December 28, 2017 By Alan Sizemore 3 min read

Automatic Dependent Surveillance Broadcast (ADS-B) is a technology mandated in all commercial and general aviation aircraft by 2020. It gives the pilot a kind of weather radar and assists with situational awareness, bringing excellent value to the cockpit for professional and private pilots alike. The ability to see thunderstorms and other aircraft in close proximity helps avoid collisions and accidents due to weather.

There is no debate as to the value and effectiveness of ADS-B. However, the technology used to bring all this wonderful situational awareness is rooted in equipment developed and commercialized in the 1960s, and it remains to be seen whether it puts passengers’ privacy at risk.

The Aviation Cybersecurity Challenge

The data format of the transponder was created to help with ground-based radar systems in tracking and to identify aircraft en route. As its name suggests, ADS-B takes the data coming in from the aircraft’s transponder (and related equipment such as a GPS position source) and aggregates it into a broadcast packet much like on an Ethernet network. For example, if two aircraft position reports are received by the ground station, it will broadcast both positions back on a given frequency. The aircraft then takes the data it receives and displays its position and the other aircraft’s position in the cockpit. Much like position data, weather data is aggregated by the ground station and then rebroadcast for display in the cockpit.

So far, so good. Now for the challenge: Like many industrial Internet of Things (IIoT) controllers, ADS-B equipment does not support encryption, so it is possible to forge the broadcast packet with a man-in-the-middle (MitM) attack. In theory, a threat actor could take a 777 and make it appear miles away from its actual location, potentially leading to midair collisions.

The FAA’s Solution

Since aircraft systems do not have enough CPU power for encryption due to backward compatibility concerns with the installed base, the Federal Aviation Administration (FAA) devised other methods to verify authenticity. These methods, while not publicly detailed, involve analytic geometry combined with a database of aircraft performance to calculate an aircraft’s previous position and compare it to the recently received packet.

Think of it like this: If the airplane has a maximum speed of 300 mph and it moves from position A to position B at a rate of 600 mph, it can be assumed that the data received is forged and will be dropped from the broadcast packet. Additionally, since the cyclic redundancy check (CRC) must remain valid, the attacker has limited choices of where he or she can place the victim aircraft. This solves the problem of making an aircraft appear on screen in a location that it is not.

But what if an attacker wanted to do a distributed denial-of-service (DDoS) attack? Could the ground station be overwhelmed with false packets, causing it to go off the air? Worse yet, the default behavior for a packet with a failed CRC is to drop it. Could a MitM attack simply flood the ground station with malformed packets for each of the aircraft received in the previous broadcast packet? Would this make all the aircraft simply drop off the screen in the cockpit?

ADS-B and Data Privacy

The good news is that air traffic control in the U.S. and elsewhere in the world is using the ADS-B technology as a wonderful supplement to situational awareness. It is not being used to replace actual ground radar stations that air traffic control (ATC) uses to control the movement of commercial flights and some general aviation flights. So for the flying public, the risk, while not zero, is indeed very small since only general aviation flights that are not on a filed flight plan are outside of ATC jurisdiction.

While the concern is real, the probability of an attacker causing a midair collision is very small. The real aviation cybersecurity concern is for data privacy. With all this information available in the clear, apps exist to track flights on your smartphone today. Will someone find a way to monetize your location data for a profit, and do you care? Furthermore, drones are not currently required to have ADS-B and, in many cases, are too small for radar to pick up. Should commercial drones be required to have ADS-B?

I don’t know about you, but as a pilot, these are the concerns that occasionally keep me up at night.

For more information about ADS-B and aviation cybersecurity, check out these helpful resources from the FAA and IBM.

More from Data Protection

Access control is going mobile — Is this the way forward?

2 min read - Last year, the highest volume of cyberattacks (30%) started in the same way: a cyber criminal using valid credentials to gain access. Even more concerning, the X-Force Threat Intelligence Index 2024 found that this method of attack increased by 71% from 2022. Researchers also discovered a 266% increase in infostealers to obtain credentials to use in an attack. Family members of privileged users are also sometimes victims.“These shifts suggest that threat actors have revalued credentials as a reliable and preferred…

Ransomware on the rise: Healthcare industry attack trends 2024

4 min read - According to the IBM Cost of a Data Breach Report 2024, the global average cost of a data breach reached $4.88 million this year, a 10% increase over 2023.For the healthcare industry, the report offers both good and bad news. The good news is that average data breach costs fell by 10.6% this year. The bad news is that for the 14th year in a row, healthcare tops the list with the most expensive breach recoveries, coming in at $9.77…

Cost of a data breach: Cost savings with law enforcement involvement

3 min read - For those working in the information security and cybersecurity industries, the technical impacts of a data breach are generally understood. But for those outside of these technical functions, such as executives, operators and business support functions, “explaining” the real impact of a breach can be difficult. Therefore, explaining impacts in terms of quantifiable financial figures and other simple metrics creates a relatively level playing field for most stakeholders, including law enforcement.IBM’s 2024 Cost of a Data Breach (“CODB”) Report helps…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today