Risk
7/26/2012
12:41 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

FAA's New Flight Control System Has Security Holes: Researcher

At the Black Hat conference, a computer scientist demonstrates how 'fake airplanes' can be inserted into FAA's upcoming air traffic control system.

Mission Intelligence: NRO's Newest Spy Satellites
Mission Intelligence: NRO's Newest Spy Satellites
(click image for larger view and for slideshow)
A key component of the FAA's emerging "Next Gen" air traffic control system is fundamentally insecure and ripe for manipulation and attack, security researcher Andrei Costin said in a presentation Wednesday at Black Hat 2012 in Las Vegas.

Costin, a computer scientist and graduate student at Eurecom, outlined a series of issues related to the Automatic Dependent Surveillance-Broadcast (ADS-B) system, which is being installed as a replacement to the decades-old ground radar system used to guide airplanes through the sky and on the ground at airports.

Among the threats to ADS-B is that the system lacks a capability for message authentication. "Any attacker can pretend to be an aircraft" by injecting a message into the system, Costin said.

There's also no mechanism in ADS-B for encrypting messages, so messages related to air traffic--including the ability to identify aircraft, their location, and altitude--can be read by virtually anyone, Costin said. He displayed an air traffic screen capture, taken this year, which ostensibly showed the in-flight location of Air Force One, the Boeing 747 used to transport President Obama.

[ Read about the Department of Defenses' plan to let unmanned aircraft share air space with commercial and private planes: Drones To Fly U.S. Skies, In DOD Plans. ]

If the aircraft was in fact Air Force One, the easy availability of that information would have national security implications. "It's a very high-profile target," said Costin. On the other hand, it's possible that the aircraft represented in the screen capture wasn't Air Force One, but another plane identified within ADS-B using Air Force One's registration code. "If the data is false, somebody is spoofing the system," said Costin.

Costin did not provide evidence of any known attacks on ADS-B. Rather, he presented a theoretical scenario in which someone injected the system with data on "fake planes," forcing the air traffic control system to adjust to aircraft that weren't actually in flight. He characterized such an attack at scale--with one million fake planes, for example—as comparable to a denial-of-service attack on the air traffic control system. Air traffic controllers might be forced to block off air space while they sorted out the mess, he said.

Costin demonstrated how an attack on ADS-B could be mounted using inexpensive software-defined radios. He took airplane data that was publicly available from the system, modified the data, and "replayed" the data back to a commercial receiver. "The possibility of injecting fake airplanes is quite easy, just by taking a real message and crafting it to your needs," he said.

There are also privacy issues, because data on private planes can be culled from ADS-B as well. By matching that data with aircraft registration databases, Costin explained, it would be possible to track non-commercial aircraft from city to city.

In a whitepaper accompanying his presentation, Costin wrote that the types of potential attacks on ADS-B range from passive attacks such as eavesdropping to active attacks, including message jamming and injections of the type he demonstrated.

In addition to the lack of encryption in ADS-B, the whitepaper identifies the following security weaknesses: no use of entity authentication as a way of protecting against message injection, or of message signatures to deter tampering; no challenge-response mechanisms to protect against replay attacks; and lack of "ephemeral identifiers" for privacy protection.

Questions over the security of the ADS-B system aren't new. Aviation experts have warned of vulnerabilities in the past, but the FAA has been reluctant to discuss them. In response to InformationWeek, the FAA, in a prepared statement, said it has "a thorough process in place" to identify possible risks to ADS-B, such as intentional jamming, and that it has taken steps to mitigate risks uncovered as part of an ADS-B security action plan. The agency declined to identify the risks it has identified or addressed, calling them "security-sensitive."

"The agency conducts ongoing assessments of ADS-B signal vulnerabilities," according to the statement. The FAA said the contract for the ADS-B ground station network requires ongoing independent validation of the accuracy and reliability of ADS-B and aircraft avionics signals. As a backup to ADS-B, the FAA plans to maintain about half of the current network of secondary radars "in the unlikely event it is needed."

Security information and event monitoring technology has been available for years, but the information can be hard to mine. In our SIEM Success report, we provide a step-by-step guide to make the most of your SIEM system. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
7/26/2012 | 7:43:18 PM
re: FAA's New Flight Control System Has Security Holes: Researcher
IGÇÖm so very thankful that there is demonstration where they show what exactly the vulnerabilities are in particular systems. FAAGÇÖs new flight system, very important system that should have no vulnerabilities what so ever! Being able to simulate planes that are not there and non-encrypted messages regarding flight information, are not vulnerabilities that make me feel safe at all! It doesnGÇÖt matter that there is no recorded attacks on this new system, if there is vulnerabilities then there will eventually be an attack if these are not taken care of and eliminated. In addition to all this, these threats are not new, and refused to identify other risks? Does anybody else feel like splitting gas money with me on the next tripGǪroad trip!

Paul Sprague
InformationWeek Contributor
Embedded SW Dev
50%
50%
Embedded SW Dev,
User Rank: Apprentice
7/27/2012 | 6:56:52 PM
re: FAA's New Flight Control System Has Security Holes: Researcher
Tracking airplanes from city to city is something which is relatively easy to do now, as private airplanes use their registration numbers with air traffic control, and there are internet sites continuously recording/monitoring air traffic control conversations in real time. Tracking them in-flight can be made more difficult by requesting the FAA block flight tracking because of a security concern, which prevents operations like flightaware from displaying those tail numbers in real-time. The most effective way of preventing traffic is to fly VFR from airports without towers. This hole just prevents the FAA flight tracking block from being effective.

I agree that the other problems need to be addressed, as I really don't want to be flying when the FAA experiences a Denial of Service attack.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4594
Published: 2014-10-25
The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment.

CVE-2014-0476
Published: 2014-10-25
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.

CVE-2014-1927
Published: 2014-10-25
The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928....

CVE-2014-1928
Published: 2014-10-25
The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulner...

CVE-2014-1929
Published: 2014-10-25
python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.