Cyberhijacking Airplanes Truth or Fiction
-
Upload
philip-polstra -
Category
Technology
-
view
2.382 -
download
0
description
Transcript of Cyberhijacking Airplanes Truth or Fiction
![Page 1: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/1.jpg)
Cyber-hijacking Airplanes:
Truth or Fiction?
Dr. Phil of Bloomsburg University
@ppolstra
http://philpolstra.com
Captain Polly of University of <redacted>
@CaptPolly
![Page 2: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/2.jpg)
Why This Talk?
● Lots of bold claims concerning the feasibility of cyber-hijacking
● Bold claims get lots of press● Most people don't know enough to
evaluate these claims● Whether you feel safer or even more
scared should be based on facts
![Page 3: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/3.jpg)
Who is Dr. Phil● You may know me as a hardware hacker, but I'm also...
– Holder of 12 aviation ratings, all current, including:● Commercial Pilot
● Flight Instructor
● Aircraft Mechanic
● Inspection Authorization holder
● Avionics Technician
– Have thousands of hours of flight time
– Aircraft builder
– Have worked on the development of avionics found in modern airliners
– Have access to airliner manuals, current and former airline pilots
![Page 4: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/4.jpg)
Who is Captain Polly
● Former airline pilot for a major US carrier
● Thousands of hours in airliners and small aircraft
● Aviation professor● Head of college simulator program● Spouse of a current airline pilot
![Page 5: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/5.jpg)
What you will learn● How some of the common aircraft systems really
work, including:
– ADS-B
– ADS-A
– ACARS
– Transponders
– Collision avoidance
– GPS
– Autopilots
– Avionics buses and networks
– Attacks being presented by others
![Page 6: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/6.jpg)
Some commonly discussed attacks
● Hacking into the avionics via the entertainment network
● Hacking ADS-B● Hacking engine systems● Hacking ACARS
![Page 7: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/7.jpg)
Let's get this out of the way to start
● You cannot override the pilot● All aircraft feature unhackable
mechanical backup instruments● You can affect the autopilot operation
– If pilot(s) notice they will disconnect
– Anything you attempt will likely result in alerts
![Page 8: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/8.jpg)
Attacking avionics networks
● Older aircraft use ARINC 429 networks– Not connected to anything useful
– Require specialized hardware
● Newer aircraft use a modified version of Ethernet known as ARINC 664 or AFDX
![Page 9: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/9.jpg)
ARINC 664 and AFDX
● Built on Ethernet, but...– Can't just start sending packets
– Never wireless
– Some security in place
● Not connected to entertainment system● Not connected to in-flight wifi
![Page 10: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/10.jpg)
Meet ARINC 664 aka AFDX● Based on ARINC 629
– First created by Boeing for 777
● Allows the use of common off the shelf (COTS) components vs ARINC 429 which is proprietary
● Built on Ethernet, but not the same– Uses redundant channels
– Assigns time slices to avoid collisions and make it deterministic
![Page 11: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/11.jpg)
ARINC 664 Virtual Links● Unidirectional logical pipe
● 1 and only 1 sender
● 1 or more receiver
● Timeslicing is used to avoid collisions
– Bandwidth Allocation Gap (BAG) determines size of timeslice
– Jitter (max latency – min latency) determined by number of VL and BAG
![Page 12: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/12.jpg)
AFDX Connections
![Page 13: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/13.jpg)
ARINC 664 in real life
![Page 14: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/14.jpg)
Tight Integration with ARINC 664
![Page 15: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/15.jpg)
Entertainment Systems
● Connected to output ports on GPS and FMS or through a Network Extension Device (NED)
● Never connected to ARINC 429/629/664
● Remember that the avionics network is never wireless and not compatible with your friendly TCP/IP
![Page 16: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/16.jpg)
In-flight Entertainment
![Page 17: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/17.jpg)
Boeing 777 Confusion
● Boeing asked for a special condition to allow the passenger information network to be connected to other networks such as the aircraft information network
● FAA granted this special condition on 11/18/13 provided that a network extension device (NED) was used and certain conditions were met
![Page 18: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/18.jpg)
777 Confusion (contd)
FAA specified:● The applicant must ensure that the design
provides isolation from, or airplane electronic system security protection against, access by unauthorized sources internal to the airplane. The design must prevent inadvertent and malicious changes to, and all adverse impacts upon, airplane equipment, systems, networks, or other assets required for safe flight and operations.
![Page 19: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/19.jpg)
Meet NED the Network Extension Device
● Essentially a gateway that goes between ARINC 429/629/664 and IP
● Like any gateway each path must be programmed
● FMS does not receive input from NED– Cannot send bogus commands to FMS
– If NED is compromised may be possible to impersonate another device
![Page 20: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/20.jpg)
Example NED implementation● Shameless used from
http://www.teledynecontrols.com/productsolution/ned/blockdiagram.asp
![Page 21: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/21.jpg)
MH370?
● A Boeing 777● Uses ARINC 629
– Not 664 we've been discussing
– Really not Ethernet
● The 777 is essentially the only plane to use ARINC 629
– Harder to hack than ARINC 664
![Page 22: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/22.jpg)
Airliner Entertainment System Connection
Redacted
Sorry, we really tried to put a schematic on this slide, but couldn't get approval from
manufacturers
![Page 23: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/23.jpg)
Hacking In-flight Wireless
![Page 24: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/24.jpg)
Attacking ADS-B/ADS-A
● Can create phantom aircraft● No security in protocol● Could create fake weather reports● Could be jammed● Not likely to affect TCAS
![Page 25: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/25.jpg)
ADS-B (broadcast)
● Piloted in Alaska
● Intended to improve flying where RADAR coverage is limited
● Part of a Free Flight system planned for the future
● Provides traffic and weather where available
● Used by small planes to broadcast position information
![Page 26: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/26.jpg)
ADS-A (addressable)● What the airlines use (contrary to what you may have
heard)
● Related to ACARS
● ADS-B == cable-ready TV
● ADS-A == addressable cable box with pay-per-view, etc
– Allows specific airplanes to send/receive messages
– Allows lower separation outside of RADAR coverage (FANS)
– Airliners use neither ADS-B or ADS-A for collision avoidance
– Can be VHF, HF, or Satellite based
![Page 27: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/27.jpg)
Collision Avoidance● TIS-B
– Provided by ATC
– Requires a mode S transponder (ADS-B in)
– Only available in some areas
– Not authoritative
– Does not use ADS-B signals
– ATC does not automatically relay every ADS-B signal they receive
![Page 28: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/28.jpg)
Collision Avoidance (contd)
● TCAD– Used in small planes
– Provides information
– Not authoritative
● TCAS – What the big boys (biz jet and up) use
![Page 29: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/29.jpg)
TCAS
● Uses transponders in the area● Can actively interrogate other
transponders● Authoritative● Pilot can use even if other aircraft not in
sight
![Page 30: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/30.jpg)
Transponders
● Supplement primary RADAR● Mode S used in ADS-B● Airliners have at least 2● Signals are used for collision avoidance
![Page 31: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/31.jpg)
Attacking ADS-B
![Page 32: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/32.jpg)
Attacking engine systems● Engine monitors are output only
– Information is recorded for maintenance
– Some information may be sent via ACARS to airline and/or manufacturer
● Some engine control systems are electronic
– All have purely mechanical backup
– Most only trim mechanical system electronically
![Page 33: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/33.jpg)
ACARS● Can be used to send
messages to/from ground● Messages to/from people or
systems● Used for
– Weather
– Delays
– Updated flight plans
– Maintenance information
![Page 34: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/34.jpg)
Attacking ACARS
● Could create a bogus flight plan update● Could create bogus weather● Hypothetically could create fake
messages from plane to ground● Not a practical way to take over an
airplane
![Page 35: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/35.jpg)
ACARS Attack
![Page 36: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/36.jpg)
Closing Thoughts
● Nearly every protocol used in aviation is unsecured
● There is certainly the potential to annoy ATC and/or small aircraft
● Increasing automation while continuing with unsecured protocols is problematic
● Airliners are relatively safe (for now)
![Page 37: Cyberhijacking Airplanes Truth or Fiction](https://reader033.fdocuments.in/reader033/viewer/2022052410/554d40dab4c905b0708b4c4f/html5/thumbnails/37.jpg)
Questions?
Come see us after or hit us on Twitter at @ppolstra or @CaptPolly