5 ms·

> The headline, "People who know how radios work can affect systems that are based on radio." is so much less scary. No, it is not. Nobody should be able to in

by jlg23 7y ago

> The headline, "People who know how radios work can affect systems that are based on radio." is so much less scary. No, it is not. Nobody should be able to influence air traffic in that way just because she/he understands the transport layer. After spending a night with a friend who just returned from a security audit (lots of cocktails were involved too) 15 years ago, I am convinced that the only reason we have not seen major disruptions yet is because of a pretty strict adherence to hacker ethics: one of the global "airport tech players" was deploying systems that used UDP for ground traffic control.... Having a bus or lorry use an active runway is just a single, malicious UDP packet away...

mopsi 7y ago
> Having a bus or lorry use an active runway is just a single, malicious UDP packet away... There are multiple safeguards in place to avoid single points of failure, such as runway crossing procedures with mandatory call to air traffic control unit for explicit permission before entering a runway. Many ATC recordings on VASAviation Youtube channel show that even rescue services (during emergencies) adhere to that. Taxiways leading to runways are marked with holding positions that may not be crossed without authorization: https://i.imgur.com/dCF8lFi.jpg https://i.imgur.com/dCF8lFi.jpg For extra visibility in poor weather, many airports are also equipped with runway guard lights paved into the ground or blinking on either side of the taxiway: https://i.imgur.com/dbix1Aw.png https://i.imgur.com/dbix1Aw.png Surface movement radars and transponder-based systems have also become widespread. They trigger alerts when a vehicle is about to enter an active runway: https://i.imgur.com/sJQ94zq.jpg https://i.imgur.com/sJQ94zq.jpg
- djsumdog 7y ago
  True, and you have real pilots. Many really busy airports do visual approaches and I know a couple pilots personally who don't often bother with ILS unless the conditions are bad. Remember in San Fransisco where a plane almost landed on a taxi way instead of the runway? It's worth reading the complex situation with the off-line runway and the way ILS was setup with those runways being so close together, but what prevented the disaster was a pilot in the Taxi line of aircraft getting on the radio and saying, "Where is this guy going?!" and everyone suddenly realizing they were lined up for the Taxi way! Real people, being aware, looking and reacting prevented that accident. That's why human checks and cross-checks are so important.
  - godelski 7y ago
    > I know a couple pilots personally who don't often bother with ILS unless the conditions are bad Because it is a pain. Every pilot has to learn to do visual approaches. I think it just makes one thing apparent though. If we go to fully automated flying then there must ALSO be a visual check. In fact we can make it better than humans because we should make sure that the plane can see through fog. But key point is that there is always some redundancy built in.
    - inferiorhuman 7y ago
      If we go to fully automated flying then there must ALSO be a visual check. I don't think a visual check is needed (otherwise you would be much more limited in where/when you can land), but cross-checking some other data is. Turns out we're already there, and in an ILS approach the pilots should already be checking other instruments.
ChuckMcM 7y ago
> No, it is not. Nobody should be able to influence air traffic in that way just because she/he understands the transport layer. I hear you. But it is the reality of the world. There comes a time when everyone realizes that the boundary between civilized behavior and uncivilized behavior is just a convention. I think of it as the final stage of moving from childhood into adulthood. For example, you could go into the hardware store and buy a couple of bags of fertilizer, some stump remover, a bag of charcoal for the grill, some food for the roses, and six quarts of motor oil. Are you going to do some gardening and grilling over the weekend or going to blow up someone's house? The materials work for either activity. Maybe you rent a moving van over the holiday weekend. Helping a buddy move? Or mowing down tourists at a crowded venue? People who choose to be evil will be evil. There isn't anything you can do about them but you can build defense in depth on various other ways. In the case of air navigation you have a pilot in the cockpit who is supposed to be paying attention. They can takeoff, navigate, and land with nothing more than their eyeballs, a compass, and some paper charts. All the other gizmos help certainly but they aren't essential[1]. When people actively interfere with the other gizmos, whether it is intentionally by transmitting on restricted frequencies, or unintentionally like the delivery truck that shut down Newark Airport because the driver used a GPS jammer to keep the home office from seeing they were taking a break while he watched the planes, it has effects. The rest of the system reacts to minimize damage and risk and the actions themselves bring attention to the people involved. It is fortunate in my experience that that 90+% of the people in the world are too lazy or simply not wired to be curious about how things work the way they do. You may have noticed from the article that they didn't say how you would interfere with navigation with a "$600 SDR", they just said that you could. Most people reading that will say, "Oh dear that's dreadful! Oh look here's a picture of a funny puppy on the next page." As I get older and meet more people, it amazes me how rare genuine curiosity really is. The persistence to follow that curiosity in order to develop understanding is rarer still. Life doesn't have a safety net, and trying to give it one to eliminate danger completely is pretty futile. [1] Ok the pilots in the group are going to jump up and say, without an artificial horizon, an airspeed indicator, and working altimeter and you'll be sorry but even without those you can do pretty well.
- bandy 7y ago
  (Hi Chuck!) I find myself to be in the mathematician camp ("A materials scientist, a Physicist, and a Mathematician were sharing a hotel room when a fire broke out, waking the materials scientist...") when it comes to things kinda like this. If it's a solved problem, I'm not interested in going any further - it's a solved problem, and therefore not really interesting. Given that one wouldn't care about spectrum purity, the required budget becomes minimal, with a trivial hardware component resulting in components easily obtainable with an anonymous visit to a swap meet, if one were to visit the right swap meet. After that, it's a simple matter of programming. I've found that a lot of people are so defined by their job that they have no idea what happens above or below them. The "I deal with packet filters" person can't explain basic networking, nor do they have any idea what the overall configuration of the (enterprise) network is like, to cite an example.
inferiorhuman 7y ago
I am convinced that the only reason we have not seen major disruptions yet is because of a pretty strict adherence to hacker ethics Sure, that and the redundancy and procedure built into an ILS approach. Keep in mind that even airplanes on the wrong part of the tarmac can fuck with the localizer. ILS is imperfect and that's already well known and worked around[1]. 1: https://www.pprune.org/rumours-news/616082-air-india-b788-descends-200-ft-over-water-hkg.html https://www.pprune.org/rumours-news/616082-air-india-b788-de...
fooker 7y ago
> Nobody should be able to influence air traffic That is impossible to prevent. If not anything, it is usually not that difficult to overwhelm any electromagnetic communication with your own powerful signal. Preventing communication is at least as destructive as manipulating communication without avoiding detection.
Haga 7y ago
The gods decided that we shall not wield exponential fire less it serves them, thus your smartphone advanced a thousand years, but your cigarettes lighter did not. To contemplate a fusion driven cigarette lighter is heresy. Theire will shall be done, the thought not even contemplated.
kruczek 7y ago
> Having a bus or lorry use an active runway is just a single, malicious UDP packet away... Nonsense. It all depends on what is implemented on top of UDP.

by jlg23 7y ago

mopsi 7y ago

> Having a bus or lorry use an active runway is just a single, malicious UDP packet away... There are multiple safeguards in place to avoid single points of failure, such as runway crossing procedures with mandatory call to air traffic control unit for explicit permission before entering a runway. Many ATC recordings on VASAviation Youtube channel show that even rescue services (during emergencies) adhere to that. Taxiways leading to runways are marked with holding positions that may not be crossed without authorization: https://i.imgur.com/dCF8lFi.jpg https://i.imgur.com/dCF8lFi.jpg For extra visibility in poor weather, many airports are also equipped with runway guard lights paved into the ground or blinking on either side of the taxiway: https://i.imgur.com/dbix1Aw.png https://i.imgur.com/dbix1Aw.png Surface movement radars and transponder-based systems have also become widespread. They trigger alerts when a vehicle is about to enter an active runway: https://i.imgur.com/sJQ94zq.jpg https://i.imgur.com/sJQ94zq.jpg

djsumdog 7y ago
True, and you have real pilots. Many really busy airports do visual approaches and I know a couple pilots personally who don't often bother with ILS unless the conditions are bad. Remember in San Fransisco where a plane almost landed on a taxi way instead of the runway? It's worth reading the complex situation with the off-line runway and the way ILS was setup with those runways being so close together, but what prevented the disaster was a pilot in the Taxi line of aircraft getting on the radio and saying, "Where is this guy going?!" and everyone suddenly realizing they were lined up for the Taxi way! Real people, being aware, looking and reacting prevented that accident. That's why human checks and cross-checks are so important.
- godelski 7y ago
  > I know a couple pilots personally who don't often bother with ILS unless the conditions are bad Because it is a pain. Every pilot has to learn to do visual approaches. I think it just makes one thing apparent though. If we go to fully automated flying then there must ALSO be a visual check. In fact we can make it better than humans because we should make sure that the plane can see through fog. But key point is that there is always some redundancy built in.
  - inferiorhuman 7y ago
    If we go to fully automated flying then there must ALSO be a visual check. I don't think a visual check is needed (otherwise you would be much more limited in where/when you can land), but cross-checking some other data is. Turns out we're already there, and in an ILS approach the pilots should already be checking other instruments.

ChuckMcM 7y ago

> No, it is not. Nobody should be able to influence air traffic in that way just because she/he understands the transport layer. I hear you. But it is the reality of the world. There comes a time when everyone realizes that the boundary between civilized behavior and uncivilized behavior is just a convention. I think of it as the final stage of moving from childhood into adulthood. For example, you could go into the hardware store and buy a couple of bags of fertilizer, some stump remover, a bag of charcoal for the grill, some food for the roses, and six quarts of motor oil. Are you going to do some gardening and grilling over the weekend or going to blow up someone's house? The materials work for either activity. Maybe you rent a moving van over the holiday weekend. Helping a buddy move? Or mowing down tourists at a crowded venue? People who choose to be evil will be evil. There isn't anything you can do about them but you can build defense in depth on various other ways. In the case of air navigation you have a pilot in the cockpit who is supposed to be paying attention. They can takeoff, navigate, and land with nothing more than their eyeballs, a compass, and some paper charts. All the other gizmos help certainly but they aren't essential[1]. When people actively interfere with the other gizmos, whether it is intentionally by transmitting on restricted frequencies, or unintentionally like the delivery truck that shut down Newark Airport because the driver used a GPS jammer to keep the home office from seeing they were taking a break while he watched the planes, it has effects. The rest of the system reacts to minimize damage and risk and the actions themselves bring attention to the people involved. It is fortunate in my experience that that 90+% of the people in the world are too lazy or simply not wired to be curious about how things work the way they do. You may have noticed from the article that they didn't say how you would interfere with navigation with a "$600 SDR", they just said that you could. Most people reading that will say, "Oh dear that's dreadful! Oh look here's a picture of a funny puppy on the next page." As I get older and meet more people, it amazes me how rare genuine curiosity really is. The persistence to follow that curiosity in order to develop understanding is rarer still. Life doesn't have a safety net, and trying to give it one to eliminate danger completely is pretty futile. [1] Ok the pilots in the group are going to jump up and say, without an artificial horizon, an airspeed indicator, and working altimeter and you'll be sorry but even without those you can do pretty well.

bandy 7y ago
(Hi Chuck!) I find myself to be in the mathematician camp ("A materials scientist, a Physicist, and a Mathematician were sharing a hotel room when a fire broke out, waking the materials scientist...") when it comes to things kinda like this. If it's a solved problem, I'm not interested in going any further - it's a solved problem, and therefore not really interesting. Given that one wouldn't care about spectrum purity, the required budget becomes minimal, with a trivial hardware component resulting in components easily obtainable with an anonymous visit to a swap meet, if one were to visit the right swap meet. After that, it's a simple matter of programming. I've found that a lot of people are so defined by their job that they have no idea what happens above or below them. The "I deal with packet filters" person can't explain basic networking, nor do they have any idea what the overall configuration of the (enterprise) network is like, to cite an example.

inferiorhuman 7y ago

I am convinced that the only reason we have not seen major disruptions yet is because of a pretty strict adherence to hacker ethics Sure, that and the redundancy and procedure built into an ILS approach. Keep in mind that even airplanes on the wrong part of the tarmac can fuck with the localizer. ILS is imperfect and that's already well known and worked around[1]. 1: https://www.pprune.org/rumours-news/616082-air-india-b788-descends-200-ft-over-water-hkg.html https://www.pprune.org/rumours-news/616082-air-india-b788-de...

fooker 7y ago

> Nobody should be able to influence air traffic That is impossible to prevent. If not anything, it is usually not that difficult to overwhelm any electromagnetic communication with your own powerful signal. Preventing communication is at least as destructive as manipulating communication without avoiding detection.

Haga 7y ago

The gods decided that we shall not wield exponential fire less it serves them, thus your smartphone advanced a thousand years, but your cigarettes lighter did not. To contemplate a fusion driven cigarette lighter is heresy. Theire will shall be done, the thought not even contemplated.

kruczek 7y ago

> Having a bus or lorry use an active runway is just a single, malicious UDP packet away... Nonsense. It all depends on what is implemented on top of UDP.