WEBVTT 00:05.920 --> 00:09.720 Hi everyone and welcome to this introduction to ACARS. 00:10.900 --> 00:19.620 I'm an aeronautical engineer, pilot and hacker at Pentest Partners in the UK and I lead our aerospace work and research program. 00:19.960 --> 00:28.440 I've had the honor of working in all sorts of environments from government networks and consumer IoT through to planes, trains and automobiles. 00:29.120 --> 00:38.660 What we're going to be talking about is an avionics system called ACARS, which is really just a way of sending text messages between ground and airborne stations. 00:39.280 --> 00:52.740 This is a light touch on the topic but I'll cover the history of it, how it's transmitted, what it's used for and current airline ops, how to decode and decipher it and explore where the potential security issues with it are. 00:53.060 --> 01:00.920 Really what ACARS is now is a data link and this has become really important in keeping up the efficiency and safety of modern aircraft. 01:02.600 --> 01:09.200 So the start of the jet age of commercial passenger flying in the 1960s, communication was pretty basic. 01:09.300 --> 01:12.400 It was voice only between aircraft and the ground. 01:12.660 --> 01:23.960 Airlines did, and still do, pay their flight crews by block time, which is the moment from the doors closing and the aircraft taxiing now to the moment the doors open again at the arrival gate. 01:24.140 --> 01:31.080 I think it's probably derived from when the ground crew pull the chocks or blocks out from the wheels to allow the aircraft to move. 01:31.500 --> 01:42.140 In the 1960s and 70s, crews would radio their off-block times to a human on the ground, who would transcribe that into a teletype machine and send that onto the airline's base. 01:42.380 --> 01:53.140 Remember that airlines routinely fly into airports where there's no direct representation of that airline on the ground, so some form of remote communication is needed back to HQ. 01:53.860 --> 01:58.660 Looking for efficiency, I guess a euphemism for not paying crews any more than they need to. 01:59.060 --> 02:07.280 ACARS was developed as a kind of automatic time clock system, sending the details of the out, off, on, and in times by radio. 02:07.800 --> 02:18.080 Because radio is line of sight only, ARINC, those who developed the standard, built out a network of ground-based transmitters to send, receive, and reload those messages around. 02:18.180 --> 02:21.540 And this whole concept hasn't really changed much to this day. 02:22.680 --> 02:24.840 So here we are today then. 02:25.120 --> 02:29.400 Plain old ACARS is broadly what it was back in 1978. 02:29.560 --> 02:34.500 It uses a VHF radio and a network of ground transmitters to send these messages around. 02:34.960 --> 02:42.460 A later evolution is ACARS over Aviation VHF Link Control, which is a terrible mashup of acronyms. 02:42.460 --> 02:44.180 IT being aerospace. 02:44.780 --> 02:51.260 This still uses a VHF line of sight radios, but on a different frequency to give a slightly higher bandwidth. 02:51.500 --> 03:01.530 For areas outside of direct ground contact, like over the Atlantic, High Frequency Data Link, HFTL, can also be used, but it's very slow. 03:02.300 --> 03:07.940 Nowadays we have SATCOM, which is increasingly the transmission mode of choice for many airlines and aircraft. 03:08.440 --> 03:18.460 There is some experimentation with using the cellular GSM networks as an ACARS platform too, but it's only in use for one European carrier, to my knowledge. 03:18.740 --> 03:24.200 There are several classes of load, I suppose you would call them, in the ACARS network. 03:24.260 --> 03:30.580 The aircraft themselves and ground stations like the airlines and air traffic control, as we'll see later. 03:30.860 --> 03:43.820 In order to route a message from an aircraft flying over, let's say Spain, back to the airline HQ in the UK, a Data Link Service Provider is paid to pick up, route, and deliver these messages. 03:44.320 --> 03:50.400 You have two Data Link Service Providers, DSPs, to choose from, CITA and Rockwell. 03:50.660 --> 03:59.880 Rockwell bought ARINC Inc., including the ACARS network, back in 2013, so you might see ARINC slash Rockwell used interchangeably. 04:01.780 --> 04:10.720 So as we've said, the original plain old ACARS, and ACARS over ABLC, used VHF radios, so a new direct line of sight. 04:10.800 --> 04:14.580 And that includes the earth being round, of course, to a ground station. 04:14.940 --> 04:22.420 Aircraft are often flying pretty high up, 35,000 feet or more, so actually the range of a single transmitter is still quite large. 04:22.540 --> 04:33.040 But you can see from CITA's coverage map here, there are lots of gaps over oceans, Africa, and places aircraft tend not to fly very much, like northern Canada. 04:33.660 --> 04:39.180 Running all of these transmitters and maintaining the communications links between them is pretty expensive. 04:39.920 --> 04:44.740 Satellite coverage is also dependent on where you are in the world, although to a lesser degree. 04:45.020 --> 04:55.860 InMarsat have coverage between plus and minus 80 degrees latitude, although Iridium have more lower satellites and can offer polar coverage too. 04:56.040 --> 05:00.360 There are only 15 high frequency transmitters in the world. 05:00.360 --> 05:04.560 They have long reach and are located for polar and oceanic coverage. 05:04.920 --> 05:13.860 The costs are a bit opaque, but one Asian carrier was paying the equivalent of a thousand dollars per megabyte on their HF service. 05:14.380 --> 05:25.960 AOA and POA are still not home broadband prices though, and there is a bit of an old adage in that for aviation you add another zero onto the end of what seems a reasonable price for anything. 05:27.360 --> 05:39.320 Original ACARS uses a signal with each bit encoded as a half bit sine wave on top of the carrier, which you can see in this nice waterfall image that most software-defined radio signals will generate for you. 05:39.640 --> 05:48.680 The modem will briefly listen to avoid transmitting at the same time as others and send a starting tone and then the serial data. 05:48.700 --> 05:53.070 And you can hear this as a fairly distinctive old-school style modem noise. 05:54.800 --> 05:59.990 As is VHF, a line-of-sight, each geographic region uses a different frequency. 06:00.360 --> 06:03.580 And this is per data link service provider as well. 06:03.580 --> 06:10.040 So ARINC, Rockwell, in Europe is a different frequency to CITER in Europe. 06:10.200 --> 06:15.920 And the aircraft's modem will usually automatically switch frequencies between them based on its known position. 06:17.200 --> 06:27.360 VHF Data Link 2, so AI, is an enhancement that uses phase shift keying modulation to give a slightly higher bandwidth throughput. 06:27.620 --> 06:33.260 It also uses the X25 routing protocol to send messages between data terminals. 06:33.500 --> 06:43.060 And I guess this sort of matches up with the lowest three layers of the OSI model, but this X25 predates TCPIP by some considerable time. 06:43.100 --> 06:53.360 Because of the use of X25, there is a global single frequency, but as with planar ACARS, it's VHF and so still line-of-sight. 06:55.560 --> 07:05.360 So several satellite communication service providers offer ACARS, including Inmarsat and Iridium, both have global coverage. 07:05.360 --> 07:13.360 But as Inmarsat has geostationary satellites, there is no reception between plus and minus 80 degrees latitude, as we can see in their coverage map. 07:13.540 --> 07:20.500 Iridium has a larger constellation of lower flying birds to give complete coverage even over polar regions. 07:20.760 --> 07:29.080 There are different bandwidth and frequency options and services from each provider, but certain frequencies are better at penetrating water. 07:29.360 --> 07:38.240 Although aircraft tend to fly above clouds and weather, and this is not usually a problem, but in the tropics, humid air can block signals. 07:38.500 --> 07:51.760 It is possible to intercept ground-to-air, that is ground-to-satellite-to-aircraft communications using a suitable antenna and software, as a signal is transmitted to the ground over a wide area. 07:51.760 --> 07:59.320 But you will not be able to see aircraft to ground, as you're not in a middle position unless you're in space. 07:59.620 --> 08:05.820 The data is relayed from the ground stations back into the DSP networks and then on to its destination. 08:06.640 --> 08:27.240 Classic aero services are quite bandwidth-limited, but we've probably all been on aircraft with in-flight Wi-Fi by now, so SATCOM program actually can be quite decent, and it's this latter capability that is now being used in modern E&A aircraft to collect huge amounts of live data for analysis and predictive maintenance. 08:28.640 --> 08:37.540 There are also options to transmit ACARS over long-wave, high-frequency transmitters, and this is reserved for oceanic and polar regions. 08:37.540 --> 08:46.440 There are actually only 15 transmitter sites and speeds are incredibly slow, and this probably also explains the very high costs of using these services. 08:48.580 --> 08:53.740 There is an early test of using the CELIN networks to provide ACARS services in Europe. 08:53.740 --> 09:03.440 This actually uses a piece of equipment found on many aircraft already, which is a wireless quick access recorder or wireless digital flight data acquisition unit. 09:03.580 --> 09:11.060 These devices capture lots of data in flight and then relay it back to the airline once they're on the ground over a 3G network. 09:11.520 --> 09:17.080 This same unit can be upgraded to provide a wireless link and route ACARS over that instead. 09:19.490 --> 09:30.650 Aircraft will often maintain multiple communication links, and for a transatlantic flight an aircraft may actually have and use all three options at various stages of the flight. 09:30.970 --> 09:39.590 A communications management unit, CMU, is used to route ACARS traffic between the various avionics systems and these physical links. 09:39.950 --> 09:45.970 An airline may also change the cost preferences depending on how much they pay for various services. 09:46.570 --> 10:01.890 This CMU has access to lots of important avionics including display unit the pilot interacts with, the flight management computer for reporting location, and for setting height or heading as we'll see later, and for acquiring lots of maintenance data. 10:02.150 --> 10:05.970 And believe it or not there are actual genuine printers on the flight deck too. 10:08.250 --> 10:10.810 A brief segue on to cell call. 10:11.370 --> 10:31.010 During transatlantic or polar flights where radio communication is intermittent and to avoid crews from having to monitor radios for a long period, cell call was introduced where the air traffic controller can trigger an alert light or sound or both in the cockpit and the crew then jump on the radio to listen for the actual message. 10:31.470 --> 10:42.670 Each aircraft is assigned a four-digit code and the first pair of letters sent as a tone and then the second, which I guess is a bit like DTMF dialing tones. 10:43.170 --> 10:52.490 As you can see there aren't that many possible combinations so there is reuse and it's really important that crews verify the transmission was really meant for them. 10:53.790 --> 11:03.490 Similarly now when there is an ACARS message the crew will hear a chime noise and a data link message will appear on the displays which they can then go and read. 11:05.470 --> 11:13.090 ACARS at its basis is simply a text message service between two parties and this concept is now being used in air traffic control. 11:13.410 --> 11:19.770 Rather than a controller using voice radios to instruct pilots on what to do this is sent by a ACARS message. 11:19.910 --> 11:32.010 This has the benefits of efficiency which means more aircraft can be accommodated in a given space but also safety you know there is no confusion in hearing about what altitude to fly to or heading etc. 11:32.710 --> 11:40.790 Both Boeing and Airbus developed their own standards but these were merged and gave rise to the FANS 1A standard as we have today. 11:41.450 --> 11:47.070 A FANS installation on aircraft requires certification and a minimum latency requirement. 11:47.070 --> 11:53.030 Messages will be automatically rejected after 30 seconds if no confirmation is made. 11:53.470 --> 12:01.450 FANS is comprised of two important services which are both sent over ACARS and that could be either VHF or SATCOM. 12:01.470 --> 12:09.710 Controller Pilot Data Link Communication CPDLC and Automatic Dependent Surveillance Contract ADSC. 12:11.850 --> 12:19.630 So for CPDLC, air traffic can send pilots instructions to climb to a particular altitude or steer a heading. 12:19.650 --> 12:26.250 Before this can happen, pilots log on to a specific controller which then shows that the data link is ready. 12:26.430 --> 12:31.870 Every instruction sent by ATC requires a positive confirmation by the pilot. 12:31.990 --> 12:35.310 You cannot simply send a message and remote control your plane. 12:36.030 --> 12:40.010 Different regions still have different CPDLC adoption levels. 12:40.150 --> 12:46.350 So Europe has on-route services whereas parts of the USA only have pre-departure at airports. 12:46.890 --> 12:58.230 And this latter is really useful because if you've ever had to note down and read back a complicated departure clearance, you'll realize how useful this is in not only time saving but in making sure it's correct. 12:59.810 --> 13:10.870 You might be familiar with ADS-B which is the position notification signal sent out on 1090 megahertz which contains GPS position and altitude. 13:10.930 --> 13:17.430 And this is picked up by services like Flight Radar 24 and ADS-B Exchange. 13:17.650 --> 13:22.590 These are periodically sent out by the aircraft when it's illuminated by primary radar. 13:22.850 --> 13:26.450 But for fans, we need more granularity and information. 13:26.550 --> 13:29.670 So ADSC is used instead. 13:30.330 --> 13:38.190 Air traffic can request an aircraft report its position or time when passing a certain altitude or a given waypoint. 13:38.530 --> 13:43.570 ADSC will also show what waypoints the aircraft is currently programmed to fly to. 13:44.170 --> 13:50.450 So controllers can better understand and more efficiently sequence traffic for arrivals into busy airports. 13:50.970 --> 13:58.290 So now we know that more ACARS is useful in broad terms, let's have a closer look at how the messages are formatted. 13:58.550 --> 14:06.070 In plain old ACARS, all messages are broadcast to all devices, or those that are in range of the same transmitter at least. 14:06.070 --> 14:10.110 So there is a header that lists the destination aircraft registration. 14:10.610 --> 14:15.330 The receiver on an aircraft will discard any messages that are not destined for it. 14:15.970 --> 14:23.750 In the header, there is a two-character label field which indicates the type of data that the whole message contains. 14:23.750 --> 14:37.030 There's no specific standard but there are some common ones like C1 which is a message for the onboard printer and indeed some airlines will use different labels to indicate the same types of data. 14:38.070 --> 14:44.430 The bulk of the transmission is taken up by the message text itself up to a maximum of 220 characters. 14:44.850 --> 14:50.950 The character set is basic ASCII alphanumerics and some special characters only and no unicode. 14:51.130 --> 15:00.750 These could just be standard free text type messages or they could be engineering and maintenance data and frankly more often than not it's the latter and are quite dull as a result. 15:01.950 --> 15:10.150 Sequential messages are sent with an incrementing number in the header so C01, C02 for example. 15:10.430 --> 15:23.010 Because of the 220 character limit, larger messages like our maintenance data can be split across multiple ACOLs transmissions or with a letter suffix to note their position in the multi-part message. 15:23.010 --> 15:27.570 So for example U10A, U10B, U10C etc. 15:27.830 --> 15:33.370 The next separate message from this particular aircraft would then be U11A and so on. 15:34.570 --> 15:43.590 The last part of the message is a simple checksum either ATM32 which is a modified form of Fletcher's checksum or a CRC. 15:43.590 --> 15:50.350 The CDU on an aircraft will discard any message without a valid checksum and ask for a retransmit if possible. 15:50.770 --> 15:55.710 The checksum is designed to protect against distortion of the message in transit only. 15:55.990 --> 16:02.590 Given we are talking about radio data links here often over long distances there is potential for garbled. 16:03.950 --> 16:13.430 You'll probably have noticed by now that all of the examples of message I've shown are actually human readable and that's because there's no encryption of the data in standard ACOLs at all. 16:14.150 --> 16:20.110 Some aircraft though do send encrypted messages and these are marked by the label type 44. 16:20.590 --> 16:36.110 There is a really great paper called Economy Class Crypto from the Oxford Aviation Security Group and they are able to decipher these messages through a combination of brute force and other inputs such as knowing where an aircraft was at the time it transmitted the message. 16:36.110 --> 16:45.090 What they are able to show is that there is a static cipher key in use across all of these terminals so its brick ones decode everywhere. 16:45.330 --> 16:54.850 Fortunately it seems that this data is mostly engineering rather than anything sensitive but operators of this equipment should be aware their messages are definitely not private. 16:55.550 --> 17:06.050 As ACOLs offers arbitrary text messaging and is often made available through cabin crew terminals it's common to see company type data like our second message here. 17:06.250 --> 17:17.310 Fortunately this particular operator seems to be aware of the limitations of ACOLs privacy and hasn't used names here just seat numbers but not everyone is this careful. 17:18.990 --> 17:24.230 Software and hardware on aircraft is written to design assurance levels. 17:24.230 --> 17:32.350 This is I suppose the code quality and testing that goes into that particular component depending on the risks that it poses to the aircraft. 17:32.610 --> 17:36.810 These hazard levels are documented in DO 178C. 17:37.450 --> 17:46.390 Although we've seen that ACOLs is important for efficiency both in air traffic and maintenance it doesn't directly impact on keeping an aircraft safe and airborne. 17:46.710 --> 17:52.110 This means that generally ACOLs components are into C or D levels of assurance. 17:53.690 --> 17:57.670 Let's step through them where ACOLs is used in different phases of flight. 17:58.190 --> 18:06.190 Airlines will provide routes to the air pilots to help them in choosing a fuel efficient routine or avoiding forecast weather, turbulence, icing and so on. 18:06.250 --> 18:21.150 The airline itself back at HQ will often calculate the aircraft takeoff performance speeds like V1 and V rotate based on the number of passengers, bags, cargo loaded and then send this directly to the aircraft for review and acceptance. 18:21.590 --> 18:24.470 Pilots will often do their own numbers too as a cross check. 18:24.830 --> 18:35.090 As we mentioned briefly air traffic control can provide departure clearances via ACOLs which will be added to the flight management computer once they've been checked by the pilots. 18:35.410 --> 18:43.870 The aircraft then fly that particular set of way points, heights and speeds after takeoff to minimize noise and improve efficiency of airspace. 18:44.430 --> 18:53.650 The aircraft itself has a large number of sensors attached to things like doors, cargo hatches and weight and wheel switches so we can work out what state it's in. 18:53.750 --> 19:01.270 This is then used to send our out, off, on and in data back to the airline for paying our pilots not a penny more than they deserve. 19:04.030 --> 19:18.150 Once in the flight the aircraft will continually be sending quite a lot of data back to the airline's maintenance teams and often the aircraft or engine manufacturer too so they can try and predict any maintenance needed. 19:18.290 --> 19:26.050 The aircraft will also immediately report things like a tail strike or hard landing so the aircraft can be properly inspected at the next landing. 19:26.510 --> 19:35.590 During cruise air traffic control will be using ACARS and CPDRC to ask the pilots to change course, routing or headings as they need to keep everything safe and efficient. 19:37.470 --> 19:42.710 CPDRC uses AOA, so X-25 routing as we've seen. 19:42.890 --> 19:55.410 The source and destination addresses are 24-bit IKO Mode S identifiers which are unique per aircraft and are the same ones you can see in ADS-B transmissions like on flight radar 24. 19:56.210 --> 20:07.190 Ground stations also have an identifier and in this message, although I've redacted the aircraft, 29D1D7 maps to London Stansted Airport. 20:07.450 --> 20:15.190 In this case this is an acknowledgement from the aircraft to Stansted saying Wilco, which is short for will comply or I will do this. 20:15.230 --> 20:20.870 And this is different to a simple acknowledgement with no expectation that they need to do anything. 20:21.450 --> 20:33.450 Just prior to landing the aircraft will obtain ATIS data, Automatic Terminal Information Service, which gives data on the runway in use, temperature, surface wind and so on. 20:33.470 --> 20:42.070 Traditionally this has been an audio broadcast but by using ACARS this data can be obtained earlier and help the crew prepare for the right runway in use. 20:42.410 --> 20:46.510 CPDRC is not used when immediate responses might be needed. 20:46.530 --> 20:49.370 Remember it has a maximum of 30 seconds latency. 20:49.690 --> 20:55.410 So this is ended with arrivals and airport controller taking over via VHF voice. 20:55.990 --> 21:09.870 The airline will also use this position info to help prepare the gate and ground crew, turn the aircraft around as quickly as possible, obtain any maintenance reports, they can change parts out and then also be informed which aircraft is on stand for payroll. 21:12.440 --> 21:15.200 So how can you look at these kinds of transmissions? 21:15.200 --> 21:23.060 Well for plain old ACARS, although we have a larger number of frequencies and two service providers, the frequencies are quite close together. 21:23.060 --> 21:32.200 So we can use software defined radio like HACRF, RTL-SDR or even a digital TV tuner to receive them all in one go. 21:32.200 --> 21:46.540 If you look on github you'll find ACARS deck by Thierry Lecomte for RTL-SDR or the port of the port ACARS-SDR play by Jan Katwik for HACRF. 21:46.540 --> 21:55.940 For aerials it's VHF so you will need line of sight to the ground station but you will see lots of aircraft if they fly over you. 21:56.280 --> 22:02.360 A telescopic one will do just fine and it works okay just placed in my office window frankly. 22:03.460 --> 22:09.000 For AOA you'll need Jumper VDL-2 by Tomasz Lemich. 22:09.000 --> 22:14.780 This doesn't have direct HACRF support but you can use it through SOPI-SDR. 22:15.860 --> 22:22.220 You'll need two SDR devices to receive and decode POA and AOA at the same time though obviously. 22:23.700 --> 22:32.620 Many people have these little tools running on a Raspberry Pi or similar for long-term capture and indeed many people re-share with others out on the internet. 22:33.020 --> 22:41.720 You can use the plane plotter and Windows software to capture the output of the tools and draw the locations of aircraft from a map and so on. 22:42.060 --> 22:53.060 If you use the dash-in or dash-output HACRF's PP switches with the destination of the machine where plane plotter is running, this is all you need to do to capture these messages. 22:54.020 --> 22:59.420 Just a quick note on the legality of receiving and decoding these HACRF transmissions. 22:59.620 --> 23:08.200 In true internet fashion I am definitely not a lawyer and I'm in the UK so here's my take based on prior law, prosecution and where I live. 23:08.580 --> 23:16.600 There are still a fair number of pages, yes pages, in use in the UK mostly amongst the emergency services. 23:16.740 --> 23:26.200 Pager POCSAG data transmissions are quite similar serial data structures to HACRF's and are also really easily decoded with RTL-SDR. 23:26.520 --> 23:35.540 These generally contain really horribly sensitive data like patient and medical information and these are directed to specific recipients. 23:35.660 --> 23:40.740 So just because you can it doesn't make it legal to decode POCSAG in the UK. 23:41.500 --> 23:53.800 Plane or HACRF's is different because all messages have to be sent to all stations before they can decode them and then decide whether they are intended to be for them based on the registration number of the aircraft. 23:54.660 --> 24:00.140 AOA on the other hand uses x25 and a specific terminal address for the recipient. 24:01.100 --> 24:09.180 But the legislation in the UK says you can pick up weather and navigation transmissions which parts of HACRF's demonstrably are. 24:09.200 --> 24:11.060 So frankly who really knows. 24:11.140 --> 24:21.880 I don't really want to be the test case though so I've redacted any example messages in this talk and I've unfortunately decided not to do a live demo just in case something sensitive pops up. 24:22.080 --> 24:27.360 But please check with your local jurisdiction before you start decoding these messages though. 24:28.020 --> 24:34.420 So I want to leave you kind of with a little thought experiment for discussions in the comments. 24:35.080 --> 24:39.200 HACRF's messages seem an awful lot like TCP sequence numbers. 24:39.280 --> 24:41.840 Could you predict the next in the sequence? 24:42.120 --> 24:44.800 Could you send a valid HACRF's message? 24:44.800 --> 24:48.000 Could you send a valid CPDLC message? 24:48.220 --> 24:50.300 And what if you actually did? 24:50.680 --> 24:57.800 We've noted that there's no encryption and no integrity checks or integrity checks rather are based on a checksign. 24:57.820 --> 25:03.420 If we were designing the system today would we implement encryption or message signing? 25:03.420 --> 25:06.280 Are there any potential problems if we do? 25:08.400 --> 25:10.040 And my final thought. 25:10.080 --> 25:16.220 Although we can see and potentially send HACRF's transmissions around there are always humans in the loop. 25:16.220 --> 25:20.100 We cannot take control and make an HACRF do things. 25:20.100 --> 25:32.660 And even if we did there are a lot of other mitigation to stop aircraft coming into conflict like air traffic controllers, their radar and systems like traffic collision avoidance system, TCAS. 25:32.880 --> 25:40.860 Yes it's a legacy system and protocol but these are vulnerabilities on the part of ARINC, Rockwell or CITER themselves. 25:40.860 --> 25:47.480 But we should keep in mind that when we're designing systems and protocols how things can end up being used 40 years on. 25:48.700 --> 25:52.380 Thanks for listening and I look forward to hearing your comments and thoughts.