start	end	text
5290	12530	Hello and welcome to this talk on demonstrating ILS and TCAS spoofing attacks.
12830	18470	My name is Alex, I'm an aerospace engineer, pilot and hacker at Pentest Partners in the UK
19030	24830	and I lead up our aerospace work and research program. I've had the honor of working in all
24830	30810	sorts of environments at PCP from government networks and consumer IoT through to planes,
30810	37290	trains and automobiles. This is me on the left there flying. What I hope you might notice is
37290	43010	that it's a pretty perfect ILS approach for later. So what we're going to be showing
43850	47810	in this talk is to give some practical demonstrations of two kinds of radio
47810	52450	frequency spoofing attack against two different types of cockpit instruments
52450	56690	that are found in virtually every single commercial aircraft flying today.
57690	62550	Harshad Shatia is giving a separate companion talk right after this one in the schedule
63230	67330	and that goes into a lot more depth on the physics and practicalities involved
67330	72730	in generating these types of spoofing. So you should definitely check out that too.
73950	78610	Unfortunately though we're not going to be showing this against a real airframe as that would be
78610	86170	super illegal. What we do have though is our Airbus A320 simulator at Pentest Partners and that does
86250	91730	a pretty good job of being able to simulate the aircraft's flight characteristics and its avionics.
91750	97630	It's the same flying model that's used in professional simulators but it's obviously
97630	102950	not certified to the same standard. So we can emulate and test things against most major
102950	110810	systems including ILS and TCAS. So TCAS is the traffic collision avoidance system and does pretty
110810	116430	much what it says. It provides both audio and visual cues to a pilot about other aircraft
116430	125030	or traffic that come within two protective bubbles the TA and RA regions. Traffic advisories
125030	131170	are labelled orange and are aircraft that don't pose an immediate threat but might then become
131490	137930	a resolution advisory. This means the pilot needs to take immediate action to avoid that conflict.
137930	145230	The TCAS system will give these RAs in the form of climb or descent but never return. It's vertical
145230	152630	movement only. Aircraft equipped with TCAS transponders and that's most passenger aircraft
153110	159330	but not general aviation, you know, small things with propellers and will emit interrogation signals
159330	165690	and listen for replies. And the transponders then use this time of flight to compute distance between
165690	173050	aircraft many times a second. As not all aircraft are equipped with TCAS, a hybrid mode can use
173050	179150	inputs from ADS-B and you might be familiar with that from services such as Flightradar24
179830	185070	and it uses this to add these other aircraft into the picture as well.
185490	191330	Resolution advisories in theory must be obeyed over any air traffic control instructions
192070	199150	and not doing so was the cause of the sad 2002 Uberlingan incident between a TU-154
199150	207350	and a DHL cargo flight. In busy airspace and Los Angeles is often cited as one such area,
207810	213810	traffic alerts can become almost constant to the point that it can become a significant pilot
213810	219910	workload and we've heard anecdotally that TCAS is sometimes turned off in such situations.
221910	228290	In our EVA simulator with the autopilot engaged, the aircraft will actually fly resolution
228290	234470	advisories automatically, moving away from a preset altitude and then returning to that
234470	240370	after the conflict has passed. Now this is an aircraft and airline option and it's not always
240370	246350	enabled however. So in the demonstration that follows we have the aircraft flying straight and
246350	252770	level with a wall of spoofed aircraft coming directly towards us. The TCAS system will issue
252770	259070	TAs then RAs and then take control to move us out of conflict if we do nothing.
262640	268980	So we are just over 5,000 feet and our spoofed aircraft are introduced ahead of us.
269020	275220	They turn from orange to red quite quickly on the right hand navigation display and the vertical
275220	282900	speed strip on the left hand display now shows a red unsafe and a green safe band at the same time
282900	289200	calling out to descend. Ideally the pilot would now pitch down to obtain that safe vertical speed
289200	297480	of about 2,000 feet per minute. Choosing to ignore this, the aircraft will automatically take control
297480	303540	and put the aircraft into a safe descent allowing our intruder aircraft to pass above us.
333750	337970	Once we're clear of any conflict the aircraft will pitch back up,
337970	346440	increase thrust and return us back to 5,000 feet. So our next system is the instrument landing system
346440	350940	which provides lateral and vertical guidance to a pilot when approaching a runway.
351380	355880	This is typically most useful in poor weather conditions but is often used even in clear and
355880	363580	fine weather. So for a specific runway a VHF ILS frequency is given which includes both a
363580	371040	glideslope, the vertical portion, and a localizer beam, the lateral. Each beam has two lobes at
371040	376520	different frequencies and the receiver works out the signal strength of each and when each is the
376520	382080	same that means you're in the center. It's a pretty simple and basic technology that's been around
382080	388660	quite a long time. The pilot then centers some magenta bars on a display instrument or more
388660	393440	likely the autopilot then follows them automatically and that will get you to the
393440	400360	touchdown point of the runway. So our situation in the simulator is that we have selected and tuned
400360	407860	to the ILS runway 28 right here at San Francisco and that's the red one marked here. We will
407860	414080	initially be flying in cloud so we can't see the airport runway lights or ground but unknown to us
414080	420140	the localizer signal is being spoofed from a location off to the left of our aircraft and what
420140	425620	will happen is that we will pop out from the cloud at quite a low level and find ourselves nowhere
425620	435870	near where we expect it to be. So the aircraft is established on the ILS for runway 28 right as we
435870	442390	can see at the top of the right hand navigation display. The magenta pips on the left hand primary
442390	448010	flight display are both centered horizontally and vertically so we believe ourselves to be
448010	453470	flying down the correct path to the runway. In the bottom right we see the outside world
453470	462390	as such it is but we're in cloud so of course it's just grey. We have selected flap and gear down at
462390	479960	this point as well. At 400 feet the aircraft believes itself to be in landing mode and ground
479960	489010	proximity and traffic alerts will be inhibited beyond this point. At 300 feet we break out of
489010	494030	the cloud and find ourselves well left of the runway even though our instruments are still
494030	500570	indicating we're on the center line. Now a pilot would go around and retry the landing if faced
500570	513940	with this situation if they had sufficient visibility to make that decision. So I will
513940	518620	leave Harshad to go into more of the detail in his talk but I personally feel that ILS spoofing
518620	524360	is unlikely given you would need a pretty powerful antenna in very close proximity to the airport.
525180	530800	This is likely to get you spotted by the police pretty quickly I would suggest. It's also fairly
530800	536820	likely that the pilot would see intermittent nav error flags in their displays telling them the ILS
536820	544640	system was unreliable. LTCAS, given it uses time of flight, would be more difficult to spoof unless
544640	550980	you had some kind of drone floating around in the airspace. But ADS-B is relatively straightforward
550980	555880	to generate from the ground and that might be enough of a distraction to lead pilots to switching
555880	563100	off the system altogether. Please do watch Harshad's talk which goes into a much deeper dive
563100	569240	on the theory and practicalities. And lastly, a special thank you to my colleague Phil Eberle
569240	574120	who managed to get the simulated video at really short notice. So thanks Phil.
574640	578940	Thank you for listening and I really look forward to hearing your comments and thoughts in the chat.