Hacker News Reader

Comment by H8crilA | Hacker News Reader

This industry is ridiculously slow compared to IT. Air traffic comms (both voice AM and text ACARS/VDL) are not only not encrypted, but also crucially not even authenticated. So you can send text messages and speak to any aircraft at any privilege level (just say you're ATC) with a simple SDR. Or you can spoof a faulty engine message on the downlink channel.

View on HN

The antiquated AM mode and the lack of encryption or even digital encoding is a safety feature for air traffic voice communications. Very weak signals still have a chance of being intelligible and if two signals are transmitted at once on the same frequency, both can still be heard.

Yeah but it's terrible for security. Also digital modes work just fine at the same range - I have no problem hearing ADS-B messages from up to 200mi away from my ground level antenna, where the max range is only limited by the curvature of the planet.

And note that the real problem is with authentication (MACs, or digital signatures), not encryption. Public availability of those records is actually probably beneficial. It's a common misconception to think that you need to encrypt while in reality you perhaps need to encrypt, but first you absolutely must authenticate.

Is this an actual problem that is happening in practice, though? How many instances of "unauthenticated" airband communication have caused an accident? I don't know. Even if the answer is nonzero, I'd be willing to bet it's less than ten in decades.

There was a guy in Berlin who was issuing fake landing clearances recently: https://aviation.direct/en/berlin-falscher-fluglotse-narrte-...

It took 6 months to find him, and mind you that that guy was the opposite of clever (he was talking from his bathtub, from what I remember, and he started out not even knowing the ATC language).

Also, it really makes sense to think ahead just a bit, you know. Not everything has to be triggered with an accident, and in this case we're likely talking about terrorism, since no one would do this without realising just how bad the legal consequences are.

You don't really need more security, because if a pilot gets an ATC instruction that doesn't make sense, they're going to question it. Pilots aren't following instructions blindly, everything is mentally cross-checked against what we expect should be happening for situational awareness. (And ATC would also hear the interloper and immediately speak up.)

On top of that, almost everyone in the US also has some form of collision avoidance technology now, as well (either TCAS or ADS-B).

And there's plenty of times where the only time I could hear ATC was with the squelch full open, trying to pick a faint signal out through the static. Digital modes are terrible for this.

Eh, I get a lot of pushback in this thread. But I'll reply.

We're talking about something like a landing clearance. It doesn't have to be completely off the chart. And yes you can inject a message like that successfully, without the ATC ever knowing.

TCAS is equally broken - doesn't have authentication codes / signatures. It's actually more vulnerable since it has higher priority than ATC.

Digital modes can encode speech more efficiently than analog modes, thus reaching further on the same link budget. For example ADS-B is "audible" as far as the curvature of the planet allows - my own antenna can hear messages from up to 200mi away.

It really is a serious problem.

At least in the ham radio community, experience is that digital radio sounds better further, but at the extreme ends of signal reception the digital signal becomes completely unusable before an analog signal becomes unintelligible.

See: https://en.m.wikipedia.org/wiki/Cliff_effect

https://www.selby.com.au/blog/what-is-the-digital-cliff-2

Up in the air, I can also hear AM analog voice transmissions from 200 miles away, so that's not really a good measure of performance. Both modes already do that. Benefit of having an unobstructed line of sight from several miles of altitude. :)

I mean, to put it simply it would just work with a digital mode. But that's not the point, the main point is that there is no authentication mechanism. Such systems are indeed being abused, for example trains were recently halted in Poland. This happened because they have an un-authenticated channel of communication that allows anyone to do that:

https://cybernews.com/news/century-old-technology-hack-broug...

It's only a matter of time before this happens in aviation, but unlike in the trains case it doesn't have to be just an availability problem (all trains stopped safely), it can be a "remote code execution" problem.

This is an annoyance, not a safety issue. No aircrew is just going to blindly follow instructions routing them off to east Jesus after they already understand where they're going and how they're cleared to get there. What's more, on any given freq, you're talking to one controller.

And if another voice comes over the freq giving you instructions that don't make sense, the response is going to be a polite version of "WTF?"

Why do you think the ATC will hear it? You can use a high gain antenna. Also, you can play some really nasty tricks with things that override the ATC, such as TCAS. Or things that are independent of the ATC, like that faulty engine readings sent over ACARS that I mentioned earlier.

There really is no way to do it safe without authentication codes or digital signatures.

PS. And the readback can be just jammed.

You're absouletly right. Here's a pretty good article covering some of the attacks that could be done against radio navigation systems:

https://arstechnica.com/information-technology/2019/05/the-r...

On a foggy day when the visibility is right at minimums, I can imagine a huge risk of aircraft being sent off-course right before landing. Hopefully the pilots would still be able to recover the situation - the TOGA button is right there on the thrust levers on most aircraft - but nobody is infallible.

I would imagine that some military transport aircraft have backup, INS-based navigation systems that create a synthetic glidepath without external radio signals. Airbus have been trying to introduce such systems on commercial airliners for quite a while, although that is intended to allow landing on more remote runways rather than specifically to improve security against malicious interference.

All that is to say that the lack of fatal aviation accidents that we know were caused by malicious radio interference doesn't in any way make the attack less feasible.

Digital signatures, even with conventional X509 certificates straight out of the OpenSSL library, would go a long way to mitigate this risk. What about the risk of the signatures failing? The worst-case scenario is that the pilots get a warning on their ECAM display: "Comms not secure". That should at least alert them to the possibility of false readings even if it can't correct them.

I don't think you have a very good grasp of how aircraft operate under instrument flight rules. Lots of what you're describing is along the same lines as saying "if whole bunches of people decided to start crashing into things or firing sniper rifles from overpasses, it'd create major havoc on the roads, and therefore our roads are insecure." Well, duh. But until there's a credible threat of that occurring, it's not worth worrying about.

It takes just 1 person who knows a bit about radio and aviation and maybe $1000-$2000 worth of hardware to pull off such an attack. And we know that terror organisations go to much further lengths to make it to the press headlines.

If a terror organization wanted to do that, they'd probably end up using rifles or missiles.

https://xkcd.com/538/

Rifles do not reach airplanes, and SAM systems are quite tightly controlled. For example Hamas is unable to take out even any of the slow piston engine Israeli surveillance drones. They even have a name for them in Arabic, you can hear the sound of the drone in almost any footage from Gaza.

Rifles can reach airplanes on the ground just fine, MANPADs have a habit of popping up in inconvenient third-world conflicts, and this whole idea that we need to have secure ATC comms and need to rewire our navigation system is still an absurdity.

Every modern airliner has dual-redundant or better GPS-aided inertial navigation systems, and every professional pilot is trained on procedures for flying in the airspace system after losing all their (multiple) radios. This is literally not a risk worth spending the millions/billions it would cost to mitigate, any more than Joe Average Internet User needs to hire a professional cybersecurity firm to secure his home Wi-Fi router.

Reply on news.ycombinator.com