Air Traffic Software Vulnerable to DoS Attacks

According to Andrei Costin, $2,000 in equipment and "modest tech skills" are enough to throw an air traffic control system of virtually any airport into complete disarray. The ADS-B system that is used across the world is vulnerable as it does not verify that incoming traffic signals as genuine.

Costin says that a hacker could inject flights that do not exist and could confuse an air controller station. Air controllers could cross-check flights with flight schedules, but if the number of phantom flights is high enough, there is no way that cross-checks would work. Consider it like an DoS attack on an air traffic control system.

Costin noted that rogue signals from the ground can be generally identified and ruled out as malicious signals, but there is no way to do the same for robotic aircraft, for example. He also noted that data sent from airplanes to air traffic controllers is unencrypted and can be captured by unidentified sources. Since this applies to any aircraft, it is in theory possible to deploy airplane tracking devices to track specific aircraft.

Contact Us for News Tips, Corrections and Feedback

  • drwho1
    Is Tom's doing now a "terrorist hand book"?
    Why tell the world how to attack airplanes or airports?
    Reply
  • nieur
    drwho1Is Tom's doing now a "terrorist hand book"?Why tell the world how to attack airplanes or airports? Attacker don't need any help from Tom's.It's always good to know the vulnerability of any standards deployed in commercial systems
    Reply
  • happyballz
    drwho1Is Tom's doing now a "terrorist hand book"?Why tell the world how to attack airplanes or airports?So...we will just ignore this issue and act like it is not there and eventually it will go away right? Yeah I didn't think so.

    More than likely this vulnerability was revealed long time ago and reported to the affected facilities since he is a "Security researcher" and that is his job to find exploits.
    Reply
  • Chainzsaw
    1+ for happy.

    If we keep stuff like this in the dark....no one will ever fix it (or care about it). Maybe they will think about making this a priority now to fix.
    Reply
  • Katsushiro
    Don't forget that the FAA uses multiple types of sensors though. There are still long and short range radars that operate both cooperatively (transponders) and noncooperatively (traditional reflection-based radar).
    Reply
  • This is very theoretical, and one should remember that ATC procedures were designed before radar era. So there are many options to cope with such situation. Revert to the good old Mode C for instance, and if the problem persists, lighten the traffic to cope with the situation (stop takeoffs), until the so-called pirates are located and arrested.

    For such a thing, this should not last very long, and if you check the local regulations, you'll see that this kind of jokes can send someone in jail for very very long...
    Reply
  • JohnnyLucky
    This is certainly not good news.
    Reply
  • stingstang
    ATPLThis is very theoretical, and one should remember that ATC procedures were designed before radar era. So there are many options to cope with such situation. Revert to the good old Mode C for instance, and if the problem persists, lighten the traffic to cope with the situation (stop takeoffs), until the so-called pirates are located and arrested.For such a thing, this should not last very long, and if you check the local regulations, you'll see that this kind of jokes can send someone in jail for very very long...I'm glad someone besides me was able to point this out before someone read this and started freaking the F out....which seems to happen all too often.
    Reply
  • RADIO_ACTIVE
    drwho1Is Tom's doing now a "terrorist hand book"?Why tell the world how to attack airplanes or airports?lol you make me laugh
    Reply
  • If this is true - it would only work in an ADS B environment - many stations have various types of surveillance......
    Reply