13 ms·
Hackers can fake radio signals to 'hijack' aircraft landing systems
- wglb 8y agoThe underlying paper here: https://aanjhan.com/assets/ils_usenix2019.pdf https://aanjhan.com/assets/ils_usenix2019.pdf
- cjrp 8y agoHow powerful would a malicious transmitter need to be in order to overpower the legitimate ILS signal?
- NegativeLatency 8y agoIf you got it close enough you could probably do it with a pretty low power transmitter. (Radio on a drone or something)
- jethro_tell 8y agoYou'd need to be out by the transmitter in the middle of the airfield though to truely spoof it.
- penagwin 7y agoIf you flew low at night I think you'd have a decent chance of getting a drone to the right location. You'll need either a decent setup or a decent position to control it though. Although as others have mentioned, if you're trying to crash a plane or cause a disruption at the airport there's easier ways. Including just flying the drone over the runway (to close an airport).
- sciurus 8y agoArs Technica covers this story much better at https://arstechnica.com/information-technology/2019/05/the-radio-navigation-planes-use-to-land-safely-is-insecure-and-can-be-hacked/ https://arstechnica.com/information-technology/2019/05/the-r...
- sascha_sl 8y agoThis is news? Def Con in 2012 https://www.youtube.com/watch?v=e1QAjCH_1oU https://www.youtube.com/watch?v=e1QAjCH_1oU
- ryandrake 8y agoA lot of aviation runs on basic radio technology. ILS, VORs, all voice comms with ATC. It’s well known that these frequencies can be jammed or transmitted on by bad actors. If you want to do this, go ahead and roll the dice on having multiple federal agencies come down on you like a ton of bricks. See how it works out. EDIT: (Since I can’t reply because HN for whatever reason prevents me from posting more than 2-3 replies per day): To clarify, yes I’m arguing that this is not newsworthy.
- gruez 8y ago>having multiple federal agencies come down on you like a ton of bricks. Only if you get caught. How do they catch you if you set up the transmitters and then fled the scene?
- AnimalMuppet 8y agoThey trace the transmitters back to you. Fingerprints, other evidence at the scene, purchase records tied to serial numbers on the transmitters... there's a lot you'd have to get right to leave no way for them to find you.
- jimktrains2 8y ago> They trace the transmitters back to you What? You can't "trace a transmitter" like this. You could triangulate someone's location while transmitting. > purchase records tied to serial numbers on the transmitters Yeah, I'm sure second hand sales would update this information if it exists in the first place at all, and even if it did, it's not like transmitter transmits that information.
- 7y ago
- john-mcclane 8y agohttps://en.wikipedia.org/wiki/Die_Hard_2 https://en.wikipedia.org/wiki/Die_Hard_2
- dontbenebby 8y agoThis is an issue, but I wouldn't be too alarmist. It probably wouldn't crash a plane though, just severely cripple an airport. (Cause all take offs to be cancelled, all incoming flights diverted, and the planes in the air land one by one in order of fuel urgency using line of sight.)
- antsar 8y ago(not a pilot) I'd think causing the autopilot to believe it is substantially off-course would induce a sharp bank to correct course. That bank at low altitude can lead to a wing strike. If not, still seems plausible to deviate enough to impact obstacles near the runway.
- dontbenebby 8y agoPossibly? Not a pilot either (but I took multiple human factors courses which talk a lot about air crashes). I'd hope that the pilot would notice something is off and abort the landing before that. (Eg: visually be like "oh there is something on the runway I thought I was cleared on) Theoretically even if cleared for landing they should keep an eye out and abort if, say, an errant baggage cart was in the way.
- AWildC182 8y ago(Am IR pilot) Assuming someone is paying any attention, the autopilot suddenly nosing down and the vertical speed increasing would immediately result in missed approach procedures being executed. These approaches usually terminate at a pre-determined height (decision height) which unless you're flying CAT-IIIC (not really used) is minimum around 50ft and more commonly between 100 and 200ft. Therefore you have some room for error in the event something bad happens. Additionally, approach paths won't have any protruding objects within a certain range of the runway.
- bulte-rs 8y agoFormer commercial pilot here: we user to be doing IIIC approaches at least 3 times a year. For the rest, usually below 10.000 feet, there van never be "two heads up", so one pilot is always watching the instruments. Any deviation from expected parameters (airspeed, verticale speed, ils deviation, radio altitude) Will result in an unstabilised approach and thus the execution of missed approach procedures (a go-around). As mentioned elsewhere, everyone in aviation knows these systems are as insecure as can be. Edit: forgot to finish a sentence..
- sokoloff 8y agoThe localizer (lateral deviation indication) is going to be harder to spoof due to the beat/squeal that it would introduce when broadcast alongside the legitimate localizer. The pilot (or PNF) will monitor the audio signal for the Morse code that identifies the localizer and the squeal will be apparent. The glideslope signal (vertical deviation indication) would be easier to spoof. Set that up 1/2 mile short of the runway and aligned to intercept the proper glideslope shortly before the true glideslope intercept point (Maltese cross on the chart). That has a chance of working and going undetected. If you're able to get an aircraft onto the rogue glideslope lobe, even when ATC gets a low altitude alert, the crew is likely to report they're perfectly on glideslope. I'm not sure this is as practical an attack as simply firing on an aircraft on approach, of course.
- i_am_proteus 8y agoOne could probably simultaneously spoof ADS-B for added chaos.
- jcims 8y agoEasily. I've heard that some systems are using trilateration to reject spoofed ADS-B but am not sure how widespread that is. Trolling flightradar24 and like services would be easy.
- crankylinuxuser 8y agoThat's certainly an interesting approach, but also spoofed by sending a adsb-spammer on a balloon. Then, start flooding adsb with 10-100 messages a second. Wireless systems without AAA and encryption and signing are effectively fucked.
- AWildC182 8y agoAnd with WAAS, the world is moving towards GPS approaches anyway. Even without careful planning anyone with a mildly powerful VHF radio and a yagi antenna can jam ILS, VORs and ATC comms rather effectively and has been able to since the end of WWII. I've seen these articles pop up a few times in the past couple days but everyone in aviation already knows that there isn't any security on this stuff. People even jam ATC for giggles sometimes[1]. There's enough redundancy that nothing bad has happened as a result so everyone goes on with life. I think this is just low hanging defcon fruit targeting non aviation-aware readers. [1] https://www.youtube.com/watch?v=ZvA_-linhg8 https://www.youtube.com/watch?v=ZvA_-linhg8
- themark 8y agoHow about MCAS?
- outworlder 8y agoIrrelevant to this discussion.
- deleted 7y ago[deleted]
- NikkiA 7y agoI think the point being made is that this feels an awful lot like a 'hey, don't keep talking about mcas.... look at this huge problem that terrorists might exploit (if they rent die hard 2), look how scary it is, boogaboogaboo'
- pageandrew 7y agoI didn't know we could only talk about one thing at a time. I don't think anyone has forgotten about MCAS
- meatmanek 8y agoILS works pretty much the same way as the Lorenz/Knickebein system used in WWII by the Germans to guide bombers (described in https://news.ycombinator.com/item?id=19737056 https://news.ycombinator.com/item?id=19737056), so the attack described in TFA sounds basically the same as the countermeasures deployed by the British.
- xvf22 8y agoHFDL and ACARS (encryption is optional) don't have much in the way of protection either.
- ChuckMcM 8y agoGiven my sort of 'maker' inclinations, I find these articles amusing. The "3D print a gun!" ones were similar. Basically they come down to, if you learn how a system works, or how something is made, you can learn to implement or influence that system and/or build that thing. Back in the 60's the click bait was "kid learns how to build an atomic bomb!" This was pretty eye catching but really it is just physics, material science, and a bit of math. That said, so many people rarely look past the surface of things, seeing something like a cell phone as an opaque magical brick that can do wondrous things. And yet all that the phone does, and how it does it, are knowable if someone chooses to invest the time. (admittedly it is a lot of time if you don't have the basics). The headline, "People who know how radios work can affect systems that are based on radio." is so much less scary.
- Chris_Chambers 7y agoThis comment is useless.
- wolf550e 7y agoIt is interesting to know whether a system that is important for safety and/or security is susceptible to hijacking by anyone who can build a radio or whether it is protected using secure cryptography (and then, who holds the keys). If, for example, simply transmitting in the clear on the right frequency can get the airliner to try to land on a virtual runway that is 20 feet below the real one - that is interesting.
- bdamm 7y agoThat would actually be pretty hard, since the airliner uses their own altimeter and radar to determine how close they are to the runway. Much easier would be to put the runway where it doesn't exist, such as at the foot of a cluster of tall buildings or hillside that is a mile from the actual location. A strong transmitter and directional antenna would be effective. It would be a once-only attack, because the FCC, FAA, FBI would all be on maximum alert after that. There's also a good chance it wouldn't work because the airliner is cross checking its position with GPS, ATC is cross checking with radar, and there's a good chance either the pilot or ATC will abort due to confusion over position.
- bjt2n3904 7y agoThere's too much sensation on this headline. The hacker does not take control of the aircraft, simply gives misleading information to the pilot. "Hacking" is a bit of a heavy handed word here, too.
- mopsi 7y agoSkimmed over the whitepaper and did not notice any mention of ILS monitoring systems. Modern ILS has continuous automatic monitoring that triggers alerts or shuts off the whole system if disturbance of beam characteristics is detected. Such monitoring systems date back to 1960s: https://sci-hub.tw/10.1049/ree.1967.0009 https://sci-hub.tw/10.1049/ree.1967.0009
- sdca 7y agoSounds like a single point of failure if the pilots rely on ATC too much. Low visibility landings and such.
- mlindner 7y agoThis is well known and has been for decades. Unlike attacks based on the internet though it’s trivial to track down people who are doing illegal broadcasts. There isn’t a concern here.
- sbhn 7y agoI can see all the politicians lining up now, “ME, ME, ME. Let ME remind the people that they are under attack”, from something they have no control over