New realities in aviation security remotely gaining control of aircraft systems
- 2. AIR TRANSPORT ● 2.8 billion – People flown in 2011. ● 38 million – Number of flights in 2011 MARITIME TRANSPORT ● 30,936 – Transport ships in 2011 ● 8,7 billion tons – Seaborne trade on 2012
- 3. Safety is NOT Security
- 4. New technologies, new threats... ...new requirements: ● IT Security profile – New systems – Automation ● Aviation profile – Specific knowledge – Own technologies – Standards
- 5. Part I – Traditional technologies Part II – New risks and attack vectors Agenda
- 7. Older technologies Primary Surveillance Radars (PSR) ✈ Detects presence of planes via the reflection of radio waves by the planes. Secondary Surveillance Radars (SSR) ✈ Detects and measures the position of aircrafts, requests additional information from them.
- 8. Legacy systems Glass cockpit Older technologies
- 10. Attack overview DISCOVERY ✈ ADS-B GATHERING ✈ ACARS EXPLOITATION ✈ Systems
- 12. DISCOVERY - ADS-B Automatic Dependent Surveillance-Broadcast ✈ Radar substitute ✈ Position, velocity, identification
- 13. GATHERING - ACARS Aircraft Communications Addressing and Reporting System ✈ Digital data link for transmission of messages between aircraft and ground stations
- 14. EXPLOITATION - FMS ✈Flight Management System – Typically consists of two units: » A computer unit » A control display unit ✈Control Display Unit (CDU or MCDU) provides the primary human/machine interface for data entry and information display. ✈FMS provides: » Navigation » Flight planning » Trajectory prediction » Performance computations » Guidance
- 15. EXPLOITATION - Attack delivery Ground Service providers ● The “glue” of the aviation ecosystem house Software Defined Radio ● A radio communication system where hardware components are implemented by means of software.
- 16. Unmanned Aircraft Systems COMMUNICATIONS – SATCOM ● Iridium ● Ku-Band ● C/S-Band – VHF ● :-) NON-SEGREGATED AIRSPACE ● Civil aviation systems – COTS/MOTS – Vulnerable: ● Protocols ● Systems
- 17. Remediation Where to start from? – ✈ NextGen Security ● On-board systems security audit – ✈ Who is affected? ● Manufacturers ● Ground Service Providers ● Airlines/Operators
- 18. Remember: Safety is NOT Security [email protected] Additional resources – RootedCon 2012 ● Slides: http://x90.es/7e4 ● Video: http://x90.es/7e5 – HITB 2013 ● Slides: http://x90.es/7e6 ● Video: http://x90.es/7e7