1
00:00:05,290 --> 00:00:12,530
Hello and welcome to this talk on demonstrating ILS and TCAS spoofing attacks.

2
00:00:12,830 --> 00:00:22,930
My name is Alex, I'm an aerospace engineer, pilot and hacker at Pentest Partners in the UK and I lead up our aerospace work and research program.

3
00:00:23,190 --> 00:00:32,270
I've had the honor of working in all sorts of environments at PCP from government networks and consumer IoT through to planes, trains and automobiles.

4
00:00:32,670 --> 00:00:35,370
This is me on the left there flying.

5
00:00:35,870 --> 00:00:40,470
What I hope you might notice is that it's a pretty perfect ILS approach for later.

6
00:00:41,190 --> 00:00:56,690
So what we're going to be showing in this talk is to give some practical demonstrations of two kinds of radio frequency spoofing attack against two different types of cockpit instruments that are found in virtually every single commercial aircraft flying today.

7
00:00:57,690 --> 00:01:10,130
Harshad Shatia is giving a separate companion talk right after this one in the schedule and that goes into a lot more depth on the physics and practicalities involved in generating these types of spoofing.

8
00:01:10,130 --> 00:01:12,730
So you should definitely check out that too.

9
00:01:13,950 --> 00:01:20,170
Unfortunately though we're not going to be showing this against a real airframe as that would be super illegal.

10
00:01:20,670 --> 00:01:31,730
What we do have though is our Airbus A320 simulator at Pentest Partners and that does a pretty good job of being able to simulate the aircraft's flight characteristics and its avionics.

11
00:01:31,750 --> 00:01:40,130
It's the same flying model that's used in professional simulators but it's obviously not certified to the same standard.

12
00:01:40,390 --> 00:01:45,970
So we can emulate and test things against most major systems including ILS and TCAS.

13
00:01:46,750 --> 00:01:52,370
So TCAS is the traffic collision avoidance system and does pretty much what it says.

14
00:01:52,370 --> 00:02:03,770
It provides both audio and visual cues to a pilot about other aircraft or traffic that come within two protective bubbles the TA and RA regions.

15
00:02:03,990 --> 00:02:13,190
Traffic advisories are labelled orange and are aircraft that don't pose an immediate threat but might then become a resolution advisory.

16
00:02:13,310 --> 00:02:17,930
This means the pilot needs to take immediate action to avoid that conflict.

17
00:02:17,930 --> 00:02:24,510
The TCAS system will give these RAs in the form of climb or descent but never return.

18
00:02:24,510 --> 00:02:26,950
It's vertical movement only.

19
00:02:27,990 --> 00:02:41,850
Aircraft equipped with TCAS transponders and that's most passenger aircraft but not general aviation, you know, small things with propellers and will emit interrogation signals and listen for replies.

20
00:02:41,930 --> 00:02:48,410
And the transponders then use this time of flight to compute distance between aircraft many times a second.

21
00:02:48,670 --> 00:03:05,070
As not all aircraft are equipped with TCAS, a hybrid mode can use inputs from ADS-B and you might be familiar with that from services such as Flightradar24 and it uses this to add these other aircraft into the picture as well.

22
00:03:05,490 --> 00:03:22,230
Resolution advisories in theory must be obeyed over any air traffic control instructions and not doing so was the cause of the sad 2002 Uberlingan incident between a TU-154 and a DHL cargo flight.

23
00:03:22,550 --> 00:03:39,910
In busy airspace and Los Angeles is often cited as one such area, traffic alerts can become almost constant to the point that it can become a significant pilot workload and we've heard anecdotally that TCAS is sometimes turned off in such situations.

24
00:03:41,910 --> 00:03:56,750
In our EVA simulator with the autopilot engaged, the aircraft will actually fly resolution advisories automatically, moving away from a preset altitude and then returning to that after the conflict has passed.

25
00:03:57,110 --> 00:04:01,830
Now this is an aircraft and airline option and it's not always enabled however.

26
00:04:02,810 --> 00:04:11,130
So in the demonstration that follows we have the aircraft flying straight and level with a wall of spoofed aircraft coming directly towards us.

27
00:04:11,390 --> 00:04:19,070
The TCAS system will issue TAs then RAs and then take control to move us out of conflict if we do nothing.

28
00:04:22,640 --> 00:04:28,980
So we are just over 5,000 feet and our spoofed aircraft are introduced ahead of us.

29
00:04:29,020 --> 00:04:44,640
They turn from orange to red quite quickly on the right hand navigation display and the vertical speed strip on the left hand display now shows a red unsafe and a green safe band at the same time calling out to descend.

30
00:04:44,920 --> 00:04:52,220
Ideally the pilot would now pitch down to obtain that safe vertical speed of about 2,000 feet per minute.

31
00:04:53,320 --> 00:05:03,540
Choosing to ignore this, the aircraft will automatically take control and put the aircraft into a safe descent allowing our intruder aircraft to pass above us.

32
00:05:33,750 --> 00:05:41,310
Once we're clear of any conflict the aircraft will pitch back up, increase thrust and return us back to 5,000 feet.

33
00:05:43,900 --> 00:05:50,940
So our next system is the instrument landing system which provides lateral and vertical guidance to a pilot when approaching a runway.

34
00:05:51,380 --> 00:05:57,000
This is typically most useful in poor weather conditions but is often used even in clear and fine weather.

35
00:05:57,860 --> 00:06:08,720
So for a specific runway a VHF ILS frequency is given which includes both a glideslope, the vertical portion, and a localizer beam, the lateral.

36
00:06:09,100 --> 00:06:18,480
Each beam has two lobes at different frequencies and the receiver works out the signal strength of each and when each is the same that means you're in the center.

37
00:06:18,480 --> 00:06:23,720
It's a pretty simple and basic technology that's been around quite a long time.

38
00:06:24,140 --> 00:06:35,280
The pilot then centers some magenta bars on a display instrument or more likely the autopilot then follows them automatically and that will get you to the touchdown point of the runway.

39
00:06:36,380 --> 00:06:47,160
So our situation in the simulator is that we have selected and tuned to the ILS runway 28 right here at San Francisco and that's the red one marked here.

40
00:06:47,200 --> 00:07:07,560
We will initially be flying in cloud so we can't see the airport runway lights or ground but unknown to us the localizer signal is being spoofed from a location off to the left of our aircraft and what will happen is that we will pop out from the cloud at quite a low level and find ourselves nowhere near where we expect it to be.

41
00:07:11,690 --> 00:07:19,210
So the aircraft is established on the ILS for runway 28 right as we can see at the top of the right hand navigation display.

42
00:07:20,010 --> 00:07:30,550
The magenta pips on the left hand primary flight display are both centered horizontally and vertically so we believe ourselves to be flying down the correct path to the runway.

43
00:07:31,070 --> 00:07:37,330
In the bottom right we see the outside world as such it is but we're in cloud so of course it's just grey.

44
00:07:40,070 --> 00:07:43,730
We have selected flap and gear down at this point as well.

45
00:07:55,400 --> 00:08:03,980
At 400 feet the aircraft believes itself to be in landing mode and ground proximity and traffic alerts will be inhibited beyond this point.

46
00:08:06,390 --> 00:08:16,550
At 300 feet we break out of the cloud and find ourselves well left of the runway even though our instruments are still indicating we're on the center line.

47
00:08:17,210 --> 00:08:25,090
Now a pilot would go around and retry the landing if faced with this situation if they had sufficient visibility to make that decision.

48
00:08:33,000 --> 00:08:44,360
So I will leave Harshad to go into more of the detail in his talk but I personally feel that ILS spoofing is unlikely given you would need a pretty powerful antenna in very close proximity to the airport.

49
00:08:45,180 --> 00:08:49,620
This is likely to get you spotted by the police pretty quickly I would suggest.

50
00:08:49,860 --> 00:08:58,940
It's also fairly likely that the pilot would see intermittent nav error flags in their displays telling them the ILS system was unreliable.

51
00:08:59,460 --> 00:09:08,460
LTCAS, given it uses time of flight, would be more difficult to spoof unless you had some kind of drone floating around in the airspace.

52
00:09:08,640 --> 00:09:17,640
But ADS-B is relatively straightforward to generate from the ground and that might be enough of a distraction to lead pilots to switching off the system altogether.

53
00:09:18,980 --> 00:09:25,260
Please do watch Harshad's talk which goes into a much deeper dive on the theory and practicalities.

54
00:09:26,280 --> 00:09:32,760
And lastly, a special thank you to my colleague Phil Eberle who managed to get the simulated video at really short notice.

55
00:09:32,760 --> 00:09:34,120
So thanks Phil.

56
00:09:34,640 --> 00:09:38,940
Thank you for listening and I really look forward to hearing your comments and thoughts in the chat.