21
$\begingroup$

I've just read an article from SkyNews just here where they said it's expected that one day air traffic control will be the target of cyber attacks.

So my question is "Is ATC connected to the Internet and why ?"

Are they just connected (if they are) to exchange information between the various ATC Centers and in this case I think they use VPN connections with military grade encryption or do they use Internet for other reasons ?

$\endgroup$
  • 3
    $\begingroup$ Note that even if they were physically separated from the internet, they would not be guaranteed to be safe from cyber attacks: wikipedia.org/en/Stuxnet $\endgroup$ – thanby Nov 18 '15 at 8:22
  • $\begingroup$ @DanielF : By military grade I mean the crypto-system used by government / organisations or by the army and not used by common people (typically the length of the key used will be longueur to increase security). To thanby : You're right any system is safe at 100% but by separating your network from the Internet you will increase your security. $\endgroup$ – FLIGHTWARS Nov 18 '15 at 9:38
16
$\begingroup$

The Air Traffic Control system does transmit information over the internet. The Air Traffic Control system has a number of components, some of which transmit information over the internet. According to Review of Web Applications Security and Intrusion Detection in Air Traffic Control Systems, Office of Inspector General, DoT,

..Federal Aviation Administration (FAA) has increasingly turned toward the use of commercial software and Internet Protocol (IP) -based technologies to modernize ATC systems.

Note that the ATC is not connected directly to the internet. It is the behind scene connections, that are routed through the internet. According to a security professional,

... when most managers say there is no connection to the Internet, they are unaware of maintenance connections. Behind the scenes there are almost always semi-direct connections through routers shared between the control system and business systems that can be exploited

Actually, the use of internet for sharing of information is increasing. FAA's NextGEN modernization involves a significant amount of information transmission over the internet. According to US Government Accountability Office,

NextGen is a modernization effort begun in 2004 by FAA to transform the nation’s ground-based ATC system into a system that uses satellite- based navigation and other advanced technology. ... These new technologies will use an Internet Protocol (IP) based network to communicate.

NextGEN

Image from GAO report on Air Traffic Control

This increasing connection to the internet does increase the associated risks. From the same GAO report:

... the shift to NextGen technologies will require FAA to replace its proprietary, relatively isolated ATC computer systems with information systems that interoperate and share data throughout FAA’s operations and those of its aviation partners. ... These new systems...will also employ digital and Internet-based computer-networking technologies, exposing the air traffic control (ATC) system to new cybersecurity risks.

As to why the ATC is connected to the internet, it basically boils down to ease of operation. According to [NATS], which manages UK airspace,

We ... are now working all over the world within an industry where systems are connected across organisations, countries and continents.

Such an interconnected worldwide system requires a standard platform, which will not be possible (or atleast very difficult to maintain) if a closed, proprietary platform is used.

So, the ATC does use internet, though this is mainly to transmit information. However, I'm not aware of the security systems, though we can be sure that they do have some sort of encryption (If I'm correct, Lockheed Martin supplies the software) and have firewalls to protect the systems.

$\endgroup$
  • 13
    $\begingroup$ Note that your first quote, and the one just above the graphics says "These new technologies will use an Internet Protocol (IP) based network to communicate.". This sounds like a private network using the same protocols and technology, not the internet itself. $\endgroup$ – Lnafziger Nov 17 '15 at 16:01
8
$\begingroup$

You'd be surprised what's connected to the internet. I've been an information security consultant for more than a decade and every time I think I've seen it all I see new levels of foolishness. I would not expect ATC systems to be directly accessible from the internet as that's a very bad idea, but I would not be surprised if it came to light that someone had been dumb enough to do it.

However, you don't have to have systems directly connected to the internet for them to be vulnerable to attack, in fact they don't have to be connected at all. Attackers go after protected targets by gaining a foothold on internet connected systems and using them as jumping off points to other systems. An attacker could be a single person, a small group, or a large, state-sponsored hacking organization.

A very common scenario is that an attacker infects users' personal computers by sending them malware (a virus, trojan horse, worm, etc) in an email, or emailing links to websites which have been compromised. The malware infects a user's computer using vulnerabilities in the operating system or installed applications and allows the attacker to access that computer in a way that the user cannot detect. Once the attacker owns the user's PC he/she can then sniff around the network and compromise other systems, again using vulnerabilities in operating systems and/or applications.

In the case of ATC an attacker could, with the right expertise and resources, penetrate and map out critical ATC computer infrastructure to the point where it could be widely disrupted.

What ATC organizations should be doing is the same as all other organizations which are targets, for example:

  • patching their systems to make them harder to hack
  • running regular penetration tests, where professional "white hat" hackers find security holes before the bad guys do
  • training staff to be aware of suspicious emails
  • protecting ATC systems using firewalls, two-factor authentication, brokered administration, and other controls
$\endgroup$
  • $\begingroup$ In NATS the operational computers are not connected to the general NATS information systems network. The operational systems also uses communications protocols with limited functionality. $\endgroup$ – user23614 Nov 17 '15 at 14:59
  • $\begingroup$ That's a good security measure, but not impossible to jump. Stuxnet used USB keys to successfully distribute malware. $\endgroup$ – GdD Nov 17 '15 at 15:04
  • 1
    $\begingroup$ The system I worked on only allowed specifically coded USB drives. A random drive attached to one of the servers would not be recognised and whoever was caught trying it would be in trouble. Systems Control would know when engineering had access to the systems and the only reason to attach a drive would be to upgrade software, and that happens roughly twice a year, always on a standby system. Physical security is strong, engineers always report to system control to gain access and the people know each other well. $\endgroup$ – user23614 Nov 17 '15 at 15:13
  • 2
    $\begingroup$ That's reassuring to hear @user23614. It may be a good idea to keep those types of details mum unless you're sure you aren't breaching employer confidentiality rules! $\endgroup$ – GdD Nov 17 '15 at 15:48
  • 3
    $\begingroup$ This is all very interesting background data about infosec, but the question is whether ATSUs are connected to the internet, and your answer is that you don't know. $\endgroup$ – Dan Hulme Nov 17 '15 at 18:34
6
$\begingroup$

Short answer: It's complicated.

I am not personally an authority on this subject, but I can point to some information the FAA has released.

System Wide Information Management (SWIM) is the network structure that will carry NextGen digital information. SWIM will enable cost-effective, real-time data exchange and sharing among users of the National Airspace System.

NextGen is the ongoing modernization of the US National Airspace System, so this describes the current plan. Note that controllers are one user group of the National Airspace System.

Security controls are defined in FAA Order 1370.114 - "Implementation of FAA Telecommunications Infrastructure Services and IS Requirements in the NAS". This document is not public.

The "FAA Telecommunications Infrastructure (FTI) NAS Boundary Protection System (NBPS) User’s Guide Volume II- For Non-NAS Users" (document)

provides guidance to external system owners for provisioning IP-based service connectivity to a National Airspace System (NAS) system.

Included is this figure:enter image description here

My head! It's SWIMMING in acronyms...

  • WMSCR (Weather Message Switching Center Replacement System): Collects, processes, stores, and disseminates textual aviation weather products and NOTAM information.
  • WARP (Weather and Radar Processor): An enroute weather system that provides Mosaiced Next Generation Weather Radar (NEXRAD) information to air traffic controllers via the Display System Replacement (DSR) and provides meteorological products to the Center Weather Service Unit (CWSU) meteorologists and Traffic Management Specialists (TMU).
  • NMR (National Airspace Data Interchange Network (NADIN) Message Switching Network (MSN) Rehost): Transmits flight plans. (source)

(gotta love the embedded acronyms.)

So it depends on what you consider "ATC". These are critical systems that support controllers and others. They are 'connected to the internet', albeit through many layers.

Finally, according to this page, updated 10 Jan 2013,

It is the FAA's intent to terminate point to point (local) connections between FAA NAS systems and outside entities as soon as possible and to replace them with connections made via secure gateway.

...implying that there are (or were) (more) direct connections into certain FAA networks, which are being overhauled with the plan described above.

Conclusion

There are many aspects of ATC. One would speculate that systems such as primary and secondary radar are appropriately sand-boxed internally. But clearly certain systems are in some fashion exposed to the internet, at least to expose data for use by others.

$\endgroup$
  • $\begingroup$ "NMR" just blew my mind a little bit... $\endgroup$ – thanby Nov 18 '15 at 8:33
4
$\begingroup$

ATC mostly rely on so-called operational network not directly connected to internet. As mentionned by aeroalias there are links between operational and business networks that might be vulnerable.

There is also a growing trend to interconnect systems to improve throughput, thus increasing exposure. Below is a scheme illustrating collaborative decision making on an airport.

Last but not least, ATC rely on wireless communication between control and planes, which is vulnerable to listening and spoofing. Not internet-based, but yet vulnerable to cyber-attack.

taken from http://www.euro-cdm.org/concept_introduction.php

$\endgroup$
  • $\begingroup$ There have indeed been attempts to spoof a call to an aircraft but all of these in the UK at least have failed due to the diligence of pilots and controllers. $\endgroup$ – user23614 Nov 19 '15 at 17:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.