11
$\begingroup$

By all reports, ADS-B is the future of air navigation and ATC. In the simplest definition, ADS-B is aircraft self-reporting GPS position to benefit everyone.

How is this secure? Seems like someone could simply broadcast a false position for any number of nefarious purposes.

Maybe I am missing something obvious, but I have yet to see an explanation of ADS-B from a security perspective.

$\endgroup$
10
$\begingroup$

You aren't missing anything obvious, ADS-B spoofing (the sending of faked messages) and tampering (putting incorrect information into a message) is possible as there is no message authentication built into the protocol. The receiving station has no way to check whether messages are fakes. There are some proposed solutions here and here, to my knowledge there has been no decision to change the protocol standard.

Keep in mind that even if you add message authentication to the protocol there would still be ways to send faked messages. ADS-B uses GPS, there's no reason you couldn't fake the GPS data being sent to a broadcast unit. The unit would have no way of knowing the GPS data is not genuine, and would send position information thinking it was authentic. So even with authentication and security in the broadcast protocol you still cannot implicitly trust the information sent as potential attackers have access to the actual transmission hardware and systems. This means in order to trust the information you have to validate it using another source.

The FAA has been close-lipped about it, they say they have the situation covered but they won't say how. It may be that they feel that the continued use of radar in built-up and secured areas (there's no plans to ditch radar completely in favor of ADS-B) will allow ATC computers to filter out the fakes. Radar is computerized, some smart algorithms would be able to match radar data to ADS-B broadcasts and alert when ADS-B data doesn't match up. An aircraft trying to fly into the Washington DC zone would not be able to use spoofing to get close to a sensitive target for example.

This would mean that the areas where spoofing is more likely to be successful would be areas where there is no radar coverage. Yes, someone could mask their aircraft's true location or fake an airplane in these locations, however the benefits of the system would seem to outweigh the potential risks.

$\endgroup$
  • 8
    $\begingroup$ TL;DR: "It isn't. The FAA would prefer you didn't think about that." $\endgroup$ – voretaq7 Mar 25 '15 at 15:19
  • $\begingroup$ How many places in populated countries actually have no radar coverage, though? At very low altitudes or behind mountains or something, I would expect this, but I wouldn't expect it to be a terribly common situation. Even when flying around at 4,500 ft. over rather rural areas, I see my transponder being interrogated by at least 4 or 5 different radars. $\endgroup$ – reirab Mar 25 '15 at 19:15
  • 1
    $\begingroup$ There's a reason ADS-B was trialled in Alaska. $\endgroup$ – GdD Mar 25 '15 at 19:35
  • $\begingroup$ @GdD Fair enough. $\endgroup$ – reirab Mar 25 '15 at 21:39
  • $\begingroup$ They do have the situation covered. Spoofing—or jamming—ADS-B requires a radio transmitter with significant power and that can be tracked down and whoever installed it might have been seen or left fingerprints or DNA traces etc. So you can spoof it or jam it, but the police will come for you and put you in jail (because interfering with safety-critical system is illegal) and there is simply not that much to be gained compared to the risk. $\endgroup$ – Jan Hudec Mar 27 '17 at 18:20
14
$\begingroup$

Yes, one can send deliberately wrong position reports. But why would anyone want to do that? We're assuming malicious intent, of course -- but even so?

Could an attacker cause a collision using fake position broadcasts? It is hard to see how. The core meaning of an ADS-B broadcast is basically, "Dear ATC, please don't clear anyone to fly too near such-and-such point in space, because that's where I am." Getting an unsuspecting other aircraft to avoid a particular point in space where in reality nobody is, will not in itself cause any accident. At most some distraction and swearing and "no sir, I reallly don't see that traffic" transmissions.

An attacker might mount a denial of service attack against the airspace by flooding an air traffic controller's monitor with dummy aircraft, so he can't find any safe way to route the real planes he's talking to. But for that effect it's not really necessary to send any fake position reports -- simply jamming the 1090 MHz downlink frequency would do just as well, and not be significantly more illegal or harder to detect.

You could try to convince ATC that someone else is in a different place than they really are. However, unless you jam the entire frequency, ATC would still be able to hear their real position reports, and their computers would be able to tell that they have several inconsistent reports from the same airframe address. It would be simple to handle that by separating traffic from both reported positions (which they need to be able to anyway, just in case someone accidentally misconfigures their transponder with a wrong address), and then we're back in the DoS scenario.

Could a suicidal attacker go up in an airplane of his own and get to ram into somebody else while faking his position as far as ATC sees it? If that's your goal, it would certainly seem helpful to stop broadcasting yoru true position, but that doesn't mean that broadcasting a false position would buy you anything that you don't also get simply by pulling the plug on your transponder so you don't broadcast anything. In both cases your problem would be that you're now a primary radar echo that doesn't correspond to any transponder reply. Depending on where you pull the trick that may or may not set alarm bells ringing -- but to the extent it does, broadcasting a different position wouldn't do anything to silence them.

One thing you can do is rig your ADS-B Out to transmit a wrong altitude and hope to get clearance to pass directly above or below someone which you might then try to ram without being seen -- because primary radar is generally bad at distinguishing altitudes. However, that is not a risk specific to ADS-B -- good old SSR also depends on airborne transponders to self-report their altitude in Mode C, and that can be tampered with just as easily.

$\endgroup$
  • $\begingroup$ While perhaps an interesting intellectual exercise, these arguments are quite beside the point. The question isn't why would someone..., the question concerns the ramifications on the ability to secure the airspace system. $\endgroup$ – digitgopher Mar 25 '15 at 18:35
  • 15
    $\begingroup$ @digitgopher Secure it against what? You can't really have a valid discussion of the security ramifications of something without first understanding what you're trying to defend against. $\endgroup$ – reirab Mar 25 '15 at 19:26
  • 2
    $\begingroup$ Also, AFAICT ADS-B is only being pushed as a replacement to secondary radar, so there is nothing much that can be done with a false report that can't be done with turning off the transponder already. $\endgroup$ – cpast Mar 26 '15 at 1:17
  • $\begingroup$ I apologize for my quick judgement; I now see where Henning is coming from. At first I saw the first few paragraphs as a red herring. I think the key here is that ADS-B is not a substitute for primary radar and other security measures. +1 for this post. $\endgroup$ – digitgopher Mar 26 '15 at 3:49
3
$\begingroup$

(not exactly an answer, I know... a bit more of a discussion)

Okay, ADS-B is vulnerable to spoofing. What could be done about that?

Although the FAA hasn't been exactly forthcoming with their plans, I've seen articles in the past that suggest they can match up the ADS-B report, the receiving station, and a radar return for some level of discrimination. Doing a match-up, a ground-receiver in Montana would automatically ignore any location info that claims to be in Florida. A plane in Montana could spoof its exact location by a few dozen miles, but couldn't lie enough to be in an entirely different ARTCC.

Because it is a digital format, one idea is to make transmitters have digital certificates, so they must sign each transmission with their certificate. By default, all receivers would see all messages, and a spoofer could still insert false messages. However, once a transmitter is identified as sending out bogus messages, it would be trivial to set a "Ignore all messages from Tx 1357" filter. The problem is coming to the initial recognition that a transmitter is lying in the first place. And once its false messages are ignored, the big question is "So... this plane isn't where it claims to be. Where is it actually??"

In short: there are mitigation steps, but nothing that can automatically and completely secure a system when anyone can be a transmitter.

$\endgroup$
  • $\begingroup$ How do you make a radar think you're several dozen miles from your actual location? You can spoof your altitude to a Mode C installation easily enough, but your (lat, long) location seems like it would be pretty hard to spoof by more than maybe a few hundred feet. $\endgroup$ – reirab Mar 25 '15 at 19:19
  • $\begingroup$ @Reirab: That is the point. You can lie with ADS-B and say you're over one location, but if Radar says you aren't there, your ADS-B message can be rejected and marked as fraudulent. However, Primary Radar does have a significant error in its reporting due to slant-range and other factors. $\endgroup$ – abelenky Mar 25 '15 at 20:04
1
$\begingroup$

So anyone questioning the level of chaos and risk associated with someone "spoofing" aircraft into an active Air Traffic System utilizing ADS-B as a part of or in whole for ATC airspace surveillance, needs to rethink the issue. Without going into the weeds, one needs to simply look at the NYC class B area on FR24 to easily see one of the most complex and congested parcels of airspace in the world. If even a single ghost aircraft is surreptitiously inserted into this system in the wrong place at the wrong time, the result could be disastrous.

While the FAA and international community naively chose to create a system with no encryption or integrated signal integrity verification, they have acknowledged that it is a vulnerability and have developed options. The most likely and prevalent is the use of integrated, real time, parallel and persistent signal multilateration (MLAT) to verify aircraft positions. The long of the short of MLAT is triangulation using Time Distance of Arrival (TDOA) capabilities. Basically if enough receivers are able to determine an aircraft's distance based on how long it takes for it's transponder signal takes to get from the aircraft to the receiver, they can determine the position.

It would be extremely difficult to create a set of signals with the complexity needed to mimic that of an actual aircraft and succeed at inserting a "ghost" aircraft into the ATS surveillance. When you consider that while it only takes 4 receivers to conduct MLAT, certified ATS ADS-B surveillance systems are far more robust and precise.

So, yeah. Coulda, shoulda, woulda encrypted the system, but all is not lost.

$\endgroup$
1
$\begingroup$

To add to @BigNutz's post.

Multilateration is a fairly secure way to ascertain a transmission is accurate.

TDOA (Time Difference Of Arrival) would need at least four synchronised receivers and is pretty much the exact opposite of how GPS works (you determine your location by knowing the distance of at least four satellites).

More is better of course, but you can authenticate that someone is transmitting from those 3d coordinates. It doesn't allow for authentication of who is transmitting the ADS-B however.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.