6 ms·
Their test setup isn't realistic at all and looks more like a way to make the article sound interesting. Several big errors: - They are testing a handheld radi
by t0mas88 7y ago
Their test setup isn't realistic at all and looks more like a way to make the article sound interesting. Several big errors:
- They are testing a handheld radio that receives a single SDR signal. In reality a plane has two separate radios (different antenna locations) receiving a signal from a powerful antenna array at the end of the runway, that you try to squeeze your SDR signal in between. So the real attack is far different from their test setup, because you're going to have several conflicting signals instead of only one that they calculate in the test.
- If you overpower the real signal, which needs a really strong transmitter, the monitoring equipment at the airport will easily detect it. That alerts the tower and they will not allow a plane to use the approach. This monitoring is even in place in simple en-route navigation beacons (VORs)
- They claim to be able to make a plane land short of the runway, but every ILS approach has an altitude check by the pilots that's independent of the ILS signal. It works by checking the altitude based on air pressure (not spoofable) at a specific location (based on a system separate from ILS, usually DME or GPS) to the altitude at which the ILS puts the plane. If the two don't match, the pilots will break-off the approach. That check is not a nice to have, if you skip it at a flight-test (every 6 months) you would fail.
- Their calculation needs to know where the plane really is. That's easy to pull from the API of X-Plane (the hobby computer game they use as their simulator) but you don't know in the real world, unless you can see the plane. If you can see the plane, the pilots can see the runway and they're not going to be flying a CAT II or CAT III approach.
They also claim that no system exists to counteract this, but aircraft GPS systems all have mandatory error checking. If you fake a GPS signal, the receiver will compare it to the other signals and either ignore the fake signal (just like it will ignore a faulty satellite) or if not possible to calculate a correct position refuse to fly the approach.
Another alternative already available for years is MLS (microwave landing system), that has a digital signal to tell the plane its position relative to the runway. You cannot fake that without making it obvious to the receiver that you have two conflicting signals and again refusing to fly the approach.
A DoS attack on airplane landing systems is absolutely possible by jamming either ILS, MLS or GPS signals. But making an airliner land next to the runway is really not as easy as this article makes it sound.
- GistNoesis 7y agoHow resistant are those systems with respect to tampering with the physical antenna ? Would someone tilting the antenna a few degrees towards the ground with a screwdriver cause significant perturbation ? Would flying a drone just in front of the antenna be enough to cause a misread ? What about a well positioned actively controlled reflector ?
- t0mas88 7y agoThey are positioned literally at the runway, so the first protection is that you're probably not going to get to them with a screwdriver. False glideslopes occur for many reasons, not just tilting the antenna, but also reflection or approaching them from outside the coverage area (the signal can leak in other directions). The protection is mostly in the check by the pilots that the altitude based on air pressure is correct for the indications. And there are regular calibration flights where the signals are checked against for example GPS position. Apart from that the signals are monitored on the airport itself, but I'm not sure that would detect tilting it down just a little bit. I think it's more for other signals interfering or the transmitters failing in some way. Edit: Oh and we have our GPS (or DME based) ground speed visible in the cockpit and know the descent rate in feet/minute (also displayed on the primary instruments) to expect for a correct glidepath with that speed. So if the descent rate is "off" almost any pilot would notice and start to think about what's causing it. If you can't figure out why the combination of data doesn't make sense, go around. That's basically in the first lesson of instrument flying.
- tgragnato 7y agoAnyway, airports are highly dependent on the correct functioning of all the instruments involved in IFR approaches. Whether it's ILS, MLS, GPS, GBAS-LS or GNSS; spoofing, jamming and replay attacks may imply the capability to degrade or disrupt airport operations. Usenix is not publishing techniques for military grade electronic warfare... I'd hope so.
- gpderetta 7y agoapparently flying a toy is enough to shutdown an airport completely for hours, so the DOS threshold is very low.