On Perception and Reality in Wireless Air Traffic Communications Security
Total Page:16
File Type:pdf, Size:1020Kb
On Perception and Reality in Wireless Air Traffic Communications Security Martin Strohmeier∗, Matthias Schafer¨ y, Rui Pinheiroz, Vincent Lendersx, Ivan Martinovic∗ yTU Kaiserslautern, zUniversity of Hagen, ∗University of Oxford, UK xarmasuisse, Switzerland Germany Germany Abstract—More than a dozen wireless technologies are used by wireless technologies considerably. Where the military can air traffic communication systems during different flight phases. often also rely on secrecy, security through obscurity, and From a conceptual perspective, all of them are insecure as superior proprietary technologies to prevail in an arms race, security was never part of their design. Recent contributions from the requirements in a civil setting of worldwide collaboration academic and hacking communities have exploited this inherent are different. In this environment, a pure security by design vulnerability to demonstrate attacks on some of these technolo- approach, such as the protection of critical wireless communi- gies. However, not all of these contributions have resonated widely within aviation circles. At the same time, the security community cation through standard cryptographic countermeasures, would lacks certain aviation domain knowledge, preventing aviation be highly preferable. Unfortunately, in the slow-changing in- authorities from giving credence to their findings. dustry of aviation, such a radical change in security approaches is not currently on the horizon (and arguably not easy to In this survey, we aim to reconcile the view of the security community and the perspective of aviation professionals con- introduce at this point in time). cerning the safety of air traffic communication technologies. To The civil aviation community emphasizes safety and has a achieve this, we first provide a systematization of the applications sound and steadily improving safety record. Security, however, of wireless technologies upon which civil aviation relies. Based is not safety, and requires a different approach. While we en- on these applications, we comprehensively analyze vulnerabilities countered many helpful and interested people and institutions and existing attacks. We further survey the existing research in aviation during our investigation, the prevalent feeling is still on countermeasures and categorize it into approaches that are applicable in the short term and research of secure new “Why is security needed? Is air traffic communication not safe technologies deployable in the long term. currently?”. Indeed, historically, few if any incidents have been recorded where communication technologies were maliciously Since not all of the required aviation knowledge is codified in exploited to cause distress to aircraft. Consequently, even re- academic publications, we additionally examine existing aviation standards and survey 242 international aviation experts. Besides cently developed aviation technologies that make the shift from their domain knowledge, we also analyze the awareness of traditional radar to modern digital communication networks do members of the aviation community concerning the security of not include security by design in their specifications; instead wireless systems and collect their expert opinions on the potential the systems rely almost exclusively on redundancy. impact of concrete attack scenarios using these technologies. However, with the widespread availability of cheap and powerful tools such as software-defined radios (SDR), the I. INTRODUCTION aviation community lost the considerable technical advantage Air traffic control (ATC) is the backbone of what is protecting its communication in the past. This is illustrated by arguably the key means of personal transport in the modern the recent proliferation of reports about potential cyberattacks arXiv:1602.08777v3 [cs.CR] 24 Oct 2016 world. As the traffic load continues to grow dramatically, ATC on wireless ATC technologies. High-profile incidents, such has to manage ever more aircraft. Large European airports, as the case of hijacked emergency signals [2] or alleged such as London Heathrow, experience spikes of more than military exercises causing aircraft to vanish from European 1,500 daily take-offs and landings, and industry forecasts radar screens [3], created a lot of speculation in the media predict that world-wide flight movements will double by 2030. about the potential impact of insecure technologies on the Additionally, with the growing adoption of unmanned aerial safety of air traffic [4], [5]. Disregarding the accuracy of vehicle (UAV) technology for civil applications, we can expect individual reports, these speculations are directly caused by a further boost in air traffic in the coming years. the fact that such attacks are potentially feasible, which has Historically, ATC and its associated wireless communi- been proven recently by hackers [6], [7] and the academic cations technologies are rooted in the military. Most of the community [8]. Much further research has been conducted on improvements in communication, navigation and surveillance the security of newly-developed ATC protocols, and the digital (CNS) technologies are direct results of wartime developments avionics systems installed in modern aircraft [9]–[11]. [1]. For instance, surveillance radar systems and navigation Meanwhile, following these revelations, accusations of functions which were developed originally for the armed forces overblown media reporting of cybersecurity issues have been were later adopted for civilian aviation. This change of purpose made by members of the aviation community. Some claim the and application also shifted the threat models affecting these impossibility of the cited hacks of aircraft IT systems in the real world [12], [13], or doubt the impact of attacks on wireless Abb. Full Name Air Traffic Control air traffic communication systems in practice due to the widely VHF Voice (Very High Frequency) deployed checks and balances common to aviation [14]. PSR Primary Surveillance Radar SSR Secondary Surveillance Radar (Mode A/C/S) These instances show that, unfortunately, many who un- ADS-B Automatic Dependent Surveillance-Broadcast derstand wireless security, do not have appropriate aviation CPDLC Controller–Pilot Data Link Communications expertise. Likewise, many stakeholders in aviation know the MLAT Multilateration Information Services processes and procedures but do not realize the severity of ACARS Aircraft Communications Addressing and Reporting System modern cybersecurity issues. Our work aims to integrate these TCAS Traffic Alert and Collision Avoidance System colliding perspectives in a realistic model and inform future FIS-B Flight Information System-Broadcast TIS-B Traffic Information System-Broadcast discussion about wireless security in aviation. Navigational Aids There is much existing work in the wider area of aviation GPS Global Positioning System VOR VHF Omnidirectional Radio Range cyber security; in Section VI we survey those articles that relate ILS Instrument Landing System to the wireless communications technologies on which we NDB Non-directional Beacon focus in the present work. For an introduction to the topic, the DME Distance-measuring Equipment reader is referred to Sampigethaya et al., who focus on future TABLE I: Short-handles and full names of aviation communication “e-enabled” aircraft communications and their security [9] and technologies, systematized into applications. highlight the challenges and problems of these modern cyber- physical systems [15]. Likewise, [16] surveyed the security of future on-board and off-board avionics systems, relating not only to wireless ATC communication but to the electronic existing vulnerabilities, the necessary change will likely not distribution of software and air health management. come about before a fatal real-world accident occurs. The remainder of this work is organized as follows: Section Contributions II gives an overview of air traffic communication and our The goal of this paper is to consolidate academic and adversarial model. Section III provides the background to our hacker security knowledge, information from aviation technol- survey. Section IV analyzes the technologies of ATC, infor- ogy standards, and expert opinions from the aviation domain, mation services, and navigation aids, including their security. both detailed and aggregated. We systematize the collected In Section V, we discuss the aviation experts’ evaluation of knowledge along three dimensions: concrete attack scenarios. Section VI categorizes the existing countermeasures and identifies current directions in aviation • We provide a systematization of all relevant wireless tech- security research. Section VII concludes this work. nologies considering their applications in aviation: air traf- fic control, information services, and navigation aids. We II. ON THE PROBLEM OF AIR TRAFFIC explain their usage within the aviation system, detail their COMMUNICATIONS SECURITY technical features, and discuss their safety impact. One goal of this paper is to show the obvious mis- • We systematically integrate knowledge from the academic match between security research and the aviation community and hacker communities with technology standards to an- concerning their approaches to the problem of air traffic alyze the security of these applications, providing a com- communications security. We consider the hypotheses that plete overview over their vulnerabilities, existing attacks, either existing wireless security flaws are widely