Cybersecurity Attacks on Software Logic and Error Handling Within ADS-B Implementations: Systematic Testing of Resilience and Countermeasures

Abstract

Automatic Dependent Surveillance-Broadcast (ADS-B) is a cornerstone of the next-generation digital sky and is now mandated in several countries. However, there have been many reports of serious security vulnerabilities in the ADS-B architecture. In this paper, we demonstrate and evaluate the impact of multiple cyberattacks on ADS-B via remote radio frequency links that affected various network, processing, and display subsystems used within the ADS-B ecosystem.Overall we implemented and tested 12 cyberattacks on ADS-B in a controlled environment, out of which 5 attacks were presented or implemented for the first time. For all these attacks, we developed a unique testbed that consisted of 13 hardware devices and 22 software that ran on Android, iOS, Linux, and Windows operating systems, which result in a total of 36 tested configurations. Each of the attacks was successful on various subsets of the tested configurations. In some attacks, we discovered wide qualitative variations and discrepancies in how particular configurations react to and treat ADS-B inputs that contain errors or contradicting flight information, with the main culprit almost always being the software implementation. In some other attacks, we managed to cause Denial of Service (DoS) by remotely crashing/impacting more than 50% of the test-set that corresponded to those attacks.Besides demonstrating successful attacks, we also implemented, investigated, and report herein some practical countermeasures to these attacks. We demonstrated that the strong relationship between the received signal strength and the distance-toemitter might help verify the aircraft's advertised ADS-B position and distance. For example, our best machine learning models achieved 90% accuracy in detecting spoofed ADS-B signals, which may be effectively used to distinguish ADS-B signals of real aircraft from spoofed signals of attackers.

Cybersecurity Attacks on Software Logic and Error Handling Within AIS Implementations: A Systematic Testing of Resilience

“…However, implementing a proper defense strategy requires more systematic research and development, which is beyond the core focus of this paper. Nonetheless, in a similar service in aviation (ADS-B), we showed a received signal strength (RSS) and distance relationship model [8] that reached up to 90% accuracy in the best case. This strategy can easily be transferred to AIS, as the concept is protocol agnostic.…”

“…However, these types of portable receivers remain untested against cyberattacks, as shown in current literature. Lack of extensive study of AIS exploitation, insufficient study on the impact of cyberattacks on modern AIS setups, and our previous security experience on a similar aviation service (Automatic Dependent Surveillance-Broadcast (ADS-B) [7], [8]) have motivated us to conduct this study. Our aim is to enhance the early discovery of new vulnerabilities in AIS to effectively address AIS attacks in the nearest future.…”

On Apache Log4j2 Exploitation in Aeronautical, Maritime, and Aerospace Communication

“…Secondly, the methodology for POA signal generation was made specifically for this study as student work, which promotes its release as a part of this master's thesis. Thirdly, the signal generation methodologies for the ADS-B and AIS protocols were developed by Khandker et al (2021Khandker et al ( , 2022, and are retained as proprietary intellectual property of the University of Jyväskylä researchers. Because these protocols are used in aircraft and vessel tracking, attacks against them carries comparatively far-reaching consequences.…”

“…Any informed individual or group can implement these protocols for compatible transceivers. Previous research has demonstrated that spoofing and other advanced attacks are possible for ACARS [20], [21], [22], [23], [24], ADS-B [25], [26], [27], [28], and AIS [29], [30].…”

“…As was the case with ACARS, our ADS-B frontend setup was monostatic. The attack waveform was created with the methodology and tools that our group developed and published earlier [26], [28]. The waveform carried the LDAP vector with an explicit port presented in Table 3.…”