4 ms·

This industry is ridiculously slow compared to IT. Air traffic comms (both voice AM and text ACARS/VDL) are not only not encrypted, but also crucially not even

This industry is ridiculously slow compared to IT. Air traffic comms (both voice AM and text ACARS/VDL) are not only not encrypted, but also crucially not even authenticated. So you can send text messages and speak to any aircraft at any privilege level (just say you're ATC) with a simple SDR. Or you can spoof a faulty engine message on the downlink channel.

teovall 3y ago
The antiquated AM mode and the lack of encryption or even digital encoding is a safety feature for air traffic voice communications. Very weak signals still have a chance of being intelligible and if two signals are transmitted at once on the same frequency, both can still be heard.
- H8crilA 3y ago
  Yeah but it's terrible for security. Also digital modes work just fine at the same range - I have no problem hearing ADS-B messages from up to 200mi away from my ground level antenna, where the max range is only limited by the curvature of the planet. And note that the real problem is with authentication (MACs, or digital signatures), not encryption. Public availability of those records is actually probably beneficial. It's a common misconception to think that you need to encrypt while in reality you perhaps need to encrypt, but first you absolutely must authenticate.
  - ryandrake 3y ago
    Is this an actual problem that is happening in practice, though? How many instances of "unauthenticated" airband communication have caused an accident? I don't know. Even if the answer is nonzero, I'd be willing to bet it's less than ten in decades.
    - H8crilA 3y ago
      There was a guy in Berlin who was issuing fake landing clearances recently: https://aviation.direct/en/berlin-falscher-fluglotse-narrte-die-piloten-sechs-monate-lang https://aviation.direct/en/berlin-falscher-fluglotse-narrte-... It took 6 months to find him, and mind you that that guy was the opposite of clever (he was talking from his bathtub, from what I remember, and he started out not even knowing the ATC language). Also, it really makes sense to think ahead just a bit, you know. Not everything has to be triggered with an accident, and in this case we're likely talking about terrorism, since no one would do this without realising just how bad the legal consequences are.
  - tjohns 3y ago
    You don't really need more security, because if a pilot gets an ATC instruction that doesn't make sense, they're going to question it. Pilots aren't following instructions blindly, everything is mentally cross-checked against what we expect should be happening for situational awareness. (And ATC would also hear the interloper and immediately speak up.) On top of that, almost everyone in the US also has some form of collision avoidance technology now, as well (either TCAS or ADS-B). And there's plenty of times where the only time I could hear ATC was with the squelch full open, trying to pick a faint signal out through the static. Digital modes are terrible for this.
    - H8crilA 3y ago
      Eh, I get a lot of pushback in this thread. But I'll reply. We're talking about something like a landing clearance. It doesn't have to be completely off the chart. And yes you can inject a message like that successfully, without the ATC ever knowing. TCAS is equally broken - doesn't have authentication codes / signatures. It's actually more vulnerable since it has higher priority than ATC. Digital modes can encode speech more efficiently than analog modes, thus reaching further on the same link budget. For example ADS-B is "audible" as far as the curvature of the planet allows - my own antenna can hear messages from up to 200mi away. It really is a serious problem.
      - tjohns 3y ago
        At least in the ham radio community, experience is that digital radio sounds better further, but at the extreme ends of signal reception the digital signal becomes completely unusable before an analog signal becomes unintelligible. See: https://en.m.wikipedia.org/wiki/Cliff_effect https://en.m.wikipedia.org/wiki/Cliff_effect https://www.selby.com.au/blog/what-is-the-digital-cliff-2 https://www.selby.com.au/blog/what-is-the-digital-cliff-2 Up in the air, I can also hear AM analog voice transmissions from 200 miles away, so that's not really a good measure of performance. Both modes already do that. Benefit of having an unobstructed line of sight from several miles of altitude. :)
        H8crilA 3y ago
psunavy03 3y ago
This is an annoyance, not a safety issue. No aircrew is just going to blindly follow instructions routing them off to east Jesus after they already understand where they're going and how they're cleared to get there. What's more, on any given freq, you're talking to one controller. And if another voice comes over the freq giving you instructions that don't make sense, the response is going to be a polite version of "WTF?"
- H8crilA 3y ago
  Why do you think the ATC will hear it? You can use a high gain antenna. Also, you can play some really nasty tricks with things that override the ATC, such as TCAS. Or things that are independent of the ATC, like that faulty engine readings sent over ACARS that I mentioned earlier. There really is no way to do it safe without authentication codes or digital signatures. PS. And the readback can be just jammed.
  - seabass-labrax 3y ago
    You're absouletly right. Here's a pretty good article covering some of the attacks that could be done against radio navigation systems: https://arstechnica.com/information-technology/2019/05/the-radio-navigation-planes-use-to-land-safely-is-insecure-and-can-be-hacked/ https://arstechnica.com/information-technology/2019/05/the-r... On a foggy day when the visibility is right at minimums, I can imagine a huge risk of aircraft being sent off-course right before landing. Hopefully the pilots would still be able to recover the situation - the TOGA button is right there on the thrust levers on most aircraft - but nobody is infallible. I would imagine that some military transport aircraft have backup, INS-based navigation systems that create a synthetic glidepath without external radio signals. Airbus have been trying to introduce such systems on commercial airliners for quite a while, although that is intended to allow landing on more remote runways rather than specifically to improve security against malicious interference. All that is to say that the lack of fatal aviation accidents that we know were caused by malicious radio interference doesn't in any way make the attack less feasible. Digital signatures, even with conventional X509 certificates straight out of the OpenSSL library, would go a long way to mitigate this risk. What about the risk of the signatures failing? The worst-case scenario is that the pilots get a warning on their ECAM display: "Comms not secure". That should at least alert them to the possibility of false readings even if it can't correct them.

teovall 3y ago

The antiquated AM mode and the lack of encryption or even digital encoding is a safety feature for air traffic voice communications. Very weak signals still have a chance of being intelligible and if two signals are transmitted at once on the same frequency, both can still be heard.

H8crilA 3y ago
Yeah but it's terrible for security. Also digital modes work just fine at the same range - I have no problem hearing ADS-B messages from up to 200mi away from my ground level antenna, where the max range is only limited by the curvature of the planet. And note that the real problem is with authentication (MACs, or digital signatures), not encryption. Public availability of those records is actually probably beneficial. It's a common misconception to think that you need to encrypt while in reality you perhaps need to encrypt, but first you absolutely must authenticate.
- ryandrake 3y ago
  Is this an actual problem that is happening in practice, though? How many instances of "unauthenticated" airband communication have caused an accident? I don't know. Even if the answer is nonzero, I'd be willing to bet it's less than ten in decades.
  - H8crilA 3y ago
    There was a guy in Berlin who was issuing fake landing clearances recently: https://aviation.direct/en/berlin-falscher-fluglotse-narrte-die-piloten-sechs-monate-lang https://aviation.direct/en/berlin-falscher-fluglotse-narrte-... It took 6 months to find him, and mind you that that guy was the opposite of clever (he was talking from his bathtub, from what I remember, and he started out not even knowing the ATC language). Also, it really makes sense to think ahead just a bit, you know. Not everything has to be triggered with an accident, and in this case we're likely talking about terrorism, since no one would do this without realising just how bad the legal consequences are.
- tjohns 3y ago
  You don't really need more security, because if a pilot gets an ATC instruction that doesn't make sense, they're going to question it. Pilots aren't following instructions blindly, everything is mentally cross-checked against what we expect should be happening for situational awareness. (And ATC would also hear the interloper and immediately speak up.) On top of that, almost everyone in the US also has some form of collision avoidance technology now, as well (either TCAS or ADS-B). And there's plenty of times where the only time I could hear ATC was with the squelch full open, trying to pick a faint signal out through the static. Digital modes are terrible for this.
  - H8crilA 3y ago
    Eh, I get a lot of pushback in this thread. But I'll reply. We're talking about something like a landing clearance. It doesn't have to be completely off the chart. And yes you can inject a message like that successfully, without the ATC ever knowing. TCAS is equally broken - doesn't have authentication codes / signatures. It's actually more vulnerable since it has higher priority than ATC. Digital modes can encode speech more efficiently than analog modes, thus reaching further on the same link budget. For example ADS-B is "audible" as far as the curvature of the planet allows - my own antenna can hear messages from up to 200mi away. It really is a serious problem.
    - tjohns 3y ago
      At least in the ham radio community, experience is that digital radio sounds better further, but at the extreme ends of signal reception the digital signal becomes completely unusable before an analog signal becomes unintelligible. See: https://en.m.wikipedia.org/wiki/Cliff_effect https://en.m.wikipedia.org/wiki/Cliff_effect https://www.selby.com.au/blog/what-is-the-digital-cliff-2 https://www.selby.com.au/blog/what-is-the-digital-cliff-2 Up in the air, I can also hear AM analog voice transmissions from 200 miles away, so that's not really a good measure of performance. Both modes already do that. Benefit of having an unobstructed line of sight from several miles of altitude. :)
      - H8crilA 3y ago

psunavy03 3y ago

This is an annoyance, not a safety issue. No aircrew is just going to blindly follow instructions routing them off to east Jesus after they already understand where they're going and how they're cleared to get there. What's more, on any given freq, you're talking to one controller. And if another voice comes over the freq giving you instructions that don't make sense, the response is going to be a polite version of "WTF?"

H8crilA 3y ago
Why do you think the ATC will hear it? You can use a high gain antenna. Also, you can play some really nasty tricks with things that override the ATC, such as TCAS. Or things that are independent of the ATC, like that faulty engine readings sent over ACARS that I mentioned earlier. There really is no way to do it safe without authentication codes or digital signatures. PS. And the readback can be just jammed.
- seabass-labrax 3y ago
  You're absouletly right. Here's a pretty good article covering some of the attacks that could be done against radio navigation systems: https://arstechnica.com/information-technology/2019/05/the-radio-navigation-planes-use-to-land-safely-is-insecure-and-can-be-hacked/ https://arstechnica.com/information-technology/2019/05/the-r... On a foggy day when the visibility is right at minimums, I can imagine a huge risk of aircraft being sent off-course right before landing. Hopefully the pilots would still be able to recover the situation - the TOGA button is right there on the thrust levers on most aircraft - but nobody is infallible. I would imagine that some military transport aircraft have backup, INS-based navigation systems that create a synthetic glidepath without external radio signals. Airbus have been trying to introduce such systems on commercial airliners for quite a while, although that is intended to allow landing on more remote runways rather than specifically to improve security against malicious interference. All that is to say that the lack of fatal aviation accidents that we know were caused by malicious radio interference doesn't in any way make the attack less feasible. Digital signatures, even with conventional X509 certificates straight out of the OpenSSL library, would go a long way to mitigate this risk. What about the risk of the signatures failing? The worst-case scenario is that the pilots get a warning on their ECAM display: "Comms not secure". That should at least alert them to the possibility of false readings even if it can't correct them.