7 ms·

Given my sort of 'maker' inclinations, I find these articles amusing. The "3D print a gun!" ones were similar. Basically they come down to, if you learn how a

Given my sort of 'maker' inclinations, I find these articles amusing. The "3D print a gun!" ones were similar. Basically they come down to, if you learn how a system works, or how something is made, you can learn to implement or influence that system and/or build that thing. Back in the 60's the click bait was "kid learns how to build an atomic bomb!" This was pretty eye catching but really it is just physics, material science, and a bit of math. That said, so many people rarely look past the surface of things, seeing something like a cell phone as an opaque magical brick that can do wondrous things. And yet all that the phone does, and how it does it, are knowable if someone chooses to invest the time. (admittedly it is a lot of time if you don't have the basics). The headline, "People who know how radios work can affect systems that are based on radio." is so much less scary.

Chris_Chambers 8y ago
This comment is useless.
wolf550e 8y ago
It is interesting to know whether a system that is important for safety and/or security is susceptible to hijacking by anyone who can build a radio or whether it is protected using secure cryptography (and then, who holds the keys). If, for example, simply transmitting in the clear on the right frequency can get the airliner to try to land on a virtual runway that is 20 feet below the real one - that is interesting.
- bdamm 8y ago
  That would actually be pretty hard, since the airliner uses their own altimeter and radar to determine how close they are to the runway. Much easier would be to put the runway where it doesn't exist, such as at the foot of a cluster of tall buildings or hillside that is a mile from the actual location. A strong transmitter and directional antenna would be effective. It would be a once-only attack, because the FCC, FAA, FBI would all be on maximum alert after that. There's also a good chance it wouldn't work because the airliner is cross checking its position with GPS, ATC is cross checking with radar, and there's a good chance either the pilot or ATC will abort due to confusion over position.
  - Johnny555 8y ago
    They don't have to deflect the plane that far -- if they can just deflect it 100 ft to the side to land on a busy taxiway or a parallel runway that's under construction with heavy equipment on it, that could cause a disastrous crash (or to land 100 ft before the start of the runway onto a freeway or water) Ideally the pilot would notice and correct, but in poor visibility, maybe they wouldn't have time.
    - stouset 8y ago
      AIUI, these systems rely on physical placement of the transmitters, so deflecting a plane by 100ft requires your transmitter to be more or less 100ft offset from the real one. At least, this is true of TACAN, maybe ILS is different.
- rixed 8y ago
  That may be interesting, but the fact that airliners could be fooled or even crashed by interfering with the radio signals they rely on is no more a security concern that the fact that airliners can be shoot down with missiles.
  - Johnny555 8y ago
    There's plenty of reasons why a simple radio attack is potentially more serious than a missile attack. It's a lot easier to buy an SDR than a SAM -- even ignoring the cost differential. I don't know the black market cost of a man portable SAM, but the SDR described in the article is less than $1000 and you can buy it commercially. If you're caught with an SDR in your suitcase, no one will likely know what it is "I use it to listen to shortwave, here, I'll demo", while if you're caught with a SAM, you'll likely end up in jail. No one is going to build a SAM in their hotel room, but it doesn't take much specialized skill to solder together a radio jammer using schematics transferred to you over the internet. And finally, you can use the radio jammer from a backpack and no one will know it's there, but the SAM will leave a trail leading back to you.
    - inferiorhuman 8y ago
      It's a lot easier to buy an SDR than a SAM -- even ignoring the cost differential. Building an SDR which can output a signal strong enough to overpower the ILS array is not going to be cheap, subtle, or particularly easy. ILS is glitchy and pilots are trained to deal with the glitches — a localizer can be disrupted merely by having a plane (or any other large metal object) nearby.
- ChuckMcM 8y ago
  I agree with this basic sentiment, there is a whole class of problems that were "hard" before modern technology made them "easy". It is definitely interesting to look at legacy systems that relied on the 'difficulty' factor as part of their design as a protection against abuse. For example it was both inspiring and utterly brilliant in the way that Alan Turing broke the Enigma cipher with his Bombe machine, but today anyone who knew how Enigma worked (which England did at the time) with a modern laptop could exhaustively search the keyspace and 'crack' messages in real time. Software radios have made it possible for curious people to have "read/write" access to the entire spectrum between half a megahertz and six gigahertz. That will continue to be a problem for people who designed systems that depended on how "difficult" it was to build a radio at their particular frequency. That isn't the case for Aircraft navigation. Anyone who can pass the Amateur "General' class exam in the US has the necessary knowledge for interfering, potentially destructively, with aircraft navigation. I normally would consider that a non-issue except that Asian Airlines flew a plane into the runway at SFO. Is that a system problem? Or one where the pilot should be better trained? Arguments can probably made along those lines. But that interfering with navigation is possible with pretty much "off the shelf" components? Not really a new thing and certainly not something that is an imminent threat to passenger safety.
  - wolf550e 8y ago
    I don't know how aircraft systems work. Can a directional antenna spoofing ILS [2] cause the crash of an airliner using ILS to land in bad visibility conditions? Does the plane trust the ILS signal? What if you combine that with a GPS jammer or GPS spoofer? Or do we consider that military technology, like MANPADs, and so out of scope? But some airlines consider MANPADs in scope, and use flares or laser systems to defend against them [1]. 1 - https://en.wikipedia.org/wiki/Flight_Guard https://en.wikipedia.org/wiki/Flight_Guard 2 - https://en.wikipedia.org/wiki/Instrument_landing_system https://en.wikipedia.org/wiki/Instrument_landing_system
    - colechristensen 8y ago
      When you know answers to questions like this it becomes an ethical question whether to share your knowledge.
- femto 8y ago
  A set of encryption keys for a critical system is another point of failure: when there is a problem with the keys the system stops working. I'd posit that the risk of a failure due to a problem with the keys is greater than the risk of a failure due to spoofing, so the safest solution in practise is to leave the encryption out until failures due to spoofing are more common than failure due to keys (meaning it is unlikely that encryption will ever be installed).
  - angry_octet 8y ago
    And because of this, systems often fall back to cleartext (esp for ILS which would need backwards compatibility). This allows for jamming sufficient to cause crypto decoding error, forcing failover to cleartext. Spread spectrum (e.g. frequency hopping) can mitigate this by improving jam margin, but still requires key material. The best response is probably jamming (seduction) detection, through good data fusion algorithms. Hard to do directive jamming without sidelobe leakage that could be detected on the ground. Transmitting a signed (AEAD) bitstream should be possible by publishing a public key in the NOTAM. The cost decrease in DRFMs (SDRs) also means that deploying radio receivers with upgradable waveforms is also much cheaper.
  - AnaniasAnanas 8y ago
    For something like airplane signals you do not need encryption though - you only need to verify the integrity of the data, which is done either by signatures or MACs.
- tgsovlerkhgsel 8y ago
  No encryption whatsoever. The systems are primitive analog systems, about the level of WW2 guidance technology. This is also not news to anyone who bothered to read Wikipedia or Stackexchange. https://en.wikipedia.org/wiki/Instrument_landing_system https://en.wikipedia.org/wiki/Instrument_landing_system and https://aviation.stackexchange.com/a/2661 https://aviation.stackexchange.com/a/2661, compare https://en.wikipedia.org/wiki/Battle_of_the_Beams https://en.wikipedia.org/wiki/Battle_of_the_Beams
jonplackett 8y ago
The thing I like best about HN is that when a headline looks a bit clickbaity I can just read the first few comments and confirm my suspicions. No need to actually read this one. Thanks guys.
jlg23 8y ago
> The headline, "People who know how radios work can affect systems that are based on radio." is so much less scary. No, it is not. Nobody should be able to influence air traffic in that way just because she/he understands the transport layer. After spending a night with a friend who just returned from a security audit (lots of cocktails were involved too) 15 years ago, I am convinced that the only reason we have not seen major disruptions yet is because of a pretty strict adherence to hacker ethics: one of the global "airport tech players" was deploying systems that used UDP for ground traffic control.... Having a bus or lorry use an active runway is just a single, malicious UDP packet away...
- mopsi 8y ago
  > Having a bus or lorry use an active runway is just a single, malicious UDP packet away... There are multiple safeguards in place to avoid single points of failure, such as runway crossing procedures with mandatory call to air traffic control unit for explicit permission before entering a runway. Many ATC recordings on VASAviation Youtube channel show that even rescue services (during emergencies) adhere to that. Taxiways leading to runways are marked with holding positions that may not be crossed without authorization: https://i.imgur.com/dCF8lFi.jpg https://i.imgur.com/dCF8lFi.jpg For extra visibility in poor weather, many airports are also equipped with runway guard lights paved into the ground or blinking on either side of the taxiway: https://i.imgur.com/dbix1Aw.png https://i.imgur.com/dbix1Aw.png Surface movement radars and transponder-based systems have also become widespread. They trigger alerts when a vehicle is about to enter an active runway: https://i.imgur.com/sJQ94zq.jpg https://i.imgur.com/sJQ94zq.jpg
  - djsumdog 8y ago
    True, and you have real pilots. Many really busy airports do visual approaches and I know a couple pilots personally who don't often bother with ILS unless the conditions are bad. Remember in San Fransisco where a plane almost landed on a taxi way instead of the runway? It's worth reading the complex situation with the off-line runway and the way ILS was setup with those runways being so close together, but what prevented the disaster was a pilot in the Taxi line of aircraft getting on the radio and saying, "Where is this guy going?!" and everyone suddenly realizing they were lined up for the Taxi way! Real people, being aware, looking and reacting prevented that accident. That's why human checks and cross-checks are so important.
deleted 8y ago
[deleted]
OrgNet 8y ago
It appears to be a huge problem... perhaps messages sent over the air for such an important system should be crypto-signed? It reminds me of when the Army's drone was diverted and captured because someone spoofed GPS... It probably isn't possible to capture a drone in the same way anymore because I'm sure that they fixed this flaw. It's like the HTTP vs HTTPS problem ... but anyone can MITM attack because the signal is wireless (and not encrypted and/or signed).
- 420codebro 8y ago
  GPS has the M-Code (Military code). It is only authorized for cleared applications / personnel. This is what missiles and military aircraft use. Why that drone was not using the M-Code (or similar protected NAV/GPS information) is beyond me. FYI, the benefit of M-Code: 1 - It chirps at 10x the rate of Civilian GPS signal. 2 - It is on different frequency, thus jamming "GPS" will most likely not jam the M-Code. 3 - It is encrypted.
- MindySS 7y ago
  It’s not surprising that Google prefers reliable sites with a valid server certificate. In this case, the user can be sure that the site uses encryption of personal data to increase protection and security. However, it must be understood that obtaining a certificate can be a daunting task (which accounts for the additional weight of this factor when ranking). When a site requests a certificate, the organization that issued the certificate becomes a trusted third party to read more here https://sitechecker.pro/http-vs-https/ https://sitechecker.pro/http-vs-https/ and check it. When your browser accesses a site that uses the secure HTTPS protocol, it uses the information contained in the certificate to authenticate the site. A user who understands the difference between HTTP and HTTPS, can safely make purchases, and not be afraid that his data will be stolen.
gcb0 8y ago
that's why you flag them and move on.
lutorm 8y ago
ILS is ancient. "Tests of the ILS system began in 1929 in the United States." It's really just a radio beam. It's no wonder it can be mucked with.

Chris_Chambers 8y ago

This comment is useless.

wolf550e 8y ago

It is interesting to know whether a system that is important for safety and/or security is susceptible to hijacking by anyone who can build a radio or whether it is protected using secure cryptography (and then, who holds the keys). If, for example, simply transmitting in the clear on the right frequency can get the airliner to try to land on a virtual runway that is 20 feet below the real one - that is interesting.

bdamm 8y ago
That would actually be pretty hard, since the airliner uses their own altimeter and radar to determine how close they are to the runway. Much easier would be to put the runway where it doesn't exist, such as at the foot of a cluster of tall buildings or hillside that is a mile from the actual location. A strong transmitter and directional antenna would be effective. It would be a once-only attack, because the FCC, FAA, FBI would all be on maximum alert after that. There's also a good chance it wouldn't work because the airliner is cross checking its position with GPS, ATC is cross checking with radar, and there's a good chance either the pilot or ATC will abort due to confusion over position.
- Johnny555 8y ago
  They don't have to deflect the plane that far -- if they can just deflect it 100 ft to the side to land on a busy taxiway or a parallel runway that's under construction with heavy equipment on it, that could cause a disastrous crash (or to land 100 ft before the start of the runway onto a freeway or water) Ideally the pilot would notice and correct, but in poor visibility, maybe they wouldn't have time.
  - stouset 8y ago
    AIUI, these systems rely on physical placement of the transmitters, so deflecting a plane by 100ft requires your transmitter to be more or less 100ft offset from the real one. At least, this is true of TACAN, maybe ILS is different.
rixed 8y ago
That may be interesting, but the fact that airliners could be fooled or even crashed by interfering with the radio signals they rely on is no more a security concern that the fact that airliners can be shoot down with missiles.
- Johnny555 8y ago
  There's plenty of reasons why a simple radio attack is potentially more serious than a missile attack. It's a lot easier to buy an SDR than a SAM -- even ignoring the cost differential. I don't know the black market cost of a man portable SAM, but the SDR described in the article is less than $1000 and you can buy it commercially. If you're caught with an SDR in your suitcase, no one will likely know what it is "I use it to listen to shortwave, here, I'll demo", while if you're caught with a SAM, you'll likely end up in jail. No one is going to build a SAM in their hotel room, but it doesn't take much specialized skill to solder together a radio jammer using schematics transferred to you over the internet. And finally, you can use the radio jammer from a backpack and no one will know it's there, but the SAM will leave a trail leading back to you.
  - inferiorhuman 8y ago
    It's a lot easier to buy an SDR than a SAM -- even ignoring the cost differential. Building an SDR which can output a signal strong enough to overpower the ILS array is not going to be cheap, subtle, or particularly easy. ILS is glitchy and pilots are trained to deal with the glitches — a localizer can be disrupted merely by having a plane (or any other large metal object) nearby.
ChuckMcM 8y ago
I agree with this basic sentiment, there is a whole class of problems that were "hard" before modern technology made them "easy". It is definitely interesting to look at legacy systems that relied on the 'difficulty' factor as part of their design as a protection against abuse. For example it was both inspiring and utterly brilliant in the way that Alan Turing broke the Enigma cipher with his Bombe machine, but today anyone who knew how Enigma worked (which England did at the time) with a modern laptop could exhaustively search the keyspace and 'crack' messages in real time. Software radios have made it possible for curious people to have "read/write" access to the entire spectrum between half a megahertz and six gigahertz. That will continue to be a problem for people who designed systems that depended on how "difficult" it was to build a radio at their particular frequency. That isn't the case for Aircraft navigation. Anyone who can pass the Amateur "General' class exam in the US has the necessary knowledge for interfering, potentially destructively, with aircraft navigation. I normally would consider that a non-issue except that Asian Airlines flew a plane into the runway at SFO. Is that a system problem? Or one where the pilot should be better trained? Arguments can probably made along those lines. But that interfering with navigation is possible with pretty much "off the shelf" components? Not really a new thing and certainly not something that is an imminent threat to passenger safety.
- wolf550e 8y ago
  I don't know how aircraft systems work. Can a directional antenna spoofing ILS [2] cause the crash of an airliner using ILS to land in bad visibility conditions? Does the plane trust the ILS signal? What if you combine that with a GPS jammer or GPS spoofer? Or do we consider that military technology, like MANPADs, and so out of scope? But some airlines consider MANPADs in scope, and use flares or laser systems to defend against them [1]. 1 - https://en.wikipedia.org/wiki/Flight_Guard https://en.wikipedia.org/wiki/Flight_Guard 2 - https://en.wikipedia.org/wiki/Instrument_landing_system https://en.wikipedia.org/wiki/Instrument_landing_system
  - colechristensen 8y ago
    When you know answers to questions like this it becomes an ethical question whether to share your knowledge.
femto 8y ago
A set of encryption keys for a critical system is another point of failure: when there is a problem with the keys the system stops working. I'd posit that the risk of a failure due to a problem with the keys is greater than the risk of a failure due to spoofing, so the safest solution in practise is to leave the encryption out until failures due to spoofing are more common than failure due to keys (meaning it is unlikely that encryption will ever be installed).
- angry_octet 8y ago
  And because of this, systems often fall back to cleartext (esp for ILS which would need backwards compatibility). This allows for jamming sufficient to cause crypto decoding error, forcing failover to cleartext. Spread spectrum (e.g. frequency hopping) can mitigate this by improving jam margin, but still requires key material. The best response is probably jamming (seduction) detection, through good data fusion algorithms. Hard to do directive jamming without sidelobe leakage that could be detected on the ground. Transmitting a signed (AEAD) bitstream should be possible by publishing a public key in the NOTAM. The cost decrease in DRFMs (SDRs) also means that deploying radio receivers with upgradable waveforms is also much cheaper.
- AnaniasAnanas 8y ago
  For something like airplane signals you do not need encryption though - you only need to verify the integrity of the data, which is done either by signatures or MACs.
tgsovlerkhgsel 8y ago
No encryption whatsoever. The systems are primitive analog systems, about the level of WW2 guidance technology. This is also not news to anyone who bothered to read Wikipedia or Stackexchange. https://en.wikipedia.org/wiki/Instrument_landing_system https://en.wikipedia.org/wiki/Instrument_landing_system and https://aviation.stackexchange.com/a/2661 https://aviation.stackexchange.com/a/2661, compare https://en.wikipedia.org/wiki/Battle_of_the_Beams https://en.wikipedia.org/wiki/Battle_of_the_Beams

jonplackett 8y ago

The thing I like best about HN is that when a headline looks a bit clickbaity I can just read the first few comments and confirm my suspicions. No need to actually read this one. Thanks guys.

jlg23 8y ago

> The headline, "People who know how radios work can affect systems that are based on radio." is so much less scary. No, it is not. Nobody should be able to influence air traffic in that way just because she/he understands the transport layer. After spending a night with a friend who just returned from a security audit (lots of cocktails were involved too) 15 years ago, I am convinced that the only reason we have not seen major disruptions yet is because of a pretty strict adherence to hacker ethics: one of the global "airport tech players" was deploying systems that used UDP for ground traffic control.... Having a bus or lorry use an active runway is just a single, malicious UDP packet away...

mopsi 8y ago
> Having a bus or lorry use an active runway is just a single, malicious UDP packet away... There are multiple safeguards in place to avoid single points of failure, such as runway crossing procedures with mandatory call to air traffic control unit for explicit permission before entering a runway. Many ATC recordings on VASAviation Youtube channel show that even rescue services (during emergencies) adhere to that. Taxiways leading to runways are marked with holding positions that may not be crossed without authorization: https://i.imgur.com/dCF8lFi.jpg https://i.imgur.com/dCF8lFi.jpg For extra visibility in poor weather, many airports are also equipped with runway guard lights paved into the ground or blinking on either side of the taxiway: https://i.imgur.com/dbix1Aw.png https://i.imgur.com/dbix1Aw.png Surface movement radars and transponder-based systems have also become widespread. They trigger alerts when a vehicle is about to enter an active runway: https://i.imgur.com/sJQ94zq.jpg https://i.imgur.com/sJQ94zq.jpg
- djsumdog 8y ago
  True, and you have real pilots. Many really busy airports do visual approaches and I know a couple pilots personally who don't often bother with ILS unless the conditions are bad. Remember in San Fransisco where a plane almost landed on a taxi way instead of the runway? It's worth reading the complex situation with the off-line runway and the way ILS was setup with those runways being so close together, but what prevented the disaster was a pilot in the Taxi line of aircraft getting on the radio and saying, "Where is this guy going?!" and everyone suddenly realizing they were lined up for the Taxi way! Real people, being aware, looking and reacting prevented that accident. That's why human checks and cross-checks are so important.

deleted 8y ago

[deleted]

OrgNet 8y ago

It appears to be a huge problem... perhaps messages sent over the air for such an important system should be crypto-signed? It reminds me of when the Army's drone was diverted and captured because someone spoofed GPS... It probably isn't possible to capture a drone in the same way anymore because I'm sure that they fixed this flaw. It's like the HTTP vs HTTPS problem ... but anyone can MITM attack because the signal is wireless (and not encrypted and/or signed).

420codebro 8y ago
GPS has the M-Code (Military code). It is only authorized for cleared applications / personnel. This is what missiles and military aircraft use. Why that drone was not using the M-Code (or similar protected NAV/GPS information) is beyond me. FYI, the benefit of M-Code: 1 - It chirps at 10x the rate of Civilian GPS signal. 2 - It is on different frequency, thus jamming "GPS" will most likely not jam the M-Code. 3 - It is encrypted.
MindySS 7y ago
It’s not surprising that Google prefers reliable sites with a valid server certificate. In this case, the user can be sure that the site uses encryption of personal data to increase protection and security. However, it must be understood that obtaining a certificate can be a daunting task (which accounts for the additional weight of this factor when ranking). When a site requests a certificate, the organization that issued the certificate becomes a trusted third party to read more here https://sitechecker.pro/http-vs-https/ https://sitechecker.pro/http-vs-https/ and check it. When your browser accesses a site that uses the secure HTTPS protocol, it uses the information contained in the certificate to authenticate the site. A user who understands the difference between HTTP and HTTPS, can safely make purchases, and not be afraid that his data will be stolen.

gcb0 8y ago

that's why you flag them and move on.

lutorm 8y ago

ILS is ancient. "Tests of the ILS system began in 1929 in the United States." It's really just a radio beam. It's no wonder it can be mucked with.