Aviation Stack Exchange is a question and answer site for aircraft pilots, mechanics, and enthusiasts. It only takes a minute to sign up.
Sign up to join this community
By all reports, ADS-B is the future of air navigation and ATC. In the simplest definition, ADS-B is aircraft self-reporting GPS position to benefit everyone.
How is this secure? Seems like someone could simply broadcast a false position for any number of nefarious purposes.
Maybe I am missing something obvious, but I have yet to see an explanation of ADS-B from a security perspective.
Yes, one can send deliberately wrong position reports. But why would anyone want to do that? We're assuming malicious intent, of course -- but even so?
Could an attacker cause a collision using fake position broadcasts? It is hard to see how. The core meaning of an ADS-B broadcast is basically, "Dear ATC, please don't clear anyone to fly too near such-and-such point in space, because that's where I am." Getting an unsuspecting other aircraft to avoid a particular point in space where in reality nobody is, will not in itself cause any accident. At most some distraction and swearing and "no sir, I reallly don't see that traffic" transmissions.
An attacker might mount a denial of service attack against the airspace by flooding an air traffic controller's monitor with dummy aircraft, so he can't find any safe way to route the real planes he's talking to. But for that effect it's not really necessary to send any fake position reports -- simply jamming the 1090 MHz downlink frequency would do just as well, and not be significantly more illegal or harder to detect.
You could try to convince ATC that someone else is in a different place than they really are. However, unless you jam the entire frequency, ATC would still be able to hear their real position reports, and their computers would be able to tell that they have several inconsistent reports from the same airframe address. It would be simple to handle that by separating traffic from both reported positions (which they need to be able to anyway, just in case someone accidentally misconfigures their transponder with a wrong address), and then we're back in the DoS scenario.
Could a suicidal attacker go up in an airplane of his own and get to ram into somebody else while faking his position as far as ATC sees it? If that's your goal, it would certainly seem helpful to stop broadcasting yoru true position, but that doesn't mean that broadcasting a false position would buy you anything that you don't also get simply by pulling the plug on your transponder so you don't broadcast anything. In both cases your problem would be that you're now a primary radar echo that doesn't correspond to any transponder reply. Depending on where you pull the trick that may or may not set alarm bells ringing -- but to the extent it does, broadcasting a different position wouldn't do anything to silence them.
One thing you can do is rig your ADS-B Out to transmit a wrong altitude and hope to get clearance to pass directly above or below someone which you might then try to ram without being seen -- because primary radar is generally bad at distinguishing altitudes. However, that is not a risk specific to ADS-B -- good old SSR also depends on airborne transponders to self-report their altitude in Mode C, and that can be tampered with just as easily.
You aren't missing anything obvious, ADS-B spoofing (the sending of faked messages) and tampering (putting incorrect information into a message) is possible as there is no message authentication built into the protocol. The receiving station has no way to check whether messages are fakes. There are some proposed solutions here and here, to my knowledge there has been no decision to change the protocol standard.
Keep in mind that even if you add message authentication to the protocol there would still be ways to send faked messages. ADS-B uses GPS, there's no reason you couldn't fake the GPS data being sent to a broadcast unit. The unit would have no way of knowing the GPS data is not genuine, and would send position information thinking it was authentic. So even with authentication and security in the broadcast protocol you still cannot implicitly trust the information sent as potential attackers have access to the actual transmission hardware and systems. This means in order to trust the information you have to validate it using another source.
The FAA has been close-lipped about it, they say they have the situation covered but they won't say how. It may be that they feel that the continued use of radar in built-up and secured areas (there's no plans to ditch radar completely in favor of ADS-B) will allow ATC computers to filter out the fakes. Radar is computerized, some smart algorithms would be able to match radar data to ADS-B broadcasts and alert when ADS-B data doesn't match up. An aircraft trying to fly into the Washington DC zone would not be able to use spoofing to get close to a sensitive target for example.
This would mean that the areas where spoofing is more likely to be successful would be areas where there is no radar coverage. Yes, someone could mask their aircraft's true location or fake an airplane in these locations, however the benefits of the system would seem to outweigh the potential risks.
(not exactly an answer, I know... a bit more of a discussion)
Okay, ADS-B is vulnerable to spoofing. What could be done about that?
Although the FAA hasn't been exactly forthcoming with their plans, I've seen articles in the past that suggest they can match up the ADS-B report, the receiving station, and a radar return for some level of discrimination. Doing a match-up, a ground-receiver in Montana would automatically ignore any location info that claims to be in Florida. A plane in Montana could spoof its exact location by a few dozen miles, but couldn't lie enough to be in an entirely different ARTCC.
Because it is a digital format, one idea is to make transmitters have digital certificates, so they must sign each transmission with their certificate. By default, all receivers would see all messages, and a spoofer could still insert false messages. However, once a transmitter is identified as sending out bogus messages, it would be trivial to set a "Ignore all messages from Tx 1357" filter. The problem is coming to the initial recognition that a transmitter is lying in the first place. And once its false messages are ignored, the big question is "So... this plane isn't where it claims to be. Where is it actually??"
In short: there are mitigation steps, but nothing that can automatically and completely secure a system when anyone can be a transmitter.
To add to @BigNutz's post.
Multilateration is a fairly secure way to ascertain a transmission is accurate.
TDOA (Time Difference Of Arrival) would need at least four synchronised receivers and is pretty much the exact opposite of how GPS works (you determine your location by knowing the distance of at least four satellites).
More is better of course, but you can authenticate that someone is transmitting from those 3d coordinates. It doesn't allow for authentication of who is transmitting the ADS-B however.
So anyone questioning the level of chaos and risk associated with someone "spoofing" aircraft into an active Air Traffic System utilizing ADS-B as a part of or in whole for ATC airspace surveillance, needs to rethink the issue. Without going into the weeds, one needs to simply look at the NYC class B area on FR24 to easily see one of the most complex and congested parcels of airspace in the world. If even a single ghost aircraft is surreptitiously inserted into this system in the wrong place at the wrong time, the result could be disastrous.
While the FAA and international community naively chose to create a system with no encryption or integrated signal integrity verification, they have acknowledged that it is a vulnerability and have developed options. The most likely and prevalent is the use of integrated, real time, parallel and persistent signal multilateration (MLAT) to verify aircraft positions. The long of the short of MLAT is triangulation using Time Distance of Arrival (TDOA) capabilities. Basically if enough receivers are able to determine an aircraft's distance based on how long it takes for it's transponder signal takes to get from the aircraft to the receiver, they can determine the position.
It would be extremely difficult to create a set of signals with the complexity needed to mimic that of an actual aircraft and succeed at inserting a "ghost" aircraft into the ATS surveillance. When you consider that while it only takes 4 receivers to conduct MLAT, certified ATS ADS-B surveillance systems are far more robust and precise.
So, yeah. Coulda, shoulda, woulda encrypted the system, but all is not lost.
