4 ms·

It is interesting to know whether a system that is important for safety and/or security is susceptible to hijacking by anyone who can build a radio or whether i

It is interesting to know whether a system that is important for safety and/or security is susceptible to hijacking by anyone who can build a radio or whether it is protected using secure cryptography (and then, who holds the keys). If, for example, simply transmitting in the clear on the right frequency can get the airliner to try to land on a virtual runway that is 20 feet below the real one - that is interesting.

bdamm 7y ago
That would actually be pretty hard, since the airliner uses their own altimeter and radar to determine how close they are to the runway. Much easier would be to put the runway where it doesn't exist, such as at the foot of a cluster of tall buildings or hillside that is a mile from the actual location. A strong transmitter and directional antenna would be effective. It would be a once-only attack, because the FCC, FAA, FBI would all be on maximum alert after that. There's also a good chance it wouldn't work because the airliner is cross checking its position with GPS, ATC is cross checking with radar, and there's a good chance either the pilot or ATC will abort due to confusion over position.
- Johnny555 7y ago
  They don't have to deflect the plane that far -- if they can just deflect it 100 ft to the side to land on a busy taxiway or a parallel runway that's under construction with heavy equipment on it, that could cause a disastrous crash (or to land 100 ft before the start of the runway onto a freeway or water) Ideally the pilot would notice and correct, but in poor visibility, maybe they wouldn't have time.
  - stouset 7y ago
    AIUI, these systems rely on physical placement of the transmitters, so deflecting a plane by 100ft requires your transmitter to be more or less 100ft offset from the real one. At least, this is true of TACAN, maybe ILS is different.
rixed 7y ago
That may be interesting, but the fact that airliners could be fooled or even crashed by interfering with the radio signals they rely on is no more a security concern that the fact that airliners can be shoot down with missiles.
- Johnny555 7y ago
  There's plenty of reasons why a simple radio attack is potentially more serious than a missile attack. It's a lot easier to buy an SDR than a SAM -- even ignoring the cost differential. I don't know the black market cost of a man portable SAM, but the SDR described in the article is less than $1000 and you can buy it commercially. If you're caught with an SDR in your suitcase, no one will likely know what it is "I use it to listen to shortwave, here, I'll demo", while if you're caught with a SAM, you'll likely end up in jail. No one is going to build a SAM in their hotel room, but it doesn't take much specialized skill to solder together a radio jammer using schematics transferred to you over the internet. And finally, you can use the radio jammer from a backpack and no one will know it's there, but the SAM will leave a trail leading back to you.
  - inferiorhuman 7y ago
    It's a lot easier to buy an SDR than a SAM -- even ignoring the cost differential. Building an SDR which can output a signal strong enough to overpower the ILS array is not going to be cheap, subtle, or particularly easy. ILS is glitchy and pilots are trained to deal with the glitches — a localizer can be disrupted merely by having a plane (or any other large metal object) nearby.
ChuckMcM 7y ago
I agree with this basic sentiment, there is a whole class of problems that were "hard" before modern technology made them "easy". It is definitely interesting to look at legacy systems that relied on the 'difficulty' factor as part of their design as a protection against abuse. For example it was both inspiring and utterly brilliant in the way that Alan Turing broke the Enigma cipher with his Bombe machine, but today anyone who knew how Enigma worked (which England did at the time) with a modern laptop could exhaustively search the keyspace and 'crack' messages in real time. Software radios have made it possible for curious people to have "read/write" access to the entire spectrum between half a megahertz and six gigahertz. That will continue to be a problem for people who designed systems that depended on how "difficult" it was to build a radio at their particular frequency. That isn't the case for Aircraft navigation. Anyone who can pass the Amateur "General' class exam in the US has the necessary knowledge for interfering, potentially destructively, with aircraft navigation. I normally would consider that a non-issue except that Asian Airlines flew a plane into the runway at SFO. Is that a system problem? Or one where the pilot should be better trained? Arguments can probably made along those lines. But that interfering with navigation is possible with pretty much "off the shelf" components? Not really a new thing and certainly not something that is an imminent threat to passenger safety.
- wolf550e 7y ago
  I don't know how aircraft systems work. Can a directional antenna spoofing ILS [2] cause the crash of an airliner using ILS to land in bad visibility conditions? Does the plane trust the ILS signal? What if you combine that with a GPS jammer or GPS spoofer? Or do we consider that military technology, like MANPADs, and so out of scope? But some airlines consider MANPADs in scope, and use flares or laser systems to defend against them [1]. 1 - https://en.wikipedia.org/wiki/Flight_Guard https://en.wikipedia.org/wiki/Flight_Guard 2 - https://en.wikipedia.org/wiki/Instrument_landing_system https://en.wikipedia.org/wiki/Instrument_landing_system
  - colechristensen 7y ago
    When you know answers to questions like this it becomes an ethical question whether to share your knowledge.
femto 7y ago
A set of encryption keys for a critical system is another point of failure: when there is a problem with the keys the system stops working. I'd posit that the risk of a failure due to a problem with the keys is greater than the risk of a failure due to spoofing, so the safest solution in practise is to leave the encryption out until failures due to spoofing are more common than failure due to keys (meaning it is unlikely that encryption will ever be installed).
- angry_octet 7y ago
  And because of this, systems often fall back to cleartext (esp for ILS which would need backwards compatibility). This allows for jamming sufficient to cause crypto decoding error, forcing failover to cleartext. Spread spectrum (e.g. frequency hopping) can mitigate this by improving jam margin, but still requires key material. The best response is probably jamming (seduction) detection, through good data fusion algorithms. Hard to do directive jamming without sidelobe leakage that could be detected on the ground. Transmitting a signed (AEAD) bitstream should be possible by publishing a public key in the NOTAM. The cost decrease in DRFMs (SDRs) also means that deploying radio receivers with upgradable waveforms is also much cheaper.
- AnaniasAnanas 7y ago
  For something like airplane signals you do not need encryption though - you only need to verify the integrity of the data, which is done either by signatures or MACs.
tgsovlerkhgsel 7y ago
No encryption whatsoever. The systems are primitive analog systems, about the level of WW2 guidance technology. This is also not news to anyone who bothered to read Wikipedia or Stackexchange. https://en.wikipedia.org/wiki/Instrument_landing_system https://en.wikipedia.org/wiki/Instrument_landing_system and https://aviation.stackexchange.com/a/2661 https://aviation.stackexchange.com/a/2661, compare https://en.wikipedia.org/wiki/Battle_of_the_Beams https://en.wikipedia.org/wiki/Battle_of_the_Beams

bdamm 7y ago

That would actually be pretty hard, since the airliner uses their own altimeter and radar to determine how close they are to the runway. Much easier would be to put the runway where it doesn't exist, such as at the foot of a cluster of tall buildings or hillside that is a mile from the actual location. A strong transmitter and directional antenna would be effective. It would be a once-only attack, because the FCC, FAA, FBI would all be on maximum alert after that. There's also a good chance it wouldn't work because the airliner is cross checking its position with GPS, ATC is cross checking with radar, and there's a good chance either the pilot or ATC will abort due to confusion over position.

Johnny555 7y ago
They don't have to deflect the plane that far -- if they can just deflect it 100 ft to the side to land on a busy taxiway or a parallel runway that's under construction with heavy equipment on it, that could cause a disastrous crash (or to land 100 ft before the start of the runway onto a freeway or water) Ideally the pilot would notice and correct, but in poor visibility, maybe they wouldn't have time.
- stouset 7y ago
  AIUI, these systems rely on physical placement of the transmitters, so deflecting a plane by 100ft requires your transmitter to be more or less 100ft offset from the real one. At least, this is true of TACAN, maybe ILS is different.

rixed 7y ago

That may be interesting, but the fact that airliners could be fooled or even crashed by interfering with the radio signals they rely on is no more a security concern that the fact that airliners can be shoot down with missiles.

Johnny555 7y ago
There's plenty of reasons why a simple radio attack is potentially more serious than a missile attack. It's a lot easier to buy an SDR than a SAM -- even ignoring the cost differential. I don't know the black market cost of a man portable SAM, but the SDR described in the article is less than $1000 and you can buy it commercially. If you're caught with an SDR in your suitcase, no one will likely know what it is "I use it to listen to shortwave, here, I'll demo", while if you're caught with a SAM, you'll likely end up in jail. No one is going to build a SAM in their hotel room, but it doesn't take much specialized skill to solder together a radio jammer using schematics transferred to you over the internet. And finally, you can use the radio jammer from a backpack and no one will know it's there, but the SAM will leave a trail leading back to you.
- inferiorhuman 7y ago
  It's a lot easier to buy an SDR than a SAM -- even ignoring the cost differential. Building an SDR which can output a signal strong enough to overpower the ILS array is not going to be cheap, subtle, or particularly easy. ILS is glitchy and pilots are trained to deal with the glitches — a localizer can be disrupted merely by having a plane (or any other large metal object) nearby.

ChuckMcM 7y ago

I agree with this basic sentiment, there is a whole class of problems that were "hard" before modern technology made them "easy". It is definitely interesting to look at legacy systems that relied on the 'difficulty' factor as part of their design as a protection against abuse. For example it was both inspiring and utterly brilliant in the way that Alan Turing broke the Enigma cipher with his Bombe machine, but today anyone who knew how Enigma worked (which England did at the time) with a modern laptop could exhaustively search the keyspace and 'crack' messages in real time. Software radios have made it possible for curious people to have "read/write" access to the entire spectrum between half a megahertz and six gigahertz. That will continue to be a problem for people who designed systems that depended on how "difficult" it was to build a radio at their particular frequency. That isn't the case for Aircraft navigation. Anyone who can pass the Amateur "General' class exam in the US has the necessary knowledge for interfering, potentially destructively, with aircraft navigation. I normally would consider that a non-issue except that Asian Airlines flew a plane into the runway at SFO. Is that a system problem? Or one where the pilot should be better trained? Arguments can probably made along those lines. But that interfering with navigation is possible with pretty much "off the shelf" components? Not really a new thing and certainly not something that is an imminent threat to passenger safety.

wolf550e 7y ago
I don't know how aircraft systems work. Can a directional antenna spoofing ILS [2] cause the crash of an airliner using ILS to land in bad visibility conditions? Does the plane trust the ILS signal? What if you combine that with a GPS jammer or GPS spoofer? Or do we consider that military technology, like MANPADs, and so out of scope? But some airlines consider MANPADs in scope, and use flares or laser systems to defend against them [1]. 1 - https://en.wikipedia.org/wiki/Flight_Guard https://en.wikipedia.org/wiki/Flight_Guard 2 - https://en.wikipedia.org/wiki/Instrument_landing_system https://en.wikipedia.org/wiki/Instrument_landing_system
- colechristensen 7y ago
  When you know answers to questions like this it becomes an ethical question whether to share your knowledge.

femto 7y ago

A set of encryption keys for a critical system is another point of failure: when there is a problem with the keys the system stops working. I'd posit that the risk of a failure due to a problem with the keys is greater than the risk of a failure due to spoofing, so the safest solution in practise is to leave the encryption out until failures due to spoofing are more common than failure due to keys (meaning it is unlikely that encryption will ever be installed).

angry_octet 7y ago
And because of this, systems often fall back to cleartext (esp for ILS which would need backwards compatibility). This allows for jamming sufficient to cause crypto decoding error, forcing failover to cleartext. Spread spectrum (e.g. frequency hopping) can mitigate this by improving jam margin, but still requires key material. The best response is probably jamming (seduction) detection, through good data fusion algorithms. Hard to do directive jamming without sidelobe leakage that could be detected on the ground. Transmitting a signed (AEAD) bitstream should be possible by publishing a public key in the NOTAM. The cost decrease in DRFMs (SDRs) also means that deploying radio receivers with upgradable waveforms is also much cheaper.
AnaniasAnanas 7y ago
For something like airplane signals you do not need encryption though - you only need to verify the integrity of the data, which is done either by signatures or MACs.

tgsovlerkhgsel 7y ago

No encryption whatsoever. The systems are primitive analog systems, about the level of WW2 guidance technology. This is also not news to anyone who bothered to read Wikipedia or Stackexchange. https://en.wikipedia.org/wiki/Instrument_landing_system https://en.wikipedia.org/wiki/Instrument_landing_system and https://aviation.stackexchange.com/a/2661 https://aviation.stackexchange.com/a/2661, compare https://en.wikipedia.org/wiki/Battle_of_the_Beams https://en.wikipedia.org/wiki/Battle_of_the_Beams