some aircraft though do send encrypted messages and these are marked by the label type 44.
980590	985550	There is a really great paper called Economy Class Crypto from the Oxford Aviation Security
985550	990010	Group and they are able to decipher these messages through a combination of brute force
990010	996110	and other inputs such as knowing where an aircraft was at the time it transmitted the message.
996110	1000790	What they are able to show is that there is a static cipher key in use across all of these
1000790	1007310	terminals so its brick ones decode everywhere. Fortunately it seems that this data is mostly
1007310	1012450	engineering rather than anything sensitive but operators of this equipment should be aware their
1012450	1018950	messages are definitely not private. As ACOLs offers arbitrary text messaging and is often
1018950	1024810	made available through cabin crew terminals it's common to see company type data like our second
1024810	1030470	message here. Fortunately this particular operator seems to be aware of the limitations of ACOLs
1030470	1037310	privacy and hasn't used names here just seat numbers but not everyone is this careful.
1038990	1045590	Software and hardware on aircraft is written to design assurance levels. This is I suppose the
1045590	1050230	code quality and testing that goes into that particular component depending on the risks
1050230	1056810	that it poses to the aircraft. These hazard levels are documented in DO 178C.
1057450	1062110	Although we've seen that ACOLs is important for efficiency both in air traffic and maintenance
1062110	1066390	it doesn't directly impact on keeping an aircraft safe and airborne.
1066710	1072110	This means that generally ACOLs components are into C or D levels of assurance.
1073690	1079070	Let's step through them where ACOLs is used in different phases of flight. Airlines will provide
1079070	1083510	routes to the air pilots to help them in choosing a fuel efficient routine or avoiding forecast
1083510	1089510	weather, turbulence, icing and so on. The airline itself back at HQ will often calculate the
1089510	1096570	aircraft takeoff performance speeds like V1 and V rotate based on the number of passengers, bags,
1096570	1101150	cargo loaded and then send this directly to the aircraft for review and acceptance.
1101590	1106790	Pilots will often do their own numbers too as a cross check. As we mentioned briefly air traffic
1106790	1111850	control can provide departure clearances via ACOLs which will be added to the flight management
1111850	1117910	computer once they've been checked by the pilots. The aircraft then fly that particular set of way
1117910	1123870	points, heights and speeds after takeoff to minimize noise and improve efficiency of airspace.
1124430	1128970	The aircraft itself has a large number of sensors attached to things like doors, cargo hatches
1129590	1135070	and weight and wheel switches so we can work out what state it's in. This is then used to send our
1135070	1141270	out, off, on and in data back to the airline for paying our pilots not a penny more than they deserve.
1144030	1149730	Once in the flight the aircraft will continually be sending quite a lot of data back to the
1149730	1156310	airline's maintenance teams and often the aircraft or engine manufacturer too so they can try and
1156310	1161250	predict any maintenance needed. The aircraft will also immediately report things like a tail strike
1161250	1167650	or hard landing so the aircraft can be properly inspected at the next landing. During cruise air
1167650	1173050	traffic control will be using ACARS and CPDRC to ask the pilots to change course, routing or headings
1173050	1182710	as they need to keep everything safe and efficient. CPDRC uses AOA, so X-25 routing as we've seen.
1182890	1188950	The source and destination addresses are 24-bit IKO Mode S identifiers which are unique
1188950	1195410	per aircraft and are the same ones you can see in ADS-B transmissions like on flight radar 24.
1196210	1201970	Ground stations also have an identifier and in this message, although I've redacted the aircraft,
1203810	1209510	29D1D7 maps to London Stansted Airport. In this case this is an acknowledgement from the aircraft
1209510	1216030	to Stansted saying Wilco, which is short for will comply or I will do this. And this is different
1216030	1223010	to a simple acknowledgement with no expectation that they need to do anything. Just prior to landing
1223010	1229250	the aircraft will obtain ATIS data, Automatic Terminal Information Service, which gives data
1229250	1235730	on the runway in use, temperature, surface wind and so on. Traditionally this has been an audio broadcast
1235730	1240590	but by using ACARS this data can be obtained earlier and help the crew prepare for the right
1240590	1247650	runway in use. CPDRC is not used when immediate responses might be needed. Remember it has a
1247650	1253170	maximum of 30 seconds latency. So this is ended with arrivals and airport controller taking over
1253170	1259790	via VHF voice. The airline will also use this position info to help prepare the gate and ground
1259790	1264570	crew, turn the aircraft around as quickly as possible, obtain any maintenance reports, they can
1264570	1273620	change parts out and then also be informed which aircraft is on stand for payroll. So how can you
1273620	1277960	look at these kinds of transmissions? Well for plain old ACARS, although we have a larger number
1277960	1283700	of frequencies and two service providers, the frequencies are quite close together. So we can
1283700	1291320	use software defined radio like HACRF, RTL-SDR or even a digital TV tuner to receive them all in one
1291320	1299620	go. If you look on github you'll find ACARS deck by Thierry Lecomte for RTL-SDR or the port
1299620	1310440	of the port ACARS-SDR play by Jan Katwik for HACRF. For aerials it's VHF so you will need line of sight
1310440	1317340	to the ground station but you will see lots of aircraft if they fly over you. A telescopic one
1317340	1325700	will do just fine and it works okay just placed in my office window frankly. For AOA you'll need
1325700	1333180	Jumper VDL-2 by Tomasz Lemich. This doesn't have direct HACRF support but you can use it through
1333180	1341180	SOPI-SDR. You'll need two SDR devices to receive and decode POA and AOA at the same time though
1341180	1347960	obviously. Many people have these little tools running on a Raspberry Pi or similar for long-term
1347960	1354180	capture and indeed many people re-share with others out on the internet. You can use the plane
1354180	1360080	plotter and Windows software to capture the output of the tools and draw the locations of aircraft
1360080	1367020	from a map and so on. If you use the dash-in or dash-output HACRF's PP switches with the
1367020	1371900	destination of the machine where plane plotter is running, this is all you need to do to capture
1371900	1379420	these messages. Just a quick note on the legality of receiving and decoding these HACRF transmissions.
1379620	1385340	In true internet fashion I am definitely not a lawyer and I'm in the UK so here's my take based
1385340	1392540	on prior law, prosecution and where I live. There are still a fair number of pages, yes pages, in use
1392540	1400100	in the UK mostly amongst the emergency services. Pager POCSAG data transmissions are quite similar
1400100	1407540	serial data structures to HACRF's and are also really easily decoded with RTL-SDR. These generally contain
1407540	1413260	really horribly sensitive data like patient and medical information and these are directed to
1413260	1419380	specific recipients. So just because you can it doesn't make it legal to decode POCSAG
1419380	1426320	in the UK. Plane or HACRF's is different because all messages have to be sent to all stations
1426940	1431040	before they can decode them and then decide whether they are intended to be for them
1431040	1436700	based on the registration number of the aircraft. AOA on the other hand uses x25
1436700	1444060	and a specific terminal address for the recipient. But the legislation in the UK says you can pick up
1444060	1450140	weather and navigation transmissions which parts of HACRF's demonstrably are. So frankly who really
1450140	1455520	knows. I don't really want to be the test case though so I've redacted any example messages in
1455520	1460680	this talk and I've unfortunately decided not to do a live demo just in case something sensitive
1460680	1466080	pops up. But please check with your local jurisdiction before you start decoding these
1466080	1473000	messages though. So I want to leave you kind of with a little thought experiment for discussions
1473000	1480160	in the comments. HACRF's messages seem an awful lot like TCP sequence numbers. Could you predict the
1480160	1488000	next in the sequence? Could you send a valid HACRF's message? Could you send a valid CPDLC message?
1488220	1493940	And what if you actually did? We've noted that there's no encryption and no integrity checks
1493940	1500080	or integrity checks rather are based on a checksign. If we were designing the system today
1500620	1506280	would we implement encryption or message signing? Are there any potential problems if we do?
1508400	1513880	And my final thought. Although we can see and potentially send HACRF's transmissions around
1513880	1520100	there are always humans in the loop. We cannot take control and make an HACRF do things.
1520100	1525140	And even if we did there are a lot of other mitigation to stop aircraft coming into conflict
1525140	1531600	like air traffic controllers, their radar and systems like traffic collision avoidance system,
1531600	1538500	TCAS. Yes it's a legacy system and protocol but these are vulnerabilities on the part of ARINC,
1538500	1543280	Rockwell or CITER themselves. But we should keep in mind that when we're designing systems
1543280	1547480	and protocols how things can end up being used 40 years on.
1548700	1552380	Thanks for listening and I look forward to hearing your comments and thoughts.