ADS-B Security hits mainstream media

denverpilot

denverpilot

Tied Down
Joined
Nov 8, 2009
Messages
55,472
Location
Denver, CO
Display Name
DenverPilot
Home Airfield
KAPA
Who basically gets lied to by FAA. Note the continued falsehoods about how ADS-B will speed travellers to their destinations that made it into the article with no investigation of that claim... straight from the FAA's talking points play card.

http://www.nbcbayarea.com/investigations/Ghost-Planes-Clouding-the-Skies-179679721.html

I keep saying it... Unauthenticated, unencrypted, low speed data is no way to run a location service.

"YOURMOM" was a nice touch. Should have be "YOMAMA" probably cleaned up for the news. Haha.
 
The article is not far from the truth. The current ATC radar mode C even though old is almost impossible to spoof as ADS-B is. Also with ADS-B anyone with an ADS-B receiver like the Garmin DL-39 and an iPad can interactively interact with the ATC scenario using an ADS-B transponder on the ground and play havoc with the system. If you are a low budget terrorist for $45.97 you can get this GPS jammer http://jammerfun.com/gps-jammers-for-sale-mini-car-gps-signal-jammer-tg1011.html. Put it in a balloon and enjoy the havoc created. Luckily TCAS systems do not rely on ADS-B signals but on the old fashion Mode C/S signal format.

ADS-B does not provide a real benefit to general flying public (airlines). Flight delays are mostly due to weather, plane malfunction and security events than to a radar problem.

José
 
denverpilot said:
Who basically gets lied to by FAA. Note the continued falsehoods about how ADS-B will speed travellers to their destinations that made it into the article with no investigation of that claim... straight from the FAA's talking points play card.

http://www.nbcbayarea.com/investigations/Ghost-Planes-Clouding-the-Skies-179679721.html

I keep saying it... Unauthenticated, unencrypted, low speed data is no way to run a location service.

"YOURMOM" was a nice touch. Should have be "YOMAMA" probably cleaned up for the news. Haha.
Click to expand...

but, but, but, the FAA dismissed the problem with unauthenticated ADS-B out reports because they will simply use radar to validate the reports.

Of course, if there is radar coverage, why the **** do we need ADS-B?
 
Piloto said:
The article is not far from the truth. The current ATC radar mode C even though old is almost impossible to spoof as ADS-B is. Also with ADS-B anyone with an ADS-B receiver like the Garmin DL-39 and an iPad can interactively interact with the ATC scenario using an ADS-B transponder on the ground and play havoc with the system. If you are a low budget terrorist for $45.97 you can get this GPS jammer http://jammerfun.com/gps-jammers-for-sale-mini-car-gps-signal-jammer-tg1011.html. Put it in a balloon and enjoy the havoc created. Luckily TCAS systems do not rely on ADS-B signals but on the old fashion Mode C/S signal format.

ADS-B does not provide a real benefit to general flying public (airlines). Flight delays are mostly due to weather, plane malfunction and security events than to a radar problem.

José
Click to expand...

How does someone with a ADS-B reciever and an iPad play havoc with a system? You are in receive only mode, not transmit.
 
BillTIZ said:
How does someone with a ADS-B reciever and an iPad play havoc with a system? You are in receive only mode, not transmit.
Click to expand...

That's where the ADS-B transponder comes into play. By connecting the transponder to a computer you can simulate multiple aircraft at different locations. Keep in mind that in ADS-B surveillance the location of the aircraft is determined by the data transmitted by the ADS-B transponder. While on Mode C the location of the aircraft is determined by radar measurement (bearing and distance).

José
 
Piloto said:
That's where the ADS-B transponder comes into play. By connecting the transponder to a computer you can simulate multiple aircraft at different locations. Keep in mind that in ADS-B surveillance the location of the aircraft is determined by the data transmitted by the ADS-B transponder. While on Mode C the location of the aircraft is determined by radar measurement (bearing and distance).

José
Click to expand...

Interesting. You would also need to replicate the "data quality" code that is part of the ADSB-out transmission to FAA receivers. Without the data quality codes, the information is not passed forward for display. With enough computing power and flight scenarios, what you describe is possible. Hex ID of the aircraft, position, altitude, speed, heading, data quality confidence, for multiple aircraft, transmitted every second.
 
Piloto said:
That's where the ADS-B transponder comes into play. By connecting the transponder to a computer you can simulate multiple aircraft at different locations. Keep in mind that in ADS-B surveillance the location of the aircraft is determined by the data transmitted by the ADS-B transponder. While on Mode C the location of the aircraft is determined by radar measurement (bearing and distance).
Click to expand...

There is no such thing as an "ADS-B Transponder". There's a Mode-S transponder, which would be sending out its programmed ID code...

If you had the ability to reprogram the ID code (and you can through the front panel on some, via serial cables on the back on others), you could then feed the transponder bad GPS data, but you still need to trigger it to send a Squitter. And if you allow it to respond to the standard Mode-C interrogation, they have at least a lubber line pointing right at you... from the RADAR that ADS-B is supposed to replace.

If you're going to hack ADS-B, far better to shove the bad info down on UAT on 900 MHz than try to trick the RADAR infrastructure. Those antennas aren't directional, but you'll still be DF'ed once someone remembers how. A quick call to the FCC Field Office and their toys can do it down to a couple of miles of your location in a VERY short period of time, if they know exactly which of the many transmissions on the ADS-B Out UAT channel is the "signal of interest"... may take an hour or two the first time to find the person... half a day at the outside.

That's assuming the FAA is smart enough to call the FCC... which is assuming a lot.

The ADS-B receivers may also have multilateralization capability for all we know... for just such an "event".

But all of it... ALL of it... is still relying on RADAR to determine if the data from the aircraft is trustworthy. Thus, ADS-B OUT is no cost-savings to anyone, at all. It's a lie.
 
denverpilot said:
There is no such thing as an "ADS-B Transponder". There's a Mode-S transponder, which would be sending out its programmed ID code...
Click to expand...
I'm pretty sure he's just talking about a "transponder" in the general sense, as in a gizmo that can receive and transmit ADSB signals, not a "transponder" in the sense of the gizmo on your panel you dial four digits into.
 
I started playing with UAT, but receiving it on the ground in my locale is essentially impossible. FAA published coverage maps that start at 3000 ft.

To make it worse, UAT is not "low-speed" signal. Only 1090ES is. To decode and encode UAT, you need an SDR with 1.2 MHz bandwidth, or a decent conventional radio with computer interface. The cheapest suitable SDR is about $800 with some change for daughterboards.
 
It's roughly 1Mb/s. Which is VERY VERY slow in modern data RF systems. Any decent communications receiver with a discriminator tap will work. Most have front-end filters that are plenty wide enough.

Cheap SDR, no. Can't sample fast enough. Typical problem with SDR.

http://www.ads-b.com/PDF/UAT SARP.pdf

Theoretical maximum data rates on, 3GPP LTE are 100 Mb/s down, 50 Mb/s up. (Most carrier's call this "4G" in the States.) There are millions of these radios out there, most in people's pockets. ;) Theoretical maximum data rates on Mobile WiMax are 128 Mb/s down, 56 Mb/s up.

1 Mb/s is nothing at this point. One of the interesting studies that had to be done was to see if 978 MHz would adversely affect UHF DME as a second order harmonic. There's papers from.around 2005 where someone finally checked that out scientifically.
 
You must log in or register to reply here.
Back
Top