ADS-B and Aviation Security - Oliver Bouchier

Thank you very much everybody. Good afternoon. Uh my name is Oliver and I am going to talk a little bit today about aviation security. Uh in particular I'm going to be talking about ADSB. So firstly a little quick bit about me. So I'm in the final year of my apprentichip at Leonardo uh in cyber security. uh and I've just finished my degree with the University of Gstershare and I have a very just a general personal interest in aviation and I've done my dissertation on ADSB and security issues in aviation. So today I'd like to teach you guys something hopefully. Um maybe learn a bit about a little bit about what ADSB is if you've not heard of it before. Uh

why it might be insecure. Um some real world examples of how we can see that it's insecure and people that have have shown it rather than just talked about it. Uh we'll talk about some potential solutions and why they don't work and we'll wrap it up from there. So firstly um what is ADSB? So it stands for automatic dependent surveillance broadcast and it is a protocol used by all aircraft to uh broadcast safety critical information about that that plane. So for example where it is which direction it's going and how fast it's going. Um as you can see here there's kind of an overlay of a map. You may have seen something very similar to this

on apps like Flight Radar. This one in particular is ADSB Exchange. And we can see there are absolutely loads of aircraft um across the world. Uh interestingly a big gap over Russia, but I'm not going to talk about that today. Um in there was one day in July 153,000 flights were recorded. So aviation is a massive thing. It's only growing. Uh I had a look about 10 minutes ago. There were about 14,000 planes in the air and about 12,000 of those were being tracked by ADSB. So the takeaway from this ADSB is a massive protocol. It's being used by pretty much every plane. The Federal Aviation Authority, the FAA in America mandated it by 2020. Uh that all planes

flying in their airspace use it and it is pretty much the standard. Um the only aircraft you might not see on ADSB are certain police or military helicopters or planes uh that have are hidden from views, public views um for security reasons. So that equates roughly to approximately one one flight every half a second. So lots and lots of aircraft using this technology. As security as security professionals, there are certain things we like to see when we're working with technology and working with protocols. And that is I would say encryption and authentication are probably two two big ones that we like to see. Uh unfortunately ADSB is neither of those things. And this is where it starts to get a little bit

interesting. So ADSB is unencrypted. uh it's open. That's where we can see these maps. And I would encourage you actually after this talk to log on to flight radar, log on to ADSP exchange and have a look. See, you know, see if you can spot any interesting aircraft on there. It's also unauthenticated, which means that anyone with the correct equipment, and I'll talk a little bit about that in a moment, can broadcast ADSB signals. So, you might be wondering, why was it designed this way? Why did they not build in um security of any kind into ADSB? And there are three main reasons. So the first reason uh and I said I'd talk a little bit about the technology

is at the time radio technology wasn't available to a normal consumer. Um right now uh I can pick one of these up little Hack RF1 if you've ever seen one of these before about £250 um on eBay or somewhere online. Uh, and I could use this right now with about 15 minutes and someone's GitHub repo and start broadcasting ADSB signals in this room. Uh, very much not allowed to do that. And there's a reason this talk does not have a live demo. Um, but it is now really easy for me to pick one of these up and do that. Back in the early 2000s, late 1990s when ADSB was being developed, this wasn't a concern. These

tools weren't available. If you wanted to do this, it was generally you needed to have some kind of enterprisegrade uh radio hardware or one of the actual transponders that sits inside the aircraft which are expensive and therefore generally inaccessible to attackers. So the first that's the first reason because it's simply it wasn't a threat. Secondly is to do with safety and efficiency. So a key the main reason ADSB exists is for safety. It's designed so that um that information is accessible to ground systems to air traffic controllers and other aircraft so they can easily map out where you know aircraft are in their airspace. Uh certain safety systems such as TCAST which is collision avoidance uh relies

on that and there is a talk later this afternoon about TAS. So if you're uh still here this afternoon make sure to stick around for that. Um the other problem is that all of the uh all of ADSB is broadcast on the same single frequency at varying speeds but a few times a second generally with the amount of planes that we're seeing doing this. And the reason I highlighted that massive number at the start the frequency is very quickly becoming clogged up. There's loads and loads of planes all broadcasting on the same frequency. And that means that the very limited packet size of ADSB can't be expanded and that we can't really broadcast too much more on that

frequency before it starts getting too crowded such that it becomes not as useful as as we see it now. The other reason is cost as well. If we wanted to upgrade ASB and bring in a new state-of-the-art encrypted authenticated version, um it would cost a lot of money and frankly no one wants to spend lots of money on something that's they're not necessarily going to be able to make an easy profit on. Um the machines that transponders that ADSB are running on now, particularly in smaller planes, are very much I'd call it a constrained environment. There's not a lot of compute power on that on that platform. So you might struggle to if you were to

add some kind of encryption or authentication mechanism, you might not have the resources that you need natively available on that plane. There may need to be some additional equipment. And also if you do change the protocol entirely, that could mean a change of the entire technological stack that's being used on the ground and in the air. So those are the three main reasons why ADSB is the way it is today. And there are a couple of real world examples. I've got a few papers here that um if you're really interested in this, I'd recommend having a read through. Particularly the one on the left, the ghost uh ghost in the air traffic um shows some very simple

practical attacks again using very sim similar equipment to this um to perform some attacks against ADSB. Uh and another one there by a guy called Martin Stromier who's a kind of one of the leaders in this kind of aviation security space. So it's not just a it's not just an idea. It's not just you know maybe it will get attacked. It is possible and there it's difficult to say what um the impact might be but there's a few things we can think about. Firstly might be controller fatigue. So if you are an air traffic controller and maybe you have a relatively quiet airspace. Uh you've got one or two planes coming in and out. You know what's happening.

Suddenly 50 aircraft appear on your screen and you think they're fake. They're almost certainly fake but you maybe you don't know for sure. Maybe there's one or two real ones in the middle there. So, if uh if the backup systems aren't working properly, if there are certain safety mechanisms that aren't working uh and all of these aircrafts suddenly appear on that controller screen, while that might not immediately cause an issue, it could force a mistake which could then lead to a safety issue. Um again mentioning TAS briefly, I won't go into it now. um but activating safety mechanisms uh on the aircraft. Uh aircraft are designed to be safe, they are designed to be secure and

if an aircraft thinks that another aircraft is flying towards it is most of them have pretty good mechanisms to get out of the way. So if a real aircraft believed a fake aircraft was about to collide with it, that could activate that safety system unnecessarily potentially causing issues. Uh, and another one kind of a more general one, um, potentially, you know, any kind of emergency procedure. If an if an airport, for example, believed an aircraft was making an emergency landing on their runway, it's not a real aircraft, so they can't communicate with it. Um, that could be mean all manner of things. That could mean, you know, um, you know, fire trucks and people deployed to the runway, the the airport

closed down. uh we have a quick reaction alert in the United Kingdom when we have uh military aircraft ready to deploy if an aircraft is coming into our airspace that we can't communicate with. Again, there are backups for this kind of thing, but if they don't work or if something goes wrong or someone misinterprets a piece of information, that could be a problem. So, obviously, people including myself have thought, you know, why don't we fix this? Let's try and fix it. And there are a few potential solutions that we consider but they all come with their own kind of unique um problems. So firstly thinking about any kind of uh symmetric encryption cryptographic signatures or

maybe a certificate based system that you wanted to implement there are two kind of problems. The first one is key management. How do you manage a fleet of such a massive number of aircraft all registered in different countries uh with different uh suppliers, different um carriers and also like I alluded to before the ADSB packet size. So the pack the space that we're working with is very small. We have enough space to talk about where we are in the air, how fast we're traveling, what height we're at, for example, but we don't necessarily have that extra space for a cryptographic signature or something like that. So a potentially creative solution might be to uh might be needed

to to solve that problem. But again broadcasting multiple packets isn't necessarily an option particularly in busy airspaces where that frequency is reaching its capacity. Uh we can we could consider multilateral verification as well or MLAT. In simple terms this is just using multiple different technologies to confirm an aircraft's position. Um, but obviously this comes at a great expense if you're using things like satellites or other technologies to cross reference the position of that aircraft. That's taking time, that's taking money for equipment uh that maybe you don't necessarily have in a safety critical situation or again thinking about a small airfield. They don't have they're not going to be able to afford um the big kind of equipment

that maybe other larger airports can. Um, another one is machine learning detection and this has been researched. I have read a few papers about this um where you could use a machine learning algorithm train it obviously there's a massive open data set we saw that kind of map at the start loads of aircraft flying around we've got a really really big good data set of real planes can we not just train a machine learning model to try and detect those fake planes honestly yes you can I think people have the problem you have is then that doesn't necessarily let you prevent those attacks because if you've detected the plane that's great but how do you

confirm it? How do you verify it? So, there's a few different solutions that have been discussed, a few different problems, but in reality, at the end of the day, because safety is the primary concern for this protocol, there haven't been any um changes made to the design since it was initially implemented. So, to wrap up, and I'll have a few minutes for questions as well, uh if anyone's interested. Um, ADSB, it's a massive part of our modern aviation infrastructure. It was designed for safety, not security. So that's why it's missing those key aspects. And I imagine if it was developed now, security would be a much bigger concern, particularly with the the kind of the consumer level

devices that we're looking at. Um and as we've kind of discussed towards the end there, there are security um considerations that have been made but are not necessarily practical to implement in the um at the scale that would be required um for a successful successful solution. Um so thank you very much for listening everyone. Um I've got my LinkedIn up on there if you'd like to connect. Uh I'd love to answer any questions now or in the future. So feel free to scan that one. Uh does anyone HAVE ANY QUESTIONS? >> [applause]

>> THANK YOU. >> Are there any sort of alternatives that are currently being used are more futuristic rather than ADSB that's quite being taken on by the aviation industry? >> Uh so there are a few there are a few options. I'll be honest I don't know too much about them because my my primary research focus has been into ADSB. Uh there's ADSC. I couldn't tell you what the C stands for to be quite honest. And there's also some satellite tracking and things that can be done. Uh again, if you kind of dig a bit deeper, look into that map, you'll see a lot of the smaller aircraft and aircraft over land are often being tracked by ADSB. Um

particularly because um using devices like this, aviation hobbyists can create their own ground stations and feed that data into the the wider ADSB network. Um so you'll be able to see those planes using ADSB to broadcast their information. However, often when you look over the Atlantic, for example, there are no ADSB stations out there for the MAC to pick them up. They're picked up by other methods such as satellites or or other methods. So, there are those they are used by air traffic control. They are used by planes as well, but also a lot of planes don't have that. So it's there's there some somewhere in between. I'd say it's not a not a straight

answer, but um yeah, I hope that kind of answers your question. >> Yeah. Um, have there been any real attacks that you know? >> Um, so there have been a few. Uh, there have been a few uh spoofed attacks. Um, there was one relatively recently where someone spoofed Air Force One and drew a Yeah, some people are laughing cuz they know know what I'm about to say. Uh, they drew a meme picture of JD Barnes over one of Donald Trump's golf clubs. Um so it's you know it is funny but um that does it demonstrates that this is a real concern. Uh this isn't just um something that's been demonstrated in papers. It is a is a real world world

thing as well. >> Yeah. >> Do you see potential for any any future attacks perhaps by nation state governments or something like that with relation to this technology? So when I was um putting together my dissertation proposal, I sent it to my supervisor and initially I wanted to demonstrate some of the attacks uh that could be done. Uh and then unfortunately he said he wouldn't it wouldn't make it past the ethics board because I was writing a terrorist tantrum. Um so I I I think in reality there there are probably enough safety mechanisms to prevent a large scale attack or something that would significantly affect the aviation industry. But the thing is there's no real way to know

unless a some serious mitigations are brought in or b probably it happens and then security retroactively rather than proactively. Um so it's difficult for me to say but yeah. >> Yeah. [snorts] >> Um the radio box you got there. So if you took 50 of those over to the airport, you say that you could spoof 50 airplanes coming in from all directions? >> I could probably spoof it with one. >> Yeah. >> Can you do this remotely? Would you actually need to be next to the airport to do it? Could you do it for Moscow for example? >> So the the [laughter] random >> completely random completely random city. >> Um so the limitation at least for for me

just with as a hobbyist with one box or a few boxes would be needing to be within range of the receiver. >> Okay. >> So you you wouldn't necessarily need to be right next to the airport. You could do it a couple of miles away. >> If you had a stronger transmitter >> if you had a strong transmitter >> [laughter]

[laughter] >> transmitter receiver you could effectively

>> presumably do something you go >> okay um has there been any work into like using direction finding equipment to sort of correlate because otherwise you could like you you could transmit like, oh, I'm over here from like one side of the airport. Um, and that would be like totally fine. But if you had direction and said, well, you're saying you're over here, but you're actually this direction. Like, do you know there's been any work into that? So I one paper comes to mind where planes were using effectively other planes to bounce off each other and kind of again this is going back to that multilateration um multilateral verification. Um using other planes to verify the

information that's being given. Um it was just a paper. I I didn't see or read any more about it other than that. Um yes again in theory but again that comes at a cost um of more equipment. Uh and again you know big big airports can probably do that quite easily but smaller airports maybe not or if two aircraft are moving through the air very quickly in different directions it may not be reliable if because of the just the timings and things. So, I can't say exactly. Um, I mean, we have very advanced Awax um system, military systems that are able to pick planes out of the air very accurately. Um, but again, that's when they're relatively

close. So, there are solutions, but private cost is a is a factor. >> Uh, anyone else? Yeah. >> Um, all these solutions have their limitations. Which one do you see potential? So this problem out of this >> um I think for me machine learning detection is the most interesting one. Um the because you wouldn't necessarily need that on every plane. You just need it at certain ground stations where you would have that compute resource available. And then if you can detect it relatively reliably, while it doesn't completely solve the problem, it doesn't mitigate the the the problem. It allows controllers to be more confident in the decisions they're making and they can say, you know, we think this is a a fake

plane and we've got a 99% on our advanced machine learning model that says yes, uh it's more than likely a scoop plane. You have one more. >> Yeah. Um I assume this is based on GPS factor in the plane signals to then relay through this network where it is. So could have you used the data in the sort of um flight radar to identify where GPS spoofing is happening in this [clears throat] interference? >> Um yes and there's a really interesting project which I will I've only got a couple of seconds left so I'll show you in a moment but um there someone has created a map of showing exactly where GPS interference is happening based on

um ADSB data entirely. And it shows you that you can see along the border with Russia there is lots of red and it's lots of green on Western Europe. So yeah, there's yes in the word. Uh I think that's all I've got time for. So thank you very much everyone. [applause]