4 ms·

Oh cool, thanks. I didn't realize this chatter is public.

mikeash 8y ago
Aircraft communication, including ATC, is mostly done using plain old VHF radio. You can buy a decent handheld air band radio for $200. Ancient technology, but it works well enough.
- RockyMcNuts 8y ago
  True, works well enough, and also it's a disaster waiting to happen for very obvious cybersecurity reasons
  - CPLX 8y ago
    I’m not finding those reasons to be as obvious as you, perhaps you could elaborate.
    - polishTar 8y ago
      What’s stopping someone from impersonating ATC? If I understand correctly, a foggy day + “cleared for takeoff” is all that’s needed for a malicious actor to kill hundreds of people
      - tyingq 8y ago
        Not much, but I suspect building and running a crypto infrastructure in a secure way for everything from tiny privately owned aircraft to international carriers isn't easy.
      - ceejayoz 8y ago
        > If I understand correctly, a foggy day + “cleared for takeoff” is all that’s needed for a malicious actor to kill hundreds of people Only if the real ATC really, really drops the ball. It's happened a few times, and leads to an immediate "who the fuck was that on this frequency?", and that's likely to result in the pilots in the area treating it like a comms outage. See https://aviation.stackexchange.com/questions/44279/what-prevents-someone-from-hijacking-a-radio-frequency-mid-air https://aviation.stackexchange.com/questions/44279/what-prev...
        polishTar 8y ago
        It clearly hasn’t become too much of a problem yet, but I feel pretty concerned that, given my understanding, it appears there’s only one layer of defense against this type of attack. The response requires 1) the ATC to figure out what happened, 2) the ATC to promptly cancel the takeoff clearance, and 3) the pilot receiving+responding to the cancelled clearance with enough time. Too many things in that chain can go wrong, especially so given this would all need to happen in just a few seconds. A sophisticated attacker might even be able to jam the signal right after they give the fake clearance or (not entirely certain this is possible) use a highly directional transmitter that would allow the targeted plane to receive the message but not others. I’m definitely not an expert in this area, so I wouldn’t be surprised if I missed something, but if I didn’t, this appears to be an astonishingly large vulnerability.
        btgeekboy 8y ago
        It’s just simply something that isn’t as big of a deal as you’re thinking. Hell, we have problems today with idiots on frequency that are technically qualified to be there but are gumming up the works. When was the last time you authenticated that construction worker directing traffic on the ground? Pilots fly without a control tower all the time. They’re also the final authority to the safe operation of that aircraft. If anything is amiss, we’ll do something else. Maybe that’ll mean contacting a different facility on a different frequency, or declare lost comms via transponder and go to our filed alternate while things are worked out. Try listening to LiveATC for an uncontrolled field on a nice weekend day. (Or even a towered airport like KCMA on a Saturday at noon.) It’s controlled chaos and yet we all make it work.
      - docker_up 8y ago
        I prefer the crowd-sourcing safety of a completely open channel. Everyone is listening to everyone and can intercede if something weird is happening, including other pilots. Having a completely private channel but stolen credentials (we are all aware this happens all the time) means that you have to completely trust the voice on the other line.
      - CPLX 8y ago
        The same thing that’s stopping people from impersonating a police officer.
      - 13of40 8y ago
        It happens: https://viewfromthewing.boardingarea.com/2018/12/03/nightmare-scenario-man-arrested-for-impersonating-air-traffic-control-issuing-fake-takeoff-instructions/ https://viewfromthewing.boardingarea.com/2018/12/03/nightmar...
      - schmookeeg 8y ago
        A resultant accident would also require: ATC to ignore the false transmission and take no action. The departing pilots to accept a new voice and a clearly inferior/weak radio clearance as fact without verifying. The departing pilots to not have situational awareness of an aircraft previously cleared to land on their runway. The departing pilots to still not check final approach on the just-falsely-cleared runway before taxiing into position. The landing pilots to have ignored the false transmission (also from a weak/inferior radio and new voice) clearing an aircraft onto their intended runway. The landing pilots to not be watching the runway when they break out at minimums. (assuming your foggy day is a worst-case scenario) The departing aircraft to have already started a takeoff roll and be more than 1,000' down the runway. (aircraft "touchdown zone" is not at the beginning of the runway) Possible? Yes. Not in my top ten fears as a pilot. Much of ATC is a collaboration between professionals, not a dictatorship. It's really an amazing thing to participate in.
      - unionemployee 8y ago
        A completely different situation, but a Las Vegas controller had a stroke while on duty not long ago. You can hear in the transmissions that as the situation goes on the pilots stop obeying and begin verifying instructions -https://youtube.com/watch?reload=9&v=Jv1kmuFOhWk https://youtube.com/watch?reload=9&v=Jv1kmuFOhWk.
    - lainga 8y ago
      Perhaps he's referring to the MITM attack from Die Hard II...?
  - lykr0n 8y ago
    How so? You can still Jam digital radio waves, and "upgrading" to a more secure system would be hella expensive as you would need to retrofit the world's planes with the new system
    - tyingq 8y ago
      Any aircraft retrofit is crazy expensive. FAA certification is tedious, and has to be redone even for tiny changes. And, aircraft don't make money on the ground.
  - mikeash 8y ago
    Security, for sure, but where’s the cyber?
  - tyingq 8y ago
    There's also ADS-B and ACARS, both unencrypted data from the aircraft. I assume the cost/benefit to encrypt voice and data has been looked at and dismissed.
  - RockyMcNuts 8y ago
    picture I have is, should move to a digital jam-resistant spread spectrum, with certificates, encryption, and some VHF fail-safe. also, voice communication is high workload, not error free, many boilerplate communications like reading out altimeter settings can be text messages or automated. I imagine work is being done but not familiar with it.
- pivo 8y ago
  Or if you’re lazy there’s LiveATC, an iOS app that lets you stream these channels.
  - mikeash 8y ago
    Also handy if you’re not right next to the transmitter. Air band is mostly line of sight, so it’s common to be able to hear all the airliners but not hear the ATC talking to them.
- jsjohnst 8y ago
  You can get a decent handheld VHF walkie that lets you also tune in on ATC for a quarter of that price.
  - _JamesA_ 8y ago
    A rtl-sdr [0] is even better. For $30 you can tune in to anything from 500 kHz up to 1766MHz. [0]: https://www.rtl-sdr.com/buy-rtl-sdr-dvb-t-dongles/ https://www.rtl-sdr.com/buy-rtl-sdr-dvb-t-dongles/

Aircraft communication, including ATC, is mostly done using plain old VHF radio. You can buy a decent handheld air band radio for $200. Ancient technology, but it works well enough.

RockyMcNuts 8y ago
True, works well enough, and also it's a disaster waiting to happen for very obvious cybersecurity reasons
- CPLX 8y ago
  I’m not finding those reasons to be as obvious as you, perhaps you could elaborate.
  - polishTar 8y ago
    What’s stopping someone from impersonating ATC? If I understand correctly, a foggy day + “cleared for takeoff” is all that’s needed for a malicious actor to kill hundreds of people
    - tyingq 8y ago
      Not much, but I suspect building and running a crypto infrastructure in a secure way for everything from tiny privately owned aircraft to international carriers isn't easy.
    - ceejayoz 8y ago
      > If I understand correctly, a foggy day + “cleared for takeoff” is all that’s needed for a malicious actor to kill hundreds of people Only if the real ATC really, really drops the ball. It's happened a few times, and leads to an immediate "who the fuck was that on this frequency?", and that's likely to result in the pilots in the area treating it like a comms outage. See https://aviation.stackexchange.com/questions/44279/what-prevents-someone-from-hijacking-a-radio-frequency-mid-air https://aviation.stackexchange.com/questions/44279/what-prev...
      - polishTar 8y ago
        It clearly hasn’t become too much of a problem yet, but I feel pretty concerned that, given my understanding, it appears there’s only one layer of defense against this type of attack. The response requires 1) the ATC to figure out what happened, 2) the ATC to promptly cancel the takeoff clearance, and 3) the pilot receiving+responding to the cancelled clearance with enough time. Too many things in that chain can go wrong, especially so given this would all need to happen in just a few seconds. A sophisticated attacker might even be able to jam the signal right after they give the fake clearance or (not entirely certain this is possible) use a highly directional transmitter that would allow the targeted plane to receive the message but not others. I’m definitely not an expert in this area, so I wouldn’t be surprised if I missed something, but if I didn’t, this appears to be an astonishingly large vulnerability.
        btgeekboy 8y ago
        It’s just simply something that isn’t as big of a deal as you’re thinking. Hell, we have problems today with idiots on frequency that are technically qualified to be there but are gumming up the works. When was the last time you authenticated that construction worker directing traffic on the ground? Pilots fly without a control tower all the time. They’re also the final authority to the safe operation of that aircraft. If anything is amiss, we’ll do something else. Maybe that’ll mean contacting a different facility on a different frequency, or declare lost comms via transponder and go to our filed alternate while things are worked out. Try listening to LiveATC for an uncontrolled field on a nice weekend day. (Or even a towered airport like KCMA on a Saturday at noon.) It’s controlled chaos and yet we all make it work.
    - docker_up 8y ago
      I prefer the crowd-sourcing safety of a completely open channel. Everyone is listening to everyone and can intercede if something weird is happening, including other pilots. Having a completely private channel but stolen credentials (we are all aware this happens all the time) means that you have to completely trust the voice on the other line.
    - CPLX 8y ago
      The same thing that’s stopping people from impersonating a police officer.
    - 13of40 8y ago
      It happens: https://viewfromthewing.boardingarea.com/2018/12/03/nightmare-scenario-man-arrested-for-impersonating-air-traffic-control-issuing-fake-takeoff-instructions/ https://viewfromthewing.boardingarea.com/2018/12/03/nightmar...
    - schmookeeg 8y ago
      A resultant accident would also require: ATC to ignore the false transmission and take no action. The departing pilots to accept a new voice and a clearly inferior/weak radio clearance as fact without verifying. The departing pilots to not have situational awareness of an aircraft previously cleared to land on their runway. The departing pilots to still not check final approach on the just-falsely-cleared runway before taxiing into position. The landing pilots to have ignored the false transmission (also from a weak/inferior radio and new voice) clearing an aircraft onto their intended runway. The landing pilots to not be watching the runway when they break out at minimums. (assuming your foggy day is a worst-case scenario) The departing aircraft to have already started a takeoff roll and be more than 1,000' down the runway. (aircraft "touchdown zone" is not at the beginning of the runway) Possible? Yes. Not in my top ten fears as a pilot. Much of ATC is a collaboration between professionals, not a dictatorship. It's really an amazing thing to participate in.
    - unionemployee 8y ago
      A completely different situation, but a Las Vegas controller had a stroke while on duty not long ago. You can hear in the transmissions that as the situation goes on the pilots stop obeying and begin verifying instructions -https://youtube.com/watch?reload=9&v=Jv1kmuFOhWk https://youtube.com/watch?reload=9&v=Jv1kmuFOhWk.
  - lainga 8y ago
    Perhaps he's referring to the MITM attack from Die Hard II...?
- lykr0n 8y ago
  How so? You can still Jam digital radio waves, and "upgrading" to a more secure system would be hella expensive as you would need to retrofit the world's planes with the new system
  - tyingq 8y ago
    Any aircraft retrofit is crazy expensive. FAA certification is tedious, and has to be redone even for tiny changes. And, aircraft don't make money on the ground.
- mikeash 8y ago
  Security, for sure, but where’s the cyber?
- tyingq 8y ago
  There's also ADS-B and ACARS, both unencrypted data from the aircraft. I assume the cost/benefit to encrypt voice and data has been looked at and dismissed.
- RockyMcNuts 8y ago
  picture I have is, should move to a digital jam-resistant spread spectrum, with certificates, encryption, and some VHF fail-safe. also, voice communication is high workload, not error free, many boilerplate communications like reading out altimeter settings can be text messages or automated. I imagine work is being done but not familiar with it.
pivo 8y ago
Or if you’re lazy there’s LiveATC, an iOS app that lets you stream these channels.
- mikeash 8y ago
  Also handy if you’re not right next to the transmitter. Air band is mostly line of sight, so it’s common to be able to hear all the airliners but not hear the ATC talking to them.
jsjohnst 8y ago
You can get a decent handheld VHF walkie that lets you also tune in on ATC for a quarter of that price.
- _JamesA_ 8y ago
  A rtl-sdr [0] is even better. For $30 you can tune in to anything from 500 kHz up to 1766MHz. [0]: https://www.rtl-sdr.com/buy-rtl-sdr-dvb-t-dongles/ https://www.rtl-sdr.com/buy-rtl-sdr-dvb-t-dongles/