Automatic Dependent Surveillance Broadcast (ADS-B) is a technology mandated in all commercial and general aviation aircraft by 2020. It gives the pilot a kind of weather radar and assists with situational awareness, bringing excellent value to the cockpit for professional and private pilots alike. The ability to see thunderstorms and other aircraft in close proximity helps avoid collisions and accidents due to weather.

There is no debate as to the value and effectiveness of ADS-B. However, the technology used to bring all this wonderful situational awareness is rooted in equipment developed and commercialized in the 1960s, and it remains to be seen whether it puts passengers’ privacy at risk.

The Aviation Cybersecurity Challenge

The data format of the transponder was created to help with ground-based radar systems in tracking and to identify aircraft en route. As its name suggests, ADS-B takes the data coming in from the aircraft’s transponder (and related equipment such as a GPS position source) and aggregates it into a broadcast packet much like on an Ethernet network. For example, if two aircraft position reports are received by the ground station, it will broadcast both positions back on a given frequency. The aircraft then takes the data it receives and displays its position and the other aircraft’s position in the cockpit. Much like position data, weather data is aggregated by the ground station and then rebroadcast for display in the cockpit.

So far, so good. Now for the challenge: Like many industrial Internet of Things (IIoT) controllers, ADS-B equipment does not support encryption, so it is possible to forge the broadcast packet with a man-in-the-middle (MitM) attack. In theory, a threat actor could take a 777 and make it appear miles away from its actual location, potentially leading to midair collisions.

The FAA’s Solution

Since aircraft systems do not have enough CPU power for encryption due to backward compatibility concerns with the installed base, the Federal Aviation Administration (FAA) devised other methods to verify authenticity. These methods, while not publicly detailed, involve analytic geometry combined with a database of aircraft performance to calculate an aircraft’s previous position and compare it to the recently received packet.

Think of it like this: If the airplane has a maximum speed of 300 mph and it moves from position A to position B at a rate of 600 mph, it can be assumed that the data received is forged and will be dropped from the broadcast packet. Additionally, since the cyclic redundancy check (CRC) must remain valid, the attacker has limited choices of where he or she can place the victim aircraft. This solves the problem of making an aircraft appear on screen in a location that it is not.

But what if an attacker wanted to do a distributed denial-of-service (DDoS) attack? Could the ground station be overwhelmed with false packets, causing it to go off the air? Worse yet, the default behavior for a packet with a failed CRC is to drop it. Could a MitM attack simply flood the ground station with malformed packets for each of the aircraft received in the previous broadcast packet? Would this make all the aircraft simply drop off the screen in the cockpit?

ADS-B and Data Privacy

The good news is that air traffic control in the U.S. and elsewhere in the world is using the ADS-B technology as a wonderful supplement to situational awareness. It is not being used to replace actual ground radar stations that air traffic control (ATC) uses to control the movement of commercial flights and some general aviation flights. So for the flying public, the risk, while not zero, is indeed very small since only general aviation flights that are not on a filed flight plan are outside of ATC jurisdiction.

While the concern is real, the probability of an attacker causing a midair collision is very small. The real aviation cybersecurity concern is for data privacy. With all this information available in the clear, apps exist to track flights on your smartphone today. Will someone find a way to monetize your location data for a profit, and do you care? Furthermore, drones are not currently required to have ADS-B and, in many cases, are too small for radar to pick up. Should commercial drones be required to have ADS-B?

I don’t know about you, but as a pilot, these are the concerns that occasionally keep me up at night.

For more information about ADS-B and aviation cybersecurity, check out these helpful resources from the FAA and IBM.