Sweet TCAS! We can make airliners go up-diddly-up whenever we want, say infosec researchers
- Reference: 1588619713
- News link: https://www.theregister.co.uk/2020/05/04/tcas_spoofing_pen_test_partners/
- Source link:
TCAS spoofing, the practice of fooling collision detection systems aboard airliners, can be controlled to precisely determine whether an airliner fitted with TCAS climbs or descends – and even to produce climb rates of up to 3,000ft/min.
Building on earlier research into the bare-bones [1]concept [PDF], PTP said it had figured out how to shape and control airliners' automatic TCAS responses so they moved up or down at precisely known points.
In a blog [2]post the firm said: “We rationalised this to the point where we only needed three fake aircraft to provide [a Resolution Advisory] that caused a climb of over 3,000 ft/min.”
TCAS works by warning pilots that another aircraft (also fitted with TCAS) is going to collide with them unless they change course, climb or descend. It does this in two stages: the first is an aural Traffic Alert (TA) which shouts "traffic, traffic" or similar over the cockpit loudspeakers; the second is a Resolution Advisory (RA), where it gives instructions to pilots ("descend now" and so on).
The system shows pilots a target climb or descent rate, co-ordinated with the other aircraft's TCAS system, to ensure they both miss each other, so one might climb and the other descend. Advanced versions allow the autopilot to fly RA manoeuvres without pilot input, which is where Pen Test Partners' research comes in.
By spoofing fake TCAS contacts using previously described techniques, PTP found it could control exactly where and when airliners climbed and descended.
The prospect of a rollercoaster ride is less scary (or realistic) than it might seem; a recent Oxford University study showed that when airliner pilots are presented with too many spoof warnings, they [3]simply disable the system responsible – and look out of the window so they keep flying safely. ®
Sponsored: [4]How to Build Your Digital Experience Portfolio
[1] https://arxiv.org/pdf/1602.08777.pdf
[2] https://www.pentestpartners.com/security-blog/jeopardising-aircraft-through-tcas-spoofing/
[3] https://www.theregister.co.uk/2020/03/04/aviation_infosec_study_a320_systems_hack/
[4] https://go.theregister.co.uk/tl/1936/-8578/how-to-build-your-digital-experience-portfolio?td=wptl1936
But how?
The testing was, for obvious reasons, done in a simulator. But they don't say how they'd spoof the transmissions in reality, unless I missed something. With TCAS you're going to have to simulate a transmission coming from a specific location, it all works off the change in time of successive received signals. I'd have thought that's the trickier bit.
ADS-B woukd be a bit easier to spoof as it sends a position rather than just worrying about how quickly things are approaching.
Re: But how?
I thought TCAS just used the tranponder data - it doesn't actively seek other aircraft?
Presumably on the basis that an aircraft isn't going to lie about it's position to other aircraft rushing toward it
Re: But how?
On my phone so slightly condensed but, TCAS asks other aircraft to transmit their transponder signal. This gives the height information and the transponder serial number. There are two receiving antenna which use phase difference to get a bearing to the other aircraft (reasonably accurate...). The time between transmission and reception lets the system calculate range. What it's really interested in is the rate of change of that time which indicates if something is closing and how quickly. If they're at a similar height you start getting alerts. If you get into resolution advisories the serial number is used to decide who should climb.
So everything is relative to the aircraft because that's all that's needed.
Re: But how?
Could a drone of some sort carry something to spoof the transponder signal? Or maybe balloons could carry a box with SDR.
Re: But how?
Ok, I assumed the transponder just broadcast its known (GPS/INS + altimeter) position as it does to ATC
More high quality 'research'
So it's maybe possible to spoof the transmissions and get the system to respond as designed.
Just a shame it's utterly impractical to spoof the transmissions in any useful form except on the bench, and they didn't even do that. In other words more bollocks security 'research' pointing out a flaw that doesn't actually exist except on paper.
Also the not so minor point that they tried everything on a sim - shame that even on the Type 7 / Level D devices code for a lot of the (non-rehosted) systems is there to recreate the training effect and *IS NOT A FULL REPLICA OF THE REAL SYSTEM* so any results mean very little. Been there, wrote that, ran the flight acceptance tests... That said I remember using real TAWS boxes on sims before (which have built in TCAS) because it was easier than trying to process their terrain databases etc.
Look out the window?
How's that work under IFR?
Re: Look out the window?
Or for 2 aircraft approaching each other pointy end first at 1300mph
All that complex computing on a hunk of metal carrying hundreds of people and when it goes wrong the driver...I mean pilot looks out the window for other planes.