WEBVTT 00:00.000 --> 00:05.880 Our fourth presenter... wait, I mean third presenter before the presentation is from Martin Strohmeyer. 00:05.880 --> 00:14.200 In case you missed his last talk, Martin is a senior scientist at the Swiss Cyber Defense Campus in Zurich and a visiting fellow of Kellogg College. 00:14.200 --> 00:24.680 He will be speaking about how ROTC-based science and technology can be conducting open security research with real AI hardware by working closely with industry and regulators. 00:24.680 --> 00:28.260 So please welcome to the stage again, Martin Strohmeyer. 00:33.000 --> 00:35.060 Yes, some people are still here, excellent. 00:35.060 --> 00:37.740 Welcome to my little softbox corner. 00:39.080 --> 00:45.160 As the intro said, we don't do only privacy, we do a lot of security stuff. 00:45.220 --> 00:53.260 And I'm trying to talk a little bit about our approach, about how to do this and how to do research in aviation security. 00:54.100 --> 01:01.120 First, let me briefly try to convince you that we actually do something useful in aviation research. 01:01.120 --> 01:10.880 As mentioned, we do research in universities, we have stakeholders in the government, in the military, where we are based ourselves. 01:10.880 --> 01:18.260 And we work with industry, mostly for knowledge exchange and disclosure of things we find. 01:18.280 --> 01:27.000 We've published over 60 papers in the area over the past 10 years, with 50 co-authors from more than 20 institutions. 01:27.000 --> 01:31.660 So that's a very broad research activity that we're doing. 01:32.040 --> 01:36.290 Currently, we have over 10 students working on various topics. 01:36.660 --> 01:45.960 Most of them are from ETH Zurich, EPF and Bosan, but also some other collaborations across Europe and actually also in the US. 01:45.960 --> 01:52.980 So we have a lot of exciting results coming up that may be in the village next year. 01:52.980 --> 01:57.640 Or if you follow what we're doing, you might see it at some other security conferences. 01:57.640 --> 01:58.840 So stay tuned. 01:59.700 --> 02:01.120 Yeah, caveat. 02:01.120 --> 02:07.400 This is obviously quite a long-term government effort, so it's not something that's trivially recreated. 02:07.400 --> 02:15.580 But I hope that some of the lessons that we have are still applying to you or what you're interested in. 02:15.640 --> 02:18.440 So I hope you get some value from this. 02:19.820 --> 02:25.600 Something that illustrates more technically what we've done over the past 10 years. 02:25.640 --> 02:37.720 Something that we built originally just to illustrate how many different types of aircraft communication and wireless communications are going on over different flight phases in aerospace. 02:37.720 --> 02:49.960 And the green numbers tell you when we published some research on all these specific communication technologies. 02:50.160 --> 03:03.700 Some stuff is not on here, so the privacy research that I've shown before around proximity warning systems or when we do research on human factors is not captured by this. 03:03.700 --> 03:07.400 But broadly, all the technologies are on here. 03:08.960 --> 03:13.700 So, let's start with trust first. 03:14.380 --> 03:25.140 These are some headlines following some Blackhat and Defcon talks around the time when I got into this topic. 03:25.340 --> 03:33.120 So, that's what you sometimes get when you say, oh, I can hack this specific part. 03:33.120 --> 03:38.780 And it gets into the media and then suddenly planes are falling out of the sky, right? 03:39.840 --> 03:51.800 The problem is the FAA, lots of people in the aviation industry, they either know this is not true or they believe it's not true or they definitely disagree. 03:51.800 --> 03:54.440 And they definitely disagree with having these headlines. 03:55.660 --> 03:59.120 So, going from there, it's very difficult to work with them. 03:59.120 --> 04:09.680 So, we typically try to avoid having any of these headlines that claim, oh, well, we can hack aircraft, we can hack ground stations and they will fall out of the sky. 04:09.680 --> 04:11.520 That's not ideal. 04:11.660 --> 04:19.220 On the other hand, also not ideal, not building trust within the security community is if you say, there's nothing to see here, right? 04:19.860 --> 04:21.360 We are safe. 04:21.360 --> 04:29.900 There's redundancy, even though all of the systems are also hackable or vulnerable at least. 04:31.300 --> 04:38.680 And you answer also over the media and say, hey, there are no vulnerabilities in any of these systems. 04:38.780 --> 04:42.320 So, nothing to see here, don't do any research. 04:42.580 --> 04:44.340 Also not building trust. 04:45.240 --> 04:48.240 What we've been trying to do is basically four steps. 04:48.240 --> 04:50.960 So, we're trying a more academic approach. 04:51.260 --> 04:56.340 We really, well, our research takes time, for sure. 04:56.560 --> 05:01.820 We try in a very academic, scientific manner with students, with universities. 05:03.300 --> 05:08.360 Try to avoid the sensationalism, the headline-grabbing approaches, right? 05:08.360 --> 05:13.840 Of course, when we find something, we work with industry, we disclose responsibly. 05:14.500 --> 05:16.620 We try to thoroughly evaluate. 05:18.180 --> 05:25.120 Yeah, not to find some issue and say, oh, here again, planes are falling out of the sky. 05:25.120 --> 05:28.600 No, the important thing is that you don't just look at one system. 05:28.800 --> 05:34.100 If you've seen 10 or 15 different communication systems alone, right? 05:34.100 --> 05:37.880 That's not even talking about all the other systems on aircraft on the ground. 05:38.620 --> 05:48.440 You need to look at them all at once, basically, and say, okay, what sort of impact can you really have on pilots on the ground or on the system overall? 05:48.800 --> 05:57.320 So, generally, all of our research has concluded that, yeah, no one's falling out of the sky, right? 05:57.380 --> 06:02.340 But in very specific circumstances, there can absolutely be relevant problems. 06:04.180 --> 06:12.260 We come from IT security, economic security background, so we had to go to aviation, right? 06:12.560 --> 06:26.240 You have to make yourself visible, you have to start talking to ANSPs, to airlines, to regulators, to everyone really working in aviation in this space, also to manufacturers. 06:26.240 --> 06:36.860 And try to find individuals, try to find pilots, try to find air traffic controllers who can really help you understand how they see their systems, right? 06:36.860 --> 06:46.320 And then you can basically bounce back and forth, what are these security issues that we've seen and what sort of impact would they have on your work? 06:47.120 --> 06:52.920 If you do that, then it's much easier to establish some credibility in the aviation community. 06:52.920 --> 06:59.190 And finally, this should actually read evaluation, not simulation. 07:00.800 --> 07:11.400 Yeah, you need to convince people that the attacks and things that you're researching and the vulnerabilities that you're finding, that they're real, right? 07:11.400 --> 07:20.340 So, if you look at some standards and there's no security built in, then that's a problem, but what sort of problem is it? 07:20.340 --> 07:25.640 Then you can start simulating attacks and you can get closer to the truth. 07:25.640 --> 07:33.140 But still, at the end of the day, we've always heard, well, this is not the real thing, you're not looking at the real system. 07:33.200 --> 07:40.300 This is just software-defined radios that you're looking at, and this is not an effective innovation, we don't believe you. 07:40.480 --> 07:46.440 And that's the second part of this talk, how to get around this. 07:47.600 --> 07:51.680 Of course, doing all these four steps is hard, right? 07:54.360 --> 07:58.940 It's definitely easier at the government, in my experience. 07:59.320 --> 08:11.000 So, when I was at the university before, if you go to regulators, if you go to manufacturers, doing the same work basically, but the response rate was much, much lower. 08:12.660 --> 08:17.120 Aviation manufacturers, they typically wouldn't reply if you have some issues. 08:17.180 --> 08:33.960 Things change, things change slowly, but in my experience, if you're independent at the university, it's much more difficult than if you work at the government or the military, where you typically get some good answers and people may be hesitant, but they probably want to work with you. 08:36.800 --> 08:38.620 It takes time. 08:38.780 --> 08:40.340 I think I made that point. 08:40.340 --> 08:42.500 We've been working on this for over 10 years. 08:42.600 --> 08:48.900 By now, we're really only where we want to be, with real-world evaluations. 08:49.840 --> 09:01.000 Personal connections, I've mentioned this, go find people at important institutions, talk to them, because very often this doesn't work on the high-level policy level, right? 09:01.000 --> 09:08.540 You need to really find some champions at different institutions and work with them on what you think is important and interesting. 09:11.580 --> 09:22.480 Defense, yeah, we are in the defense space, and a lot of aviation stuff is, of course, run by manufacturers and institutions that are also in the defense space. 09:23.420 --> 09:28.480 Even if you don't like it, it's probably necessary to get an in there somewhere. 09:29.620 --> 09:34.260 Collaborate as widely as possible, that's certainly an important point. 09:34.260 --> 09:42.560 So don't stay just in your bubble here, even though the aerospace village is an excellent initiative where you can meet a lot of people. 09:42.560 --> 09:46.540 But yeah, go out and find everyone who wants to work in the space. 09:46.860 --> 09:54.580 And also, go not only to IT conferences, do go to aviation conferences, tell them about security issues. 09:54.780 --> 09:57.500 They still don't know, they still don't understand. 09:58.060 --> 10:01.360 So there are several big aviation conferences. 10:01.760 --> 10:04.640 And yeah, you should go there and tell these people. 10:04.640 --> 10:05.920 It helps a lot. 10:08.740 --> 10:14.880 A couple of disclosure examples as well that we've had over the past few years. 10:16.600 --> 10:18.660 This was a positive one. 10:18.660 --> 10:27.300 We were just collecting some data back then and saying, oh, okay, here, there's ACARS, it's a data link if you're not familiar. 10:27.660 --> 10:33.200 And several airlines are just sending credit card data over this data link in the clear, right? 10:33.200 --> 10:35.560 Everyone can just collect it. 10:35.560 --> 10:38.700 Some websites on the internet collected it. 10:39.640 --> 10:43.540 Somebody to tell these airlines basically, well, stop doing this. 10:43.920 --> 10:47.120 So we reported this to a few people. 10:47.120 --> 10:50.140 It took a few years, to be honest. 10:50.620 --> 10:52.520 Processes are very, very slow. 10:52.940 --> 10:58.840 But they were eventually fixed, so we take that. 11:00.760 --> 11:03.880 We have some negative examples, however, as well. 11:03.880 --> 11:23.060 In this area, for example, we had a paper a few years where we, other people too, noticed that these data links, something that manufacturers call encryption, however, it's not encryption, it's really just a monoalphabetic substitution cipher. 11:23.460 --> 11:27.840 So best case, we can call it obfuscation. 11:28.000 --> 11:37.180 So we wrote a paper, we talked to the manufacturer responsible for this sort of thing and said, do you really want to do this? 11:37.180 --> 11:39.580 Or do you have something better, maybe? 11:39.580 --> 11:44.980 But we heard from them saying, no, that's fine with us, honestly. 11:46.060 --> 11:50.680 And the arguments were like, well, it's not encryption, right? 11:50.680 --> 11:52.080 It's just obfuscation. 11:52.380 --> 11:56.900 And there's no sensitive data on these data links, right? 11:57.780 --> 12:03.640 That's why they have some sort of obfuscation, but we said, okay, there's no problem here. 12:03.640 --> 12:09.960 And we also don't need, you know, there are no industry standards on this, so we can do what we want. 12:09.960 --> 12:15.080 We don't need to do security because there are no industry standards telling us to do so. 12:16.720 --> 12:24.300 Finally, they said, everyone using this sort of encryption on an aircraft, they know it's not encryption. 12:24.960 --> 12:36.320 So, they said they're all basically experts on security, and they're fully aware that this is not encryption, it's just obfuscation. 12:36.360 --> 12:37.840 That's what we got from the lawyers. 12:37.840 --> 12:40.600 I guess that's the job of the lawyers. 12:40.660 --> 12:49.580 However, afterwards, I mean, we looked at the software that they use for this data link, and, I mean, my eyes don't deceive me. 12:49.580 --> 13:00.560 It literally says, encrypt downlink, and if I'm not an expert, even if I am an expert, I think that uses some proper encryption to secure my data, right, if I have that option. 13:00.960 --> 13:09.120 And only if I really look at the data myself, I realize, oh, this is trivial, and anyone can basically crack it. 13:10.200 --> 13:13.400 So, yeah, good and bad examples both exist. 13:14.520 --> 13:18.440 That brings me to the second part of my talk, and that's labs. 13:18.440 --> 13:26.660 How do you really build aviation security labs so that you can find real vulnerabilities in practice? 13:28.160 --> 13:36.400 Our original motivation around three years ago was, well, we wanted to do mostly radio frequency attacks, real ones. 13:36.400 --> 13:57.040 So, it was a decade of research, right, simulation, you find lots of papers, lots of talks at DEFCON, Black Hat, talking about things like ADS-B, ACARS, multi-iteration, collision avoidance, and everyone says, oh, it's not encrypted, it's insecure, you can do whatever you want. 13:58.120 --> 14:09.940 However, yeah, aviation experts, but also academic reviewers told us, this cannot be done in a real aircraft, or in a real constellation, on a real system. 14:10.440 --> 14:17.000 There will be redundancy, there will be some black magic that will prevent these attacks. 14:17.000 --> 14:20.500 Nobody tells you how, but they will say, no, this can't work. 14:20.600 --> 14:24.980 And even if you believe they are wrong, you need to show it. 14:24.980 --> 14:28.600 You need to go out and really, really show it. 14:29.680 --> 14:39.480 So, basically, until then, we had this, we have avionics simulated with SDRs, as you can see on the right here. 14:39.480 --> 14:49.480 Some computer will simulate the software, you have software-defined radios receiving data, and you have the actual attack, also in software-defined radio. 14:49.480 --> 14:57.720 That part is okay, but the avionics part, yeah, you need to have real avionics here, to show people that it's a problem. 14:58.220 --> 15:08.320 There have been some related efforts on this, there was some paper 4-5 years ago, where they also built an avionics lab. 15:08.320 --> 15:15.940 It wasn't looking at the radio frequency parts, but they were looking at things like a ring 429, and saying, okay, we have a bus here, what can we do? 15:15.940 --> 15:20.020 So that was interesting, you can check it out. 15:20.020 --> 15:22.500 Of course, we've seen stuff in the village, right? 15:26.280 --> 15:30.500 Also in the media over the past few years, so these were great efforts. 15:31.180 --> 15:42.520 Maybe you've also seen this, where the Department of Homeland Security offered some people at least a way to look at a real aircraft, maybe not the newest one, but a real aircraft. 15:43.600 --> 15:53.520 However, that quietly ended around 3 years ago, and none of the results have ever been made public, to my knowledge. 15:53.680 --> 16:00.180 So, certainly a commendable effort, very useful, but not for me at least, directly. 16:02.620 --> 16:06.080 Several challenges, of course, when you try to build such a lab. 16:06.080 --> 16:11.180 It's a fairly novel thing, at least I'm not aware of anyone doing this publicly. 16:11.840 --> 16:14.560 So there's fairly unchartered ground. 16:14.980 --> 16:23.600 There are some projects that I know of, they are OEMs like Airbus, or even the Swiss manufacturer Pilatus. 16:23.680 --> 16:35.470 But, yeah, typically, unless you're really working with them, there's no way you can access it, and also probably you aren't getting any aid, or you can't do what you want. 16:37.030 --> 16:42.290 Some avionics manufacturers, we've also seen, they're not very open. 16:42.390 --> 16:48.910 Definitely not many at the university, but even to us, they were not very open in building such testbeds for security. 16:49.350 --> 16:51.790 Second thing is, of course, you have trade-offs, right? 16:52.130 --> 16:57.870 Well, you can spend a lot of money, that's one thing. 16:57.870 --> 17:01.190 The more money you spend, the more realistic it gets. 17:01.290 --> 17:10.070 But complexity also grows, and then it gets obviously much harder to just look at the systems that you're interested in. 17:10.830 --> 17:14.250 Costs here, easily in the six figures, quickly. 17:14.250 --> 17:21.490 So, at some point you think, well, maybe it should just wind by an aircraft, but again, data complexity is a problem. 17:21.650 --> 17:34.530 Because, yeah, working on aircraft, it's much harder to attack systems and debug everything than if you built a lab just exactly for this purpose. 17:35.290 --> 17:41.050 So, high-level concept that we have is, we wanted certified avionics hardware. 17:42.050 --> 17:48.330 That definitely believes that it's deployed in a real aircraft and actually flying. 17:48.430 --> 17:52.870 We have all the radio frequency devices, so lots of antennas. 17:53.470 --> 17:58.850 We should be able to spoof, to send everything to these antennas over the air. 17:59.110 --> 18:03.090 So we can really do some testing, spoofing, jamming, positive testing. 18:03.570 --> 18:08.070 And we also said, well, we start with something, but we want to have it extend to the light. 18:08.070 --> 18:15.010 So, if this works well, in the future we want to have more technologies. 18:17.010 --> 18:22.310 This is the complete overview of our first attempt. 18:23.130 --> 18:25.750 We got some hardware from Garmin. 18:26.630 --> 18:31.510 GT-M750, GT-X6000 and GT-S8000. 18:31.510 --> 18:38.630 These are all connected and integrated by certified aviation integrators. 18:39.690 --> 18:43.730 They all have the right antennas. 18:43.730 --> 18:51.050 So , the antennas for the collision avoidance system, for the transponder, for the GNSS system, of course. 18:51.050 --> 18:57.290 And the only thing that we really need to simulate is the barometric altitude. 18:57.550 --> 19:12.930 So that's fed in by a PC, because, well, there are ways, but it's a bit too complex to condense a system that is maybe 10,000 feet up in the air and not standing on the ground, if we don't do it with simulations. 19:14.890 --> 19:16.790 Safety is, of course, important. 19:16.790 --> 19:19.010 So, you know, we have several approaches. 19:19.010 --> 19:22.670 We have large Faraday cages, where we can do radio frequency testing. 19:22.670 --> 19:31.510 We have anechoic chambers available, where we can put all this in and start sending freely without bothering anybody. 19:33.110 --> 19:37.070 That's how the first original lab looked assembled together. 19:37.070 --> 19:39.850 So, we have a full rack with all the avionics. 19:40.790 --> 19:45.630 Computer feeds, again, the barometric altitudes and the antennas at the back. 19:45.630 --> 19:51.430 And then the system can be controlled, basically, with the same touchscreen as a pilot would. 19:52.730 --> 19:57.710 First thing we did was, well, let's try out some well-known attacks, right? 19:57.870 --> 20:01.710 Is there any protection against GPS spoofing in these systems? 20:02.930 --> 20:04.850 Turns out, no, there's not. 20:04.850 --> 20:14.230 So, this aircraft, even though it was at the lab, even though it was in Switzerland, you can make it believe, oh, I'm in Scandinavia. 20:14.230 --> 20:18.130 Or, as you've seen in the video here, it's actually even flying. 20:18.130 --> 20:21.370 So, you just spoof the GPS in a way that it thinks it's flying. 20:22.330 --> 20:26.450 That's all been done with software-defined radios, openly available software. 20:26.970 --> 20:34.810 Second thing we did is all these alt attacks on, you know, ATSD and also collision avoidance systems. 20:35.730 --> 20:38.750 Yeah, some of them work out of the box. 20:38.750 --> 20:42.030 You can go send some aircraft on collision course. 20:42.870 --> 20:45.450 You don't get the full resolution advisory. 20:45.450 --> 20:50.950 For that, you really need to attack the TCAS, which is something that we're working on at the moment. 20:53.830 --> 20:55.890 Then we started with some extensions. 20:57.470 --> 21:02.310 CPGLC, Controller Pilot Data Link Communication System. 21:02.310 --> 21:09.010 We wanted to look at this, because this is really being rolled out, particularly in Europe and the US. 21:09.010 --> 21:15.590 Everyone going via the Atlantic commercial aircraft, they now need to have this new system shortly. 21:15.590 --> 21:20.550 So, we bought more hardware, this time from Universal Avionics. 21:21.070 --> 21:23.690 As you've seen, it's on rack. 21:23.690 --> 21:36.390 Then we worked with our local ANSP and Eurocontrol to be able to connect to a rail-ground station, be able to log in with these systems. 21:36.530 --> 21:41.290 And from there, of course, you can go capture the data. 21:41.450 --> 21:42.950 It's all unencrypted. 21:42.970 --> 21:45.170 It's also not authenticated. 21:45.170 --> 21:56.110 They can really look into the protocol and try to figure out how do I really attack these systems best, or how difficult it is. 21:56.210 --> 21:58.550 Also, work on this forthcoming. 21:59.350 --> 22:06.250 The second extension was at the SAFCOM system, Iridium, that was offered by the Garmin system. 22:06.250 --> 22:15.330 So, they can go and simply send e-mails, SMS, or even call using the Avionics hardware. 22:15.710 --> 22:25.050 Iridium, incidentally, is of course also unencrypted, so it's quite trivial to find your own calls and your own SMS on this system. 22:25.990 --> 22:29.850 Electronic flight packs are a big thing, also seen in the village. 22:30.150 --> 22:39.010 So, we also bought the extension that you can connect your phone, your iPad, to the flight management computer using Bluetooth and WiFi. 22:39.310 --> 22:43.830 Also, obviously, lots of security research opportunities here. 22:43.990 --> 22:51.290 And finally, we built a multi-iteration system recently, so that is very practical. 22:52.910 --> 23:04.330 If you're not familiar, multi-iteration is also being used a lot to back up ADS-P and other insecure systems, or at least it's argued that this could work. 23:04.330 --> 23:09.790 So, we said, okay, we also need to set up such a system and do security research on those. 23:10.650 --> 23:13.470 So, most of this is really ongoing. 23:14.090 --> 23:22.230 The lab has already been used in person by lots of people from different countries, lots of our own students. 23:23.130 --> 23:27.450 I've teased all of these results on these support technologies. 23:27.930 --> 23:31.850 But, yeah, we're open for collaborations as well on this. 23:31.850 --> 23:38.670 If you say, hey, this is really cool, I would like to try it out, give us a shout. 23:40.910 --> 23:49.090 Because, yeah, we built this not just for us, but we said, okay, we really want to improve aviation security in the long run. 23:49.830 --> 23:51.610 Brings me to the end of my talk. 23:51.790 --> 23:53.890 Four takeaways that I have. 23:53.990 --> 24:05.790 I think building this sort of trust that you can go and conduct aviation security research responsibly and have some impact, it's hard, but it's necessary and worth it. 24:05.790 --> 24:14.110 So, yeah, don't just look at the system and find a flaw and then basically leave it at that. 24:14.230 --> 24:23.890 Second one, simulations, software, attacks, that's all great, but we need to take this eventually. 24:23.890 --> 24:31.990 So, we really need to invest in better, more realistic systems to find out what sort of impact can these things really have. 24:32.710 --> 24:42.030 To that extent, we built a lab, it's certified hardware, it supports radio communication, which I personally think is really cool, that's what I typically work on. 24:42.750 --> 24:46.890 And I think it's important to do this, to really overcome any of the doubts. 24:47.310 --> 24:53.050 And as I mentioned, it's there for research, it's for collaboration, so please contact us. 24:53.110 --> 24:53.910 Thank you.