![Page 1: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/1.jpg)
Air Traffic Control:Insecurity and ADS-B
Righter Kunkel, CISSP, CISA
Security Researcher
defcon 17
![Page 2: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/2.jpg)
defcon 17 Righter Kunkel 2
Agenda
� Who am I?
� ATC Background
� DOS on a Tower
� State of Airline Security
� Where are we going?
� ADS-B
![Page 3: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/3.jpg)
defcon 17 Righter Kunkel 3
Who am I?
� Security Field for >12 years
� Worked with secure operating systems: B1, B2
� Firewalls, proxies
� Trainer
� CISSP, CISA
� Ham Radio
� Private Pilot
![Page 4: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/4.jpg)
defcon 17 Righter Kunkel 4
First
� Is flying safe? YES
� Are planes going to fall out of the sky after this talk? NO
� Is flying safe after this talk? YES
� Is some of this talk illegal? YES
Disclaimer: Don’t do this!
![Page 5: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/5.jpg)
defcon 17 Righter Kunkel 5
Pilots?
� Is any one a pilot?
![Page 6: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/6.jpg)
defcon 17 Righter Kunkel 6
Our Focus
� We are not going to focus on:
� Airport physical security
� Cockpit door security
� X-Ray security
� Our focus:
� Computers used by ATC
� How airplanes report their position to ATC
� NexGen ATC
![Page 7: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/7.jpg)
defcon 17 Righter Kunkel 7
Why?
� ATC is busy moving planes through the air
� ATC not focused on network security of equipment being used
� Who would want to hack a radar scope?
![Page 8: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/8.jpg)
defcon 17 Righter Kunkel 8
Some ATC Background
� ATC
� VOR
� Transponders
� Flight Plans
![Page 9: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/9.jpg)
defcon 17 Righter Kunkel 9
ATC
� What is ATC?
Source: GAO/TGAO/TGAO/TGAO/T----AIMDAIMDAIMDAIMD----00000000----330 FAA Computer Security330 FAA Computer Security330 FAA Computer Security330 FAA Computer Security
![Page 10: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/10.jpg)
defcon 17 Righter Kunkel 10
VOR
� What are VOR’s?
� VHF Omni-directional Radio Range
Source: Wikipedia
![Page 11: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/11.jpg)
defcon 17 Righter Kunkel 11
Airplane Transponder
Source: Wikipedia
![Page 12: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/12.jpg)
defcon 17 Righter Kunkel 12
Mode-S Transponders
� Primary Surveillance Radar (PSR)
� Paint the skin
� Secondary Surveillance Radar (SSR)
� Asks planes transponder to send out a signal and data, time based
� Get unconfirmed ALT from plane
Source: Wikipedia
![Page 13: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/13.jpg)
defcon 17 Righter Kunkel 13
How do Flight Plans Work?
� Pilot submits a requested route
� Goes into a central computer
� Real flight plan gets printed out at ATC
Source: Wikipedia
![Page 14: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/14.jpg)
defcon 17 Righter Kunkel 14
Some interesting attacks in the past
� D.B. Cooper
� 9/11
� People trying to fake their own death
![Page 15: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/15.jpg)
defcon 17 Righter Kunkel 15
Who Was D.B. Cooper?
� Legendary Skyjacker
� $200,000
� Parachuted out the back of a 727 in flight
� Never found
Source: Wikipedia
![Page 16: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/16.jpg)
defcon 17 Righter Kunkel 16
9/11
� I only want to focus on one fact:
� They turned the transponder off
� We have not developed anything to mitigate that attack country wide
� ADIZ in DC only defense
![Page 17: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/17.jpg)
defcon 17 Righter Kunkel 17
Faking Your Own Death
� A Pilot tried to bluff ATC about an emergency
� Set plane on autopilot
� Parachuted out of plane
� Plane intercepted by F16s
� Plane crashed
� Pilot got caught
![Page 18: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/18.jpg)
defcon 17 Righter Kunkel 18
Switching Gears
� My proposed attack:
� DOS on an ATC tower
![Page 19: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/19.jpg)
defcon 17 Righter Kunkel 19
A DOS on an ATC Tower
1. Get a fake ID (Of course this is illegal)
2. Get an aviation medical using fake id (also illegal)
3. Get issued a student pilot certificate with certificate number
4. Log into duat.com
5. Create multiple flight plans and submit
6. All flight plans get printed at tower
![Page 20: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/20.jpg)
defcon 17 Righter Kunkel 20
Medical Cert
Source: Wikipedia
![Page 21: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/21.jpg)
defcon 17 Righter Kunkel 21
Web Sites
� Web based way to get weather briefings and enter flight plans
� Duat.com
� Duats.com
![Page 22: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/22.jpg)
defcon 17 Righter Kunkel 22
duat.com
![Page 23: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/23.jpg)
defcon 17 Righter Kunkel 23
duat.com
![Page 24: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/24.jpg)
defcon 17 Righter Kunkel 24
duat.com
![Page 25: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/25.jpg)
defcon 17 Righter Kunkel 25
duats.com
![Page 26: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/26.jpg)
defcon 17 Righter Kunkel 26
Telnet access to duats.com
![Page 27: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/27.jpg)
defcon 17 Righter Kunkel 27
Or Telephone Numbers
Source: A/FD
Source: A/FD
![Page 28: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/28.jpg)
defcon 17 Righter Kunkel 28
Or Radio
� Jam the ATC tower frequencies
![Page 29: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/29.jpg)
defcon 17 Righter Kunkel 29
State of Airline Insecurity
� I then stepped back and looked around.
![Page 30: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/30.jpg)
defcon 17 Righter Kunkel 30
FAA Insecurity
� A published report came out:
� ATC_Web_report.pdf
� Included on the CD
![Page 31: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/31.jpg)
defcon 17 Righter Kunkel 31
Test Results
� Wow!
![Page 32: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/32.jpg)
defcon 17 Righter Kunkel 32
FAA Network Infrastructure
� The connection that should never happen
![Page 33: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/33.jpg)
defcon 17 Righter Kunkel 33
IDS Sensors
� Who needs IDS
![Page 34: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/34.jpg)
defcon 17 Righter Kunkel 34
Leaked Data From Report
� ATC_Web_report.pdf
� I guess we now know what networks are vulnerable
![Page 35: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/35.jpg)
defcon 17 Righter Kunkel 35
Where are We Going?
� IDS by Feb. 2010
� NextGen ATC
� ADS-B
![Page 36: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/36.jpg)
defcon 17 Righter Kunkel 36
NextGen ATC
� Converting from proprietary hardware to commercial off the shelf hardware
� Phasing out radar
� Airplanes transponder will report Lat., Long., and Alt. in clear txt
� ADS-B
![Page 37: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/37.jpg)
defcon 17 Righter Kunkel 37
ADS-B Insecurity
� Who am I and where am I in one unencrypted packet
� GPS will be the backbone of NextGen
� Oh, and GPS sats are failing faster than expected
� One could easily fake an ADS-B transmission
� No radar to verify true position
![Page 38: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/38.jpg)
defcon 17 Righter Kunkel 38
Call to Action
� Listen to ATC
� View ADS-B broadcasts
� Become a Pilot
![Page 39: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/39.jpg)
defcon 17 Righter Kunkel 39
Conclusion
� ATC Background
� DOS on a Tower
� State of Airline Security
� Where are we going?
� ADS-B
![Page 40: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/40.jpg)
defcon 17 Righter Kunkel 40
Questions
?
![Page 41: Air Traffic Control: Insecurity and ADS-B · 2011-02-26 · No radar to verify true position. defcon17 Righter Kunkel 38 Call to Action Listen to ATC View ADS-B broadcasts Become](https://reader031.vdocuments.mx/reader031/viewer/2022011808/5c80dbee09d3f2c0278b917b/html5/thumbnails/41.jpg)
defcon 17 Righter Kunkel 41
References� http://en.wikipedia.org/wiki/D._B._Cooper
� http://www.oig.dot.gov/StreamFile?file=/data/pdfdocs/ATC_Web_Report.pdf
� http://www.airsport-corp.com/adsb2.htm
� http://online.wsj.com/article/SB124165272826193727.html#
� http://en.wikipedia.org/wiki/Pilot_certification_in_the_United_States
� Airport/Facility Directory; FAA Product ID:AFDSW ; www.naco.faa.gov
� http://en.wikipedia.org/wiki/Air_traffic_control_radar_beacon_system
� http://en.wikipedia.org/wiki/VHF_omnidirectional_range
� GAO, FAA COMPUTER SECURITY, GAO/T-AIMD-00-330 FAA Computer Security,
Sept. 2000