Automatic Dependent Surveillance Broadcast (ADS-B) is a technology mandated in all commercial and general aviation aircraft by 2020. It gives the pilot a kind of weather radar and assists with situational awareness, bringing excellent value to the cockpit for professional and private pilots alike. The ability to see thunderstorms and other aircraft in close proximity helps avoid collisions and accidents due to weather.

There is no debate as to the value and effectiveness of ADS-B. However, the technology used to bring all this wonderful situational awareness is rooted in equipment developed and commercialized in the 1960s, and it remains to be seen whether it puts passengers’ privacy at risk.

The Aviation Cybersecurity Challenge

The data format of the transponder was created to help with ground-based radar systems in tracking and to identify aircraft en route. As its name suggests, ADS-B takes the data coming in from the aircraft’s transponder (and related equipment such as a GPS position source) and aggregates it into a broadcast packet much like on an Ethernet network. For example, if two aircraft position reports are received by the ground station, it will broadcast both positions back on a given frequency. The aircraft then takes the data it receives and displays its position and the other aircraft’s position in the cockpit. Much like position data, weather data is aggregated by the ground station and then rebroadcast for display in the cockpit.

So far, so good. Now for the challenge: Like many industrial Internet of Things (IIoT) controllers, ADS-B equipment does not support encryption, so it is possible to forge the broadcast packet with a man-in-the-middle (MitM) attack. In theory, a threat actor could take a 777 and make it appear miles away from its actual location, potentially leading to midair collisions.

The FAA’s Solution

Since aircraft systems do not have enough CPU power for encryption due to backward compatibility concerns with the installed base, the Federal Aviation Administration (FAA) devised other methods to verify authenticity. These methods, while not publicly detailed, involve analytic geometry combined with a database of aircraft performance to calculate an aircraft’s previous position and compare it to the recently received packet.

Think of it like this: If the airplane has a maximum speed of 300 mph and it moves from position A to position B at a rate of 600 mph, it can be assumed that the data received is forged and will be dropped from the broadcast packet. Additionally, since the cyclic redundancy check (CRC) must remain valid, the attacker has limited choices of where he or she can place the victim aircraft. This solves the problem of making an aircraft appear on screen in a location that it is not.

But what if an attacker wanted to do a distributed denial-of-service (DDoS) attack? Could the ground station be overwhelmed with false packets, causing it to go off the air? Worse yet, the default behavior for a packet with a failed CRC is to drop it. Could a MitM attack simply flood the ground station with malformed packets for each of the aircraft received in the previous broadcast packet? Would this make all the aircraft simply drop off the screen in the cockpit?

ADS-B and Data Privacy

The good news is that air traffic control in the U.S. and elsewhere in the world is using the ADS-B technology as a wonderful supplement to situational awareness. It is not being used to replace actual ground radar stations that air traffic control (ATC) uses to control the movement of commercial flights and some general aviation flights. So for the flying public, the risk, while not zero, is indeed very small since only general aviation flights that are not on a filed flight plan are outside of ATC jurisdiction.

While the concern is real, the probability of an attacker causing a midair collision is very small. The real aviation cybersecurity concern is for data privacy. With all this information available in the clear, apps exist to track flights on your smartphone today. Will someone find a way to monetize your location data for a profit, and do you care? Furthermore, drones are not currently required to have ADS-B and, in many cases, are too small for radar to pick up. Should commercial drones be required to have ADS-B?

I don’t know about you, but as a pilot, these are the concerns that occasionally keep me up at night.

For more information about ADS-B and aviation cybersecurity, check out these helpful resources from the FAA and IBM.

More from Data Protection

How Do You Plan to Celebrate National Computer Security Day?

In October 2022, the world marked the 19th Cybersecurity Awareness Month. October might be over, but employers can still talk about awareness of digital threats. We all have another chance before then: National Computer Security Day. The History of National Computer Security Day The origins of National Computer Security Day trace back to 1988 and the Washington, D.C. chapter of the Association for Computing Machinery’s Special Interest Group on Security, Audit and Control. As noted by National Today, those in…

Resilient Companies Have a Disaster Recovery Plan

Historically, disaster recovery (DR) planning focused on protection against unlikely events such as fires, floods and natural disasters. Some companies mistakenly view DR as an insurance policy for which the likelihood of a claim is low. With the current financial and economic pressures, cutting or underfunding DR planning is a tempting prospect for many organizations. That impulse could be costly. Unfortunately, many companies have adopted newer technology delivery models without DR in mind, such as Cloud Infrastructure-as-a-Service (IaaS), Software-as-a-Service (SaaS)…

Millions Lost in Minutes — Mitigating Public-Facing Attacks

In recent years, many high-profile companies have suffered destructive cybersecurity breaches. These public-facing assaults cost organizations millions of dollars in minutes, from stock prices to media partnerships. Fast Company, Rockstar, Uber, Apple and more have all been victims of these costly and embarrassing attacks. The total average cost of a data breach has increased by 2.6% since 2021 and is now $4.35 million. Organizations that don't deploy zero trust security models also incur an average of $1 million more in…

How the Mac OS X Trojan Flashback Changed Cybersecurity

Not so long ago, the Mac was thought to be impervious to viruses. In fact, Apple once stated on its website that "it doesn't get PC viruses". But that was before the Mac OS X Trojan Flashback malware appeared in 2012. Since then, Mac and iPhone security issues have changed dramatically — and so has the security of the entire world. In this post, we'll revisit how the Flashback incident unfolded and how it changed the security landscape forever. What…