GDL90fuzz: Fuzzing - GDL-90 Data Interface Specification Within Aviation Software and Avionics Devices–A Cybersecurity Pentesting Perspective

Turtiainen, Hannu; Costin, Andrei; Khandker, Syed; Hämäläinen, Timo D.

doi:10.1109/access.2022.3150840

Cited by 8 publications

(16 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In comparison with Lundberg et al [30], our work provides comprehensive qualitative and quantitative security feature testing of MCIS. Last but not least, the present paper complements our research work and the results in [14], [31].…”

Section: Related Studiessupporting

confidence: 79%

“…However, not all the applications were compatible with all the devices, because some devices use proprietary protocols to exchange data with applications. The most popular protocol is GDL-90 [31], which most applications, such as AvPlan, FLyQ, OzRunways, use. However, the GarminPilot application worked only with the Garmin GDL-52 device, while SensorBox worked with their developed Horizon application.…”

Section: Electronic Flight Bag Applicationsmentioning

confidence: 99%

“…Among them, GDL-90 is the most popular. By following this protocol but using malformed input, we conducted fuzz tests of the EFB applications [31].…”

Section: Attacks On Mobile Cockpit Information Systemsmentioning

confidence: 99%

See 2 more Smart Citations

On the (In)Security of 1090ES and UAT978 Mobile Cockpit Information Systems–An Attacker Perspective on the Availability of ADS-B Safety- and Mission-Critical Systems

Khandker¹,

Turtiainen²,

Costin³

et al. 2022

IEEE Access

Self Cite

View full text Add to dashboard Cite

Automatic dependent surveillance-broadcast (ADS-B) is a key air surveillance technology and a critical component of next-generation air transportation systems. It significantly simplifies aircraft surveillance technology and improves airborne traffic situational awareness. Many types of mobile cockpit information systems (MCISs) are based on ADS-B technology. MCIS gives pilots the flight and trafficrelated information they need. MCIS has two parts: an ADS-B transceiver and an electronic flight bag (EFB) application. The ADS-B transceivers transmit and receive the ADS-B radio signals while the EFB applications hosted on mobile phones display the data. Because they are cheap, lightweight, and easy to install, MCISs became very popular. However, due to the lack of basic security measures, ADS-B technology is vulnerable to cyberattacks, which makes the MCIS inherently exposed to attacks. Attacks are even more likely for the MCIS, because they are power, memory, and computationally constrained. This study explores the cybersecurity posture of various MCIS setups for both types of ADS-B technology: 1090ES and UAT978. Total six portable MCIS devices and 21 EFB applications were tested against radio-link-based attacks by transmission-capable software-defined radio (SDR). Packet-level denial of service (DoS) attacks affected approximately 63% and 37% of 1090ES and UAT978 setups, respectively, while many of them experienced a system crash. Our experiments show that DoS attacks on the reception could meaningfully reduce transmission capacity. Our coordinated attack and fuzz tests also reported worrying issues on the MCIS. The consistency of our results on a very broad range of hardware and software configurations indicate the reliability of our proposed methodology as well as the effectiveness and efficiency of our platform.

show abstract

Section: Related Studiessupporting

confidence: 79%

Section: Electronic Flight Bag Applicationsmentioning

confidence: 99%

See 1 more Smart Citation

On the (In)Security of 1090ES and UAT978 Mobile Cockpit Information Systems–An Attacker Perspective on the Availability of ADS-B Safety- and Mission-Critical Systems

Khandker¹,

Turtiainen²,

Costin³

et al. 2022

IEEE Access

Self Cite

View full text Add to dashboard Cite

show abstract

“…Any informed individual or group can implement these protocols for compatible transceivers. Previous research has demonstrated that spoofing and other advanced attacks are possible for ACARS [20], [21], [22], [23], [24], ADS-B [25], [26], [27], [28], and AIS [29], [30].…”

Section: B Mission-critical Wireless Protocolsmentioning

confidence: 99%

“…Recently in 2021, Khandker et al [26], [28] expanded on the subject and depicted in detail further security weaknesses in the ADS-B protocol and its implementations. Furthermore, Turtiainen et al [27] developed a fuzzing platform for the popular Garmin DataLink 90 (GDL-90) protocol, which is used between an ADS-B receiver and user interface devices. Turtiainen et al [27] tested the security implementations of several electronic flight bag systems that utilized GDL-90 and were able to crash a significant number of them via fuzzing.…”

Section: Related Workmentioning

confidence: 99%

On Apache Log4j2 Exploitation in Aeronautical, Maritime, and Aerospace Communication

Juvonen¹,

Costin²,

Turtiainen³

et al. 2022

IEEE Access

Self Cite

View full text Add to dashboard Cite

In this master's thesis on cyber security accessible methodology for over-the-air experiments using ACARS, ADS-B, and AIS telecommunication protocols is proposed, using software-defined radios, and utilising open-source and freeware software. The protocols are used as attack vectors for exploitation of Apache Log4j2 Java-library's vulnerabilities. Methods for studying CVE-2021-44228 "log4shell" remote code execution and related vulnerabilities using intentionally vulnerable software are presented. The telecommunication protocols' capabilities in transmitting CVE-2021-44228 and related cyberattack strings are evaluated by studying protocol specifications to identify probable attack vectors. Practical scenarios, in which mission critical and safety-of-life information systems could be exploitable, are experimentally demonstrated. All three studied protocols are found to be susceptible for wireless log4shell-cyberattacks, when identified preconditions are met. Moreover, novel findings concerning a high-severity Log4j2 denial of service vulnerability are presented.

show abstract

A Fuzz Testing Approach for Embedded Avionic Software

Xompero,

Mohammad,

Isoaho

et al. 2024

Procedia Computer Science

View full text Add to dashboard Cite

GDL90fuzz: Fuzzing - GDL-90 Data Interface Specification Within Aviation Software and Avionics Devices–A Cybersecurity Pentesting Perspective

Cited by 8 publications

References 21 publications

On the (In)Security of 1090ES and UAT978 Mobile Cockpit Information Systems–An Attacker Perspective on the Availability of ADS-B Safety- and Mission-Critical Systems

On the (In)Security of 1090ES and UAT978 Mobile Cockpit Information Systems–An Attacker Perspective on the Availability of ADS-B Safety- and Mission-Critical Systems

On Apache Log4j2 Exploitation in Aeronautical, Maritime, and Aerospace Communication

A Fuzz Testing Approach for Embedded Avionic Software

Contact Info

Product

Resources

About