We are in the aerospace village at DEFCON 30 and this is a really hard thing to miss.
Can you tell me what this is? Obviously it's an airplane, but like, what am I looking at?
So we brought our Airbus A320 simulator with us.
It comes in this little custom flight case and it's shipped out here to DEFCON.
DEFCON kindly gave us the screens to save us the wait.
But yeah, it's an Airbus A320 cockpit. It's exactly life-size.
It's exactly as you would find on an aircraft.
And is the goal to learn how to fly? Is it to hack away? Is it to plug in dumb firmware?
What's the purpose?
So we brought some electronic flight bag vulnerabilities.
Electronic flight bags are used by commercial pilots to work out how long a runway they need to take off,
what settings they need on the aircraft.
So we brought it to demonstrate that, but frankly we've had such a huge queue
that people just want to do some landings and stuff.
So it's been really good fun to see people get involved and do that.
That's awesome. So in that case, I want to keep hearing about it, but I also want to fly it.
So can you show me how to fly this thing?
Yep, let's get in and have a fly.
Excellent.
So I sit here?
Yep.
Right, give me two seconds.
But at the same time, I'm afraid that I'm totally going to break something.
You think when you look at these buttons, you'd expect to recognize any of them?
Like an on-off or an AC switch?
Well, interestingly, there's no keys on an aircraft.
If you think about it, there's no keys for the doors.
There's no ignition key or anything like that.
That's hilarious. I guess, yeah, I never really thought about that.
But starting it from cold and dark is actually quite difficult.
So yeah, unless you know what you're doing.
It's funny, I'm looking at some of these like ROSE, LS, VOR, NAV, ARC, PLAN.
Some acronyms you intend to make some sense of, but I can't make sense of any of this.
I know obviously radio, but can you walk me through just some of this?
And I'm guessing that's part of the simulation too.
Sure. So I think that's one of the challenges, and one of the things that Aerospace Village does really well
is that where you've got IT language and you've got aerospace language, they're really difficult.
Everyone uses lots of acronyms and you bring the two together and it's something like a complete nightmare.
So that's part of what we're doing is to speak through this.
So the top is the glare shield and this is the aircraft autopilot settings.
This is pretty much how 95% of the time a pilot would fly the aircraft.
So they would be given a speed or a heading or an altitude to fly out by air traffic.
And they will just change these so the aircraft will then fly itself.
In front of you, you've got your primary flight display and your navigation display.
So again, this is pretty much where the pilot, when they're hand flying, is going to be looking.
So your artificial horizon, blue is sky, brown is ground.
And you've got your speed and your altitude and other things on there as well.
This is the ECAM. So this is to do with monitoring the aircraft.
So this is our engine performance, our wheels currently.
We can bring up fuel information, electrical, hydraulics, all that kind of stuff.
So all these buttons are what kind of brings me through these other screens.
As a quick question, I see that I have two of these screens.
Are these duplicate, like redundant, or is one showing different?
So unfortunately, US Customs broke our other monitors.
So I would have one in front of me as well.
But yeah, each pilot, the co-pilot, would have their own screens.
They can actually change what's on them independently.
This is the standby instrument.
So if we lose all power, all engines, this will still work.
So we'll still fly. You've got the same kind of information.
The very basic information you need to fly the aircraft on that.
Okay, so we covered this one, we covered switching.
This is radio nav, it looks like.
Yeah, so pretty much, actually, this is how you program an aircraft.
It's called the MCDU. It does a variety of different things.
So we can bring up how we would configure our flight plans.
If we want to, as we're about to do now, follow a particular radio beacon to an aircraft, that's how we would configure it.
But the MCDU, it's a multi-configuration display unit.
So interfaces with lots of different things.
And this is how you would fly.
So each, the pilot and co-pilot, will have their own.
And they will have different settings on there at different phases of the flight.
Can you run me through some of these other ones, too?
Oh, yeah. So we've got radios on both sides.
Again, for redundancy, there's one for each side.
We've got how you would want to interact with the radios, because you can actually have three VHF radios, a HF radio, a variety of things on here.
You actually have the active frequencies of the people that we're talking to currently.
And we often kind of know who we're going to speak to next.
So we would configure up the standby, and then you can just use the button to switch.
Okay.
So when you leave an airport, for example, you take off, you'll be speaking to the ground or whatever, but then there'll be a departure frequency.
So we'll have that set up, and then they'll tell us to, as we've taken off, contact departures, push the button, and then we can contact them straight away.
Now, so much of this, obviously, is pre-programmed and things like that.
Is any of this networked, like connected in a way where an external entity can connect into it, or is it closed loop?
Well, not so much. So aircraft are split into three domains, a bit like DMZs.
You've got a flight services domain, and that is anything that is critical to flight, and that's pretty much isolated.
You've got a passenger domain, people at the back, we don't trust them at all.
So they can connect to Wi-Fi, they can look at the IFE, but that's pretty much segregated away.
You've got an intermediate information services domain, and that's stuff that's nice to have, but if it stops working, then the aircraft isn't going to pull out the sky.
So a lot of the attacks, which you had mentioned, the vulnerabilities, which are a little too busy where everyone just wants to fly it,
those vulnerabilities, the way you would attack those would be physical, like plugging a console port in or plugging into the system.
Yeah, so there are maintenance terminals and things in the cockpit, but for commercial air transport anyway, everything is physically secured.
There's an armored bulletproof door, things at airside at an airport.
So the things that we're interested in are the electronic flight bags, the iPads that the pilots take home with them.
And we know from speaking to pilots that they often give them to their kids to watch Netflix on.
So it's the hardening of the flight bags that are the issue that we face.
And if someone is able to tamper with the way that these apps create this performance data, then that's the issue that you can get.
So the pilot has an iPad, brings it home, someone malicious grabs it, edits it, then they bring it back.
Does that get plugged in somehow or they're not supposed to?
Typically, they're not plugged into the aircraft, but they use them to calculate performance data, which is then used by the aircraft.
So if I can modify that information that they get out. Also, a lot of pilots, they stay at the same hotels, they lay over exactly the same places.
You have to update the data on your iPad every four weeks around an ARAC cycle.
So if I know where you are, I know you're on a dodgy hotel Wi-Fi and you've got to update your iPad.
Then there's an opportunity there to sit in the middle and modify that data.
So the piece I'm missing is you've modified the data, they bring it into the cockpit.
Do they manually look at that data and then input it or is there like they plug it in and it uploads it?
Yeah. So currently, most aircraft, it would be a manual entry.
So they would calculate those speed speeds, then they would go into the MCBU and they would configure those speeds on the aircraft or the FLEXSTEM.
However, we're starting to see connections from portable EFVs into the aircraft.
The idea is that you reduce the risk of transposition error because you can just downlink it straight into the flight management system.
But obviously, there's now an increased risk that we can start to push data onto the FMS because there is some connectivity.
You still have to accept it. I can't just push it and then have the aircraft do something.
A human still has to review what has arrived on the MCBU and then accept it.
I'd imagine there's a whole other level also of like that's pushing data down, expected data.
So if I configure it in expected data, but these systems probably, I'm guessing, aren't built for, let's say, unexpected data, which would be if I start doing protocol fuzzing.
Like, how does the data get down? I'm guessing it's just a SDR or some telnet port or something.
Sometimes there's Wi-Fi, but there are very specific ARINC protocols that govern data load and data transfer.
They are very prescriptive. So I would not imagine that fuzzing will work particularly well against them.
But I think that's an interesting area for exploration. I don't really know the answer, but I wouldn't expect that to be a problem.
Last question before I know we get to flying. This is fascinating to me.
One of the things I was thinking about is that you said transposition errors.
If that data would be modified, would it be clear to a pilot to be able to go, oh, that that number looks off?
Right. Or is it more, you're using a device because it's hard to calculate in your head.
So would you be able to, would a pilot, again, I know pilots are going flight after flight after flight after flight.
All the numbers probably get like a little garbled.
I mean, I think that there's two things. One is that you've got two really highly trained pilots who are trained to deal with unexpected situations.
So things that don't pan out the way you expect that they're designed to deal with that.
So I think that's a really important thing. You've always got two humans in the loop who can, even if things aren't right, they'll be able to recover.
And, you know, crashes are mercifully rare. Right.
But we do know that there are crash reports where people have used the wrong information in their performance calculations and gone off the end of the runway or rotated too soon and tail striped and things like that.
I think that's a really positive thing in the aviation industry and that we learn from our mistakes.
We publish what went wrong so that other people can learn from that and avoid the same mistakes again.
But coming back to transposition errors, if it was two numbers swapped around, I mean, and they were very close to each other, would you necessarily notice that? Possibly not.
I know for me, obviously, all of this is a different language to me, so I wouldn't be able to.
If it's a close error, if my calculation for my runway distance should be something like three and a half thousand metres, but my app tells me it's 900 metres, I'm probably going to notice that just by looking out the window.
It's not under a kilometre long. So that might give me an inclination.
But I think the issue is these corner cases. So in aerospace, we call it hot, high and heavy.
So if we're very high altitude where it's warm, the air is thin, we're carrying a lot of weight, then we're right on the margin of performance where we need every single centimetre of runway to get off safely.
That's when potential issues occur. It's not like, you know, if we've got a 10,000 metre long runway, who cares?
There's so much to think about because I'm turning over attack paths and things like that. But like, we've talked about this forever. Let's jump on then.
Yep, OK. So what I'll do is I'll set the aircraft up and I'll run through the briefing and then you can have a go at landing.
That sounds great.
OK, so give me one second.
So what I've done is I've set us up for a landing on 27 right, so our right hand runway here.
And the aircraft is actually going to fly itself all the way.
So it's on the instrument landing system. So it would follow this imaginary glide slope to the ground.
In fact, this aircraft will do a full auto land. It will fly to runway, flare, roll out, break, even turn off all automatically if that's what we wanted it to do.
That's the kind of thing you would need in really poor weather. But what we're going to do is get you to fly the last bit.
So as a quick question, you had mentioned that's what would happen in really bad weather. You'd use the autopilot in bad weather.
That feels like it would be reversed in my mind that you would use the autopilot in good weather and bad weather I would have to take manual controls.
Well, we have categories of landing 1, 2, 3. And categories 1 and 2 require the pilot to still make a visual landing.
And that requires them to drop out of cloud and see the runway. A cat 3 landing means the cloud is at the floor. There's fog. You're not going to be able to see the runway in time.
So the only way to do it is let the aircraft deal with it.
Okay.
So in your case, if you've never flown before.
Never flown.
Don't move it just yet.
Okay.
What you want to do is keep these purple diamonds in the middle of these yellow ticks here.
So at the moment they're centered.
Okay.
These are our left and right of the runway and above and below this imaginary glide slope in the sky.
Okay.
The other thing that's really important to you is the descent rate.
You want to keep that around 7 to 800 feet per minute. So roughly what it is now.
So everything else is automatic.
The throttles, trim, everything else is set and ready to go.
So when you're ready, about a thousand feet, it's your aircraft.
Oh boy.
So I would say that small inputs go a really long way.
You don't need to make too big adjustments.
Keep looking out, look in, look out.
Don't get too fixated on the inside.
Yeah, right as you said that I realized I'm staring down here and I haven't even looked where I'm going.
The flying instructor tells me the same.
So we're quite close.
I'm sitting in a simulation. Why is my heart beating so fast?
Oh gosh.
Oh gosh.
Am I going the wrong way? Oh gosh.
You're a little bit high, but it's okay. It's a really long runway. Don't worry.
Push forward, push forward.
I'll push forward.
Oh gosh.
Oh gosh.
Oh gosh.
I'll do the throttles for you.
I think I've lost the diamond.
Oh gosh.
There we go, we've got reverse as well.
And I'll brake for you.
Okay.
At one point I completely lost the diamond on this side.
As you get closer, because it's a radio beam, you know, the angles start to get much larger.
Ah, okay.
Oh gosh.
I was totally expecting to crash there when I saw the diamond just completely start shooting down.
Nice job, great landing.
I mean, I'll give you a flight tag after it. I haven't got one, but you can get a flight tag.
Nice landing, well done.
Thank you so much.
This is, this is incredible.
Like, it's, it's funny.
As you're approaching and things like that, you hear this thing, low landing, up landing,
and I'm sitting here going, oh crap, what do I do? I see the diamond shoot down, and then you're saying that's radio waves.
There's a lot of information on the flight display to take in, but pilots are trained to just, at a glance, get what they need.
And I'm laughing because all I'm focused on is, alright, keep these diamonds inside the lane,
and all of a sudden you're like, I got the thrusters, I have the brake, and I'm thinking like, oh gosh.
Like, I can, at this point I think I can handle driving a car this, I think I, maybe you need some more training.
Well, that's why they train for a long time, a thousand hours in fact.
That's a lot.
Thank you so much.
This is so cool.
Thanks for bringing this.
Thank you for going through the explanation with us.
Thank you for watching.
And as always, hack on.