3 ms·

This guy has all the right pieces, but sadly nobody is going to believe him until he demonstrates it on a functional plane. I saw this talk at Blackhat on vuln

by dsl 14y ago

This guy has all the right pieces, but sadly nobody is going to believe him until he demonstrates it on a functional plane. I saw this talk at Blackhat on vulnerabilities in ADS-B, which scared the shit out of me. The paper is a good read http://media.blackhat.com/bh-us-12/Briefings/Costin/BH_US_12_Costin_Ghosts_In_Air_WP.pdf http://media.blackhat.com/bh-us-12/Briefings/Costin/BH_US_12... tl;dr: once a second every commercial plane transmits its location, heading, and speed over an unencrypted unauthenticated protocol, and other planes and air traffic control take it for truth.

dhx 14y ago
Automatic Identification System (AIS)[1] is used for tracking ships and is also unprotected/unencrypted. This is not particularly an issue because ships inform government port and coastguard authorities of their source and destination ports long before entering sovereign waters. Those authorities can then use a system not too dissimilar to [2] to verify that a ship detected with radar: a) is transmitting an AIS identifier that matches the paperwork already received b) has been transmitting AIS track data that aligns with the paperwork already received since leaving the source port Furthermore, ships have to allow a pilot on their vessel for pilotage into a port berth. Once they have pulled aside, the area surrounding the berth is, at least for most developed countries, a maritime security zone with barbed wire fences, security patrols and surveillance cameras. The aviation sector has all of the above controls in place with even greater rigour. Encryption of track data, when factoring in the complexity of key exchange mechanisms and the expense of swapping out old hardware, would therefore have limited effect on either maritime or aviation security. [1] https://en.wikipedia.org/wiki/Automatic_Identification_System https://en.wikipedia.org/wiki/Automatic_Identification_Syste... [2] http://www.marinetraffic.com/ais/ http://www.marinetraffic.com/ais/
bigiain 14y ago
"nobody is going to believe him until he demonstrates it on a functional plane." And there are some _really_ obvious reasons why you wouldn't just go and do that so you can present the results at a conference. If the claims _are_ true, you'll need to get someone with the authority to grant you the privilege to demonstrate your attack against their aircraft - and so far as I can see, the most likely way to get to do that is probably to present a plausible and perhaps overblown paper at a well publicised conference.
adestefan 14y ago
There are many people that do the same thing using APRS. Once you start digging it's pretty easy to get real-time location information for a ton of entities. https://en.wikipedia.org/wiki/Automatic_Packet_Reporting_System https://en.wikipedia.org/wiki/Automatic_Packet_Reporting_Sys...
mikeash 14y ago
The lack of security in ADS-B is bad, but how much of a problem could you really cause with it? The best I can come up with is tripping some collision alarms. Even then, you won't be able to do too much before pilots and controllers in the area decide that ADS-B is messed up and ignore it in preference to radar.
- bisrig 14y ago
  Serious question: what do you think about the lack of security in Mode A/C then?
  - mikeash 14y ago
    Those are far less spoofable because so much of the information comes in the form of un-spoofable things like echo delays and directional information. You could spoof Mode C altitude, of course. You could spoof a distance from the radar that's more than what your actual distance is by delaying your response to the interrogation. But that's about it. You can't spoof direction, and you can't pretend to be closer than you really are. I'm sure you could still make a minor nuisance of yourself, but it's not going to be a very big deal, I'd think. I think you'd have to either be very close to the radar or airborne to pull any of this off, too, which means that you likely get to play games only once, then the large men in black suits will come ask you to please stop.
    - jacquesm 14y ago
      They may even omit the 'please'.
deleted 14y ago
[deleted]

by dsl 14y ago

dhx 14y ago

Automatic Identification System (AIS)[1] is used for tracking ships and is also unprotected/unencrypted. This is not particularly an issue because ships inform government port and coastguard authorities of their source and destination ports long before entering sovereign waters. Those authorities can then use a system not too dissimilar to [2] to verify that a ship detected with radar: a) is transmitting an AIS identifier that matches the paperwork already received b) has been transmitting AIS track data that aligns with the paperwork already received since leaving the source port Furthermore, ships have to allow a pilot on their vessel for pilotage into a port berth. Once they have pulled aside, the area surrounding the berth is, at least for most developed countries, a maritime security zone with barbed wire fences, security patrols and surveillance cameras. The aviation sector has all of the above controls in place with even greater rigour. Encryption of track data, when factoring in the complexity of key exchange mechanisms and the expense of swapping out old hardware, would therefore have limited effect on either maritime or aviation security. [1] https://en.wikipedia.org/wiki/Automatic_Identification_System https://en.wikipedia.org/wiki/Automatic_Identification_Syste... [2] http://www.marinetraffic.com/ais/ http://www.marinetraffic.com/ais/

bigiain 14y ago

"nobody is going to believe him until he demonstrates it on a functional plane." And there are some _really_ obvious reasons why you wouldn't just go and do that so you can present the results at a conference. If the claims _are_ true, you'll need to get someone with the authority to grant you the privilege to demonstrate your attack against their aircraft - and so far as I can see, the most likely way to get to do that is probably to present a plausible and perhaps overblown paper at a well publicised conference.

adestefan 14y ago

There are many people that do the same thing using APRS. Once you start digging it's pretty easy to get real-time location information for a ton of entities. https://en.wikipedia.org/wiki/Automatic_Packet_Reporting_System https://en.wikipedia.org/wiki/Automatic_Packet_Reporting_Sys...

mikeash 14y ago

The lack of security in ADS-B is bad, but how much of a problem could you really cause with it? The best I can come up with is tripping some collision alarms. Even then, you won't be able to do too much before pilots and controllers in the area decide that ADS-B is messed up and ignore it in preference to radar.

bisrig 14y ago
Serious question: what do you think about the lack of security in Mode A/C then?
- mikeash 14y ago
  Those are far less spoofable because so much of the information comes in the form of un-spoofable things like echo delays and directional information. You could spoof Mode C altitude, of course. You could spoof a distance from the radar that's more than what your actual distance is by delaying your response to the interrogation. But that's about it. You can't spoof direction, and you can't pretend to be closer than you really are. I'm sure you could still make a minor nuisance of yourself, but it's not going to be a very big deal, I'd think. I think you'd have to either be very close to the radar or airborne to pull any of this off, too, which means that you likely get to play games only once, then the large men in black suits will come ask you to please stop.
  - jacquesm 14y ago
    They may even omit the 'please'.

deleted 14y ago

[deleted]