Hacker News Reader

Comment by sokoloff | Hacker News Reader

The localizer (lateral deviation indication) is going to be harder to spoof due to the beat/squeal that it would introduce when broadcast alongside the legitimate localizer. The pilot (or PNF) will monitor the audio signal for the Morse code that identifies the localizer and the squeal will be apparent.

The glideslope signal (vertical deviation indication) would be easier to spoof. Set that up 1/2 mile short of the runway and aligned to intercept the proper glideslope shortly before the true glideslope intercept point (Maltese cross on the chart). That has a chance of working and going undetected. If you're able to get an aircraft onto the rogue glideslope lobe, even when ATC gets a low altitude alert, the crew is likely to report they're perfectly on glideslope. I'm not sure this is as practical an attack as simply firing on an aircraft on approach, of course.

View on HN

And with WAAS, the world is moving towards GPS approaches anyway. Even without careful planning anyone with a mildly powerful VHF radio and a yagi antenna can jam ILS, VORs and ATC comms rather effectively and has been able to since the end of WWII.

I've seen these articles pop up a few times in the past couple days but everyone in aviation already knows that there isn't any security on this stuff. People even jam ATC for giggles sometimes[1]. There's enough redundancy that nothing bad has happened as a result so everyone goes on with life. I think this is just low hanging defcon fruit targeting non aviation-aware readers.

[1] https://www.youtube.com/watch?v=ZvA_-linhg8

Can't you override GPS too? I thought that was part of the exploit chain that netted Iran a stealth drone.

The Iran thing is dubious. If they did pull it off it required state level resources. Eventually it might be possible with commercial hardware but there isn't a lot of cheap stuff on the market that can generate the frequencies needed at the requisite power. It's worth noting that while the real GPS signal is very weak, the antennas that receive it are on the top of the plane and are somewhat directional. The receivers also have some minimal integrity checking capability IIRC.

This is not to say it's impossible, but with the current stuff on the market and required software investment I'd put it at an order of magnitude or two higher execution complexity than grabbing a VHF radio and messing with ILS beams.

> The Iran thing is dubious. If they did pull it off it required state level resources.

https://www.cnet.com/news/truck-driver-has-gps-jammer-accide... (Truck driver has GPS jammer, accidentally jams Newark airport)

I've already taken over GPS (not jam, emulate all 12 sattelites for a takeover) in a dummy load environment (large paint can grounded). It was with a ADALM-Pluto. Tx was only 5mW but I could easily build a multistage amplifier and filtered appropriately.

Why dont I? Its illegal and its ethically wrong, and its not my focus of study.

I concur.

Generating the requisite signal is easy to do with opensource code and just $200 or so of equipment.

I bet the drone didn't use the military encrypted GPS because they didn't want encryption keys to fall into the wrong hands (they're global), or just because the effort to load the new GPS keys every week was too much, The attackers just jammed and then spoofed GPS, and by providing a very strong signal, any kalman filters designed to merge signals from inertial units would be fooled.

Most of the dubiousness I've seen is wrt the fact that the DoD claims that RQ-170's use inertial guidance and terrain following since GPS is so easily gamed (jam encrypted ranges, spoof civilian ranges). Even the DoD claims that a GPS attack itself is easy.

Of course none of the DoD's version of events explains why then Iran has a mostly intact RQ-170...

I get banner ads all the time on slashdot for enterprise GPS ‘testing’ gear.

> The Iran thing is dubious. If they did pull it off it required state level resources.

The Islamic Republic of Iran, by definition, has state level resources. In addition to their own resources, they have close ties with Russia and China. I agree with your ballpark of an order of magnitude higher complexity than messing with ILS, but that's well within Iran's capabilities.

Jamming is relatively easy. Spoofing is a bit harder.

There are a couple of very interesting articles on GPS spoofing. Not only is it doable [0] but there are some interesting cases that most people don't really think about. Consider that GPS is often used as a timing signal by various financial entities (including stock exchanges). If you override the legitimate GPS signal (not a lot of power required as you'll be much closer to the receiver) and introduce a small deviation into the timing signal you can create some very interesting (and profitable) effects in the stock market. [1]

Even introducing an error into the system can cause disastrous effects [2]

[0] https://arstechnica.com/information-technology/2018/07/a-225...

[1] https://radionavlab.ae.utexas.edu/images/stories/files/paper...

[2] https://blog.themistrading.com/2012/07/could-gps-spoofing-ca...

Username checks out :)

Ars technica cited a researcher at Northwestern that said GPS isn't necessarily a perfect fallback

> One reason: the types of runway misalignments that would be effective in a spoofing attack typically range from about 32 feet to 50 feet, since pilots or air traffic controllers will visually detect anything bigger. It’s extremely difficult for GPS to detect malicious offsets that small. A second reason is that GPS spoofing attacks are relatively easy to carry out.

https://arstechnica.com/information-technology/2019/05/the-r...

> People even jam ATC for giggles sometimes.

Or impersonate. One of my pilot friends was planning a trip across the CA Central Valley, and he reported with some bemusement that there was at active NOTAM (NOtice To Air Men) to be on guard about some guy in the Fresno area that was impersonating ATC. Apparently it had been happening for months and nothing much by way of investigation had taken place.

At this point I pretty much concluded that bad Part 15 devices or PG&E power line noise h0rk1ng over my ham radio reception was not going to get any attention, ever, if the FCC can't be bothered to find an ATC impersonator. I mean really, there are hams that do hidden transmitter hunts purely for sport. A posse of them could find that clown easily on any random Saturday morning and not be late for lunch.

> there are hams that do hidden transmitter hunts purely for sport. A posse of them could find that clown easily on any random Saturday morning and not be late for lunch.

So why don't they?

You need to get the community organised for a hunt. I recall one that happened when a rogue retransmitter managed to spill religious radio onto TWR2 frequency at local Airport

What is a bunch of random nerds going to do? They have no power to fine or arrest. All they can do is document the evidence and turn it over to the FCC, which does happen on occasion. But, I have listened to ARRL division directors talking about trying for years to get well-documented egregious cases of malicious interference dealt with by the FCC. The FCC just can not be bothered. It's not so much that they can't be bothered to collect evidence, which they can't, but even if they have evidence, that can't be bothered to act on it. The FCC should be a technical organization but is pathetically political.

One of my ham friends deals with the FCC often, because he works in spectrum management at the NTIA. The stories he tells make me never want to set foot in D.C. except to visit all the museums that my taxes fund.

No power to fine or arrest isn't entirely true.

What stops them from finding who's transmitting and then filing a civil suit?

They keep telling you that the FCC has the power to do it but does not have the political will.

You're assuming it would broadcast long enough to find the station, not a hit and run operation. And even if there was a constant signal, they could be using a repeater.

The T-hunting game is usually pretty spicy, with intermittent transmissions and propagation hacks. A repeater adds no difficulty at all.... just DF the input of the repeater.

Or impersonate indeed [0]

[0] https://www.youtube.com/watch?v=7WKZNGisSqM

> harder to spoof

Whenever I hear something like this it reminds me of the favorite talks I attended. The Iridium hacking talk at HOPE XI[1].

"When they talk about security they mainly talk about 'hey this is so complex, no one is able to do this, maybe a state or something like that'. So they say 'it will probably be beyond the reach of all but the most determined attackers.' We went well ok, we are determined."

[1]: https://youtu.be/cvKaC4pNvck

Additionally don't forget to add in the human aspect of this, the attack may be detectible to somebody in a clean room that is expecting it, but the same attack on a real pilot in flight may work because the human is not expecting it, is distracted, a little tired, paying attention to adverse weather etc

Isn't this pretty much the plot to Die Hard 2?

you read my mind

Yes. Exactly it.

I don't think the attack would work in the wild; even on a Cat III autoland approach, there is still a decision altitude and runway visual range requirements. When the runway never appears it's a go around.

Cat IIIc has no decision height, but there aren’t any airports that are even planning to install this type of system that I’m aware of. Cat IIIa and IIIb have decision heights of 100ft and 50ft, respectively. Those don’t leave much time for a pilot to execute a go-around.

You’d probably have to engineer the flight path to go through a building, power line, or other obstacle, but that in and of itself seems like a difficult proposition since flight paths leading into an airport with this type of system wouldn’t have 100ft obstacles anywhere near the approach direction. You’d have to spoof the localizer to be offset to the side of the runway to accomplish this, but doing it too far will cause instruments to disagree (GPS, VOR) and ATC to yell at you.

Maybe you could aim it at a nearby taxiway, but to do so (per my understanding of the physics of ILS) you’d have to have your equipment in-line with the taxiway. All of this just seems really hard to pull off in practice.

https://en.wikipedia.org/wiki/2010_Polish_Air_Force_Tu-154_c...

One of the many conspiracy theories associated with this incident is that Russia deliberately created the physical and electronic conditions necessary for this crash to take place.

The cockpit records suggest there were more obvious causes in this instance, but it seems very likely a state actor would be able to engineer a successful attack using a variety of means - not just ILS, but other forms of physical and electronic spoofing.

If you can get the airplane to descend early to a decision height 200 feet above touchdown zone elevation in an area where local terrain is 150’ above TDZE, you might be able to crash one who initiates the missed approach at the DH.

I agree it’s not a practical attack.

You'd also probably get a (E)GPWS warning well before crashing.

Couldn't squeal be minimized by phase matching the localizer then mixing in a doppler offset (assuming you know what you're targeting)? You would still likely get some noise but possibly not sufficient to disrupt the action.

> I'm not sure this is as practical an attack as simply firing on an aircraft on approach, of course.

But that would reveal your position. Presumably the above could be executed without even being present: just leave behind the equipment.

One could probably simultaneously spoof ADS-B for added chaos.

Easily. I've heard that some systems are using trilateration to reject spoofed ADS-B but am not sure how widespread that is.

Trolling flightradar24 and like services would be easy.

That's certainly an interesting approach, but also spoofed by sending a adsb-spammer on a balloon. Then, start flooding adsb with 10-100 messages a second.

Wireless systems without AAA and encryption and signing are effectively fucked.

Reply on news.ycombinator.com