Aviation Village - A Hackers First Solo Airplane Avionics Security 101
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Ken
Alex
An airplane is a complex mix of legacy components and custom protocols, generally obscured from security researchers as a result of the high barriers to entry and safety-critical requirements. As a result, little is known in the research community about airplane security. The little that does make it in to the public domain is generally full of FUD; the media are understandably excited about such stories and independent researchers are rarely aware of the security controls that can mitigate some attacks. We will lift the lid on airplane network and avionics security. This is a 101 primer for aviation security: understand the network surface on an airplane, the protocols involved, the components and how they interface with each other and ground systems, plus potential routes that attackers might take & how to lock them down. We will also be running hands-on avionics hardware security workshops during the aviation village. Learn from reverse engineers and understand how aviation components interact.
 Thank you so much for coming today. My name is Ken, this is my colleague Alex, and we're here to talk about aviation security. And the first thing I want to say is don't hack planes. It is illegal, it's dangerous, you'll go to jail. But what we want to show you today is some of the 101, some of the terminology you'll find up on planes, some of the systems you'll find, some of the security levels you'll find. There are huge levels of redundancy, some isolation and security on planes. You can't hack planes. But there are lots of interesting technologies you're going to find on there. A little background to us, so Alex and I are both light aircraft pilots. Alex, I found out five minutes ago, he's actually a qualified aeronautical engineer. I didn't know that. But it's actually quite a useful set of skills to bring together. Sort of things that we've done in the past, looking at embedded system security. So we're well known for our work in automotive, so car hacking, also in shipping, and IoT. You've probably seen lots of our work out there in the press. Some of you might be familiar with John McAfee's cryptocurrency wallet, the BitFi, the unhackable one that we hacked. But hey, all very useful and relevant experience when you come to looking at embedded system security. We've even tested all rigs and shown how from the public internet we could shift a rig off station. Crazy stuff, hey? Now, Alex is the clever one. I'm just the monkey who gets to hold probes in ports. That's him working. We've had some really interesting experience of late. One of the huge challenges for a security reach as a researcher is there are big barriers to entry, not least cost of components. We've got an avionics device out there on our table, a switch that's $75,000 to buy new. So there are huge barriers to entry. And there are also huge challenges with understanding, getting access to data sheets and understanding how the technology works. Now, we've been very lucky. We found a friendly boneyard that we asked nicely and they said, can we come and have a look at some of your end of life airframes? And they said, yeah. So usually when they fly in to be parted out, they're going to be sat there for two, three, four days whilst they get the engines off, which have already been pre-sold. But the ground power systems are still working. But you're working on an end of life device that isn't going to fly anymore. So you can look at it. You can inspect it. You can play with it without fear for affecting people's safety. And that was been really, really interesting. We learned a huge amount about that. Now, words of caution. Airplanes last a long time. If you find issues with them, they're very difficult to fix. They have to go through testing, recertification, and that takes a long time. So vulnerability disclosure in this industry isn't 90 days. It takes a long time to get that code checked, recertified, deployed for safety reasons. So don't expect manufacturers to come back to you and go, hey, yeah, that's fine. Publish that. It doesn't work like that. You need to be safe. I fly. I travel a lot. And I want to feel safe when I'm flying. I don't want people messing around with planes. However, in the past, the security model was fundamentally physical with huge layers of redundancy. So for example, in the case of autopilots, if you want to do a CAT 3C auto land in zero viz, three autopilots need to be working and operating if one does something odd, the other two disregard it and can land safely. There's huge areas of redundancy and failover. There are routes to disclose responsibly. You can work direct with manufacturers. You can work direct with regulators. There are routes to get vulnerabilities disclosed confidentially and safely. So please, if you find anything, do it responsibly. There is no value to publishing a story in the press that scares everyone off flying. That doesn't help anybody. Disclose responsibly. So how do we get started? Well, we got access to end of life airframes in the Boneyard. That one don't work so well anymore. There's more missing than present, I think. But we've had access to various airplanes, landed the day before, and got the chance to start looking at them. So it's my turn to hand over to Alex who's going to tell you what sort of things we looked at and what to find and what's there. Well, thanks, Ken. So I'm going to walk through kind of all the interfaces you might find on an aircraft. Some of them might be familiar to you and others not. But broadly, the aircraft is split or the avionics are split into three domains. Passenger, information, and control. So control is the highest level of safety. So this is anything that is going to be safety or flight critical, so autopilot, engines, that kind of stuff. There's an information domain. So this is nice to have info. So weather, navigational routing updates, efficiency, connections to airline systems so they might be able to help you if the aircraft is running late, they might be able to rebook you on to another flight actually from the aircraft itself. So they're not flight critical, but they're kind of nice to have. And then finally there's the passenger domain. So that's where you have your in-flight entertainment, the screens on the seat back, in-flight Wi-Fi, that kind of stuff. So these are from the least trusted to the most trusted. And there should be no route from the least trusted to the most trusted domain. So there should be no way to get from the passenger domain to the flight control domain, as you would expect. So I know this is going to sound a bit 101, but that was the title of the talk I came up with. But here's an airplane. There's a pointy bit in a hangar. When it's in a hangar, it actually has ground power connected to it and will touch on the challenges around power and testing later. But, you know, if it's in a hangar, it's going to be connected to a main supply. There are going to usually be two avionics bays and accesses through a hatch in the side of the aircraft. So this is how the physical control of security is implemented. These things are airside, all these avionics are behind locked doors and avionics bays. Inside these avionics bays, it looks something quite dank and horrible and it's really noisy. They have forced air conditioning, so when the power is up and running, it's deafening. So if you're thinking of working there, take care of plugs, please. It's really horrible to work in. So these are what are termed line replaceable units. So there is a rack and they lift out via a handle and they push into conaxes. The idea being that these are interchangeable units. So if there's a fault on one, they can be easily pulled out and swapped back in again. Hence, LRUs. So you can see at the back, lots of discrete cabling and this is the traditional way that aircraft have been built is that there are line replaceable units and they are cabled via their own cable routes up to the cockpit. So these cable routes have to be checked and certified so that things don't interfere with each other. If you want to install a new bit of kit, then everything has to be re-certified all over again so that there's no interference between neighboring cable runs. So really starting with the basics, what do we have on aircraft? Well, we have radios. We have VHF and HF radios. VHF is used for speaking to air traffic control but also for navigational aids that we'll touch on later. If you want to travel further, then we have HF radios. VHF is line of sight only. So although aircraft fly really high, you still have a fairly limited range. So if you're flying across a big ocean, then you're going to need a HF radio system. The VHF and HF radios also integrate with a system called ACARS and ACARS is a short text messaging service. And of course, you know, ideally we would have afforded our own aircraft to come here today but it's quite a long way so the best we can do is to have a party fly on ACARS. But we have hundreds and hundreds of thousands of aircraft airborne every day. We can't have encrypted communications over radio. It's just not feasible to manage the cryptographic keys between aircraft themselves and the ground. So VHF and HF is all unencrypted. You can buy a $20 receiver and you can listen into your local airport, you can listen into stuff. We'll even broadcast it on the internet. So you can sit there and listen to planes talking in decipherable gibberish with air traffic. So the ACARS system actually is really, really interesting in that you can actually push out routes to ACARS and do other things with it, size from just text message. Those routes have to be approved by the pilot and accepted. So there is always a human in the loop there. Obviously these days aircraft will have some sort of satellite navigation system like GPS. The precision levels of GPS aren't quite there for full automatic landing so there are these overlay services. So there is a GPS ground station that is in a very known fixed position and that is compared with the GPS signal that is coming down and a differential between the known location and what GPS location says is applied. So you can have sort of atmospheric effects that distort the signal. So this is then broadcast over radio and satellite to give a much higher degree of precision, sub-meter levels of precision. But we all know that GPS, although there are encrypted levels, the unencrypted system used on civil levels can be jammed. So I've got an example here, sorry at the back, but here's an example of a notice to airmen. I'm sorry, it's a really gendered terminology, but notice to airmen that in the UK the military are operating a jamming exercise in this area. And it's really interesting that when you read the note, actually for you know, 100 miles around this area potentially GPS could be affected. So GPS spoofing and jamming is definitely an issue. The military and foreign governments have certainly been known to do it. There are over term legacy navigational systems on the aircraft as well so we're not just reliant on GPS as the sole navigational system, there are radio navigational aids. So some of these date from the 1930s. So for example, VOR and NDB and DME, these are all date from the 1930s along with the instrument landing system, but ILS is in use daily. So ILS is used to guide the aircraft in to land. And there has been work shown relatively recently on how spoofed ILS signals could cause an aircraft to land off-center. But I think it's really important to take that in context in that if you've got visual with the runway, then a pilot is going to notice that you're landing off-center. But obviously if it's zero visibility, then you may not actually be able to see the painting paint on the runway to be able to realize that that's happening. So there is this interoperability between GPS, the overlay services and other radio navigational aids to kind of bring a holistic view and kind of mitigate some of these risks. So if we look on an aviation chart, we can actually see some of these legacy beacons listed. So the if I can zoom in, doesn't work. Great. But the circle in the center labeled EGLL, that's London Heathrow. We're starting to replace these legacy navigational aids with just waypoints in a database. So rather than rely on fixed radio navigational beacons, we have waypoints, three dimensional waypoints in the sky and we give them cute names. And air traffic controllers kind of get to name them and name these routes. And these are programmed in the flight management system. So there has to be a regular update of the flight management system, waypoint database, to every time new ones are issued, that these are set up. So air traffic control might tell you to route to whiskey or to bravo or to star or Juliet or whatever and you would find that waypoint name in your database and the aircraft will then fly to it. It's a virtual thing. There is no physical beacon that shows you where that is. It's all based on the navigational systems in the aircraft itself. So in this you can see that sort of traditionally some of the upper airways and navigational routes have converged on these legacy beacons just because of how they are. But now they're starting to converge on these virtual waypoints instead. So this is kind of the way that we're moving because we want to maximize efficiency of airspace. So having and running physical beacons is expensive and difficult to maintain and less flexible. So we're moving now to these waypoints in databases instead. Aircraft have satcom on them. They're not only used for inflight and entertainment purposes but they're used for by people like Rolls-Royce. I think it's an apocryphal story but I think it might be true that Rolls-Royce lose money on every engine sale that they make. If you buy an engine or from Rolls-Royce you buy it for less than it costs Rolls-Royce to make it. But they make all the money back over the lifetime on sales and maintenance and if you pay them a giant budget money they will monitor your engine in real time over things like satcom. So they can see and then EWC Center in Derby in the UK if one of your engines is running out of performance they can even get a part to wait for that aircraft to land. When you land at JFK for example they could have a part waiting for you so you can get it on and get that aircraft away really quickly. So it's not only engine data but it's for passenger Wi-Fi and also tracking as the MH370 that disappeared in Malaysia showed that it must have done some really great work on being able to look at Pings and find out where the aircraft potentially was although sadly never been found. Now we've done an awful lot of work on satcom in maritime and not all of it great. So this is some of the work we started looking at in shipping. Now shipping tends to be much less secure than aviation but we started to notice a lot of commonalities. So for example this is a terminal that we were looking at on a particular vessel. We've actually got one of these terminals sat over in the maritime village right now and we tend to find is in maritime people don't really pay attention to keeping the software up to date and this particular terminal we found on a boat we found we could remotely compromise it and route all the way through the vessel networks into the OT systems and take control of the engine. So this is why it's so important to keep software and technology bang up to date. And that's another interesting challenge for aviation is lots of different systems needing checked validation certification confidence they're secure which is all difficult to do when you're trying to keep up with security and security vulnerabilities. It's just another challenge to add the layer of complexity that you've got. Now I don't believe that these these sort of vulnerabilities are to be found in aircraft. I think aviation manufacturers are much more responsible they have much more vested interest in keeping it that way but we do find significant problems in satcoms in maritime. So sorry to continue with the acronym BLAST I mean IT is notorious for acronyms but aviation is way way worse and you bring the two together and it's just horrific. But I think it's maybe less than known that when you're on Wi-Fi you kind of assuming that on your plane that everything is going up in the sky by satellites when you're browsing Twitter or whatever. But actually in most of Europe and US there is a termed a complementary ground component. So when you're over land there are actually just LTE masks that operate on the 2 gigahertz band so it's just the same as your mobile phone except that the antennas are pointed upwards rather than horizontally. So next time you're kind of surfing the internet and you're flying over the continental US the chances are that your internet traffic is going out at the bottom of the airplane and back over the mobile phone network rather than satcom connection. So there is Wi-Fi on aircraft not only for passenger access but also for GateLink and GateLink started as a sort of proprietary radio protocol and it was used for exchanging data about the past sector that the aircraft has just flown back to the airline but also for receiving information about the next sector it's going to fly. So it's trying to cut down on the time it takes for the people at the gate to print out the load sheet, get you your waypoints and routing. Again it's just trying to maximize the efficiency of the aircraft by minimizing the amount of time that it's actually on the ground. Every time it's got weight on wheels then you know the aircraft isn't really making money so you want it flying kind of all the time. So GateLink has kind of morphed and there are now GateLink boxes and aircraft that use Wi-Fi. So GateLink set up access points at participating airports and when the aircraft detects that it's landed so there's weight on wheels, it will also receive a feed from the GPS system so it knows which airport it's at and it will look in its box and it will work out which Wi-Fi SSIDs to connect to, what the passphrase is, what the security etc. So when as the aircraft arrives at the gate it will join that Wi-Fi network and it will then again exchange information back with the airlines, receive data for the next segment and again try and maximize efficiency. But again I think it's showing that where there were proprietary protocols it's now moving to commodity ones and it's kind of lowering that bar to malicious actors. Where GateLink was something you might have to really decipher and spend thousands of dollars trying to understand what Wi-Fi is, stuff that we all know out here at DEF CON. There are other sources of data on aircraft so flying data acquisition units and quick access recorders. So again airlines want to do sort of almost big data analytics on their fleet. They want to know when in advance that there is a problem, not a safety critical one but an efficiency one. If there's a problem with the engines where they're consuming a bit more fuel than they anticipate then they want to start trying to bring forward maintenance to address that. Fuel is the major cost in airline operations. So if something is consuming more fuel than you expected you kind of want to address that. And traditionally the way of doing this was having a flight data acquisition unit in the aircraft that sucked in lots of parameters from all sorts of systems. And we've got one out on our stand in the aviation village so you can come and have a look. And the one that we've got uses a magneto optical drive. Yeah, really. But you've also seen ones with PC cards but these require someone to climb into the AVA on X-Bay, eject that disk and then ship it back to the airline. So again to maximize efficiency they're starting to put in wireless ones. So they're putting in Wi-Fi and they're putting in wireless 4G modems so that when the aircraft lands all this data is kind of instantly transmitted back. So this is a wireless quick access recorder off the FCC website. So again it's showing that the bar to access this information whereby you may be previously had to buy avionics, a huge premium. You can just go to the FCC website and this information is public. So here you can see what wireless cards are in use, there's a USB port on the other side. So this is all kind of interesting information when you're trying to explore the interfaces to aircraft. So radar is an interesting one. There are primary radar so the big spinny thing you see are airports, sends out pulses of radio waves and listens for the responses. But primary radar is not great. You get returns of things like thunderstorms, flocks of birds, insects I saw recently, like a whole, like ants, flying ants in the UK showed up on radar. Passing trucks will even give radar returns. And all of this adds clutter to traffic and it's difficult for them to work out what is noise versus real aircraft. So we started putting transponders in aircraft. So as soon as they're illuminated by primary radar source they send back over a different radio channel information about their height, a serial number so that traffic control, air traffic control can associate and see much better what aircraft are doing, what height they are and assign them kind of a unique code so they can track them better. Now this has started to evolve a bit and there is a protocol called ADS-B. And ADS-B has started to become mandatory in the US from next year. So if you fly a light aircraft you will have to have an ADS-B transmitter fitted to your aircraft. And ADS-B interfaces with GPS to provide also rather than just a code but also your exact height and location information in that return. And Renderman who was in the panel previously, you probably heard has done some work on ADS-B spoofing. This is all unencrypted information so you can view ADS-B transmissions from aircraft so you can see where they are. I think maybe it's not a known thing that if you look on something like Flightradar they do actually filter out certain ADS-B channels from military, police helicopters, things like that. But you can buy a $5 TV dongle off eBay and you can listen to ADS-B returns on your own. And if you come to the village people will show you how to do that. So you can see unfiltered ADS-B responses. And again I don't think regulators have quite caught on something that was a safety critical service. Now it's kind of security implications because it's an unencrypted broadcast protocol. There is another service on commercial airliners called T-CAS which is a traffic collision avoidance system. T-CAS operates on its own bands and aircraft communicate with themselves to try and keep them away from each other. But T-CAS can also take a feeding from ADS-B. So only large commercial aircraft will have T-CAS fitted but smaller light aircraft may also infringe into the airspace of commercial aircraft and therefore you kind of want to know where they might be coming from. So T-CAS can use ADS-B transmissions to give you a deconfliction advice. Now on really, really modern aircraft A350s, A380s there is an option for T-CAS to be coupled with the autopilot. And if a pilot doesn't take evasive action then T-CAS will drive the autopilot and move the aircraft for you. So you can see the potential risk for spoofed ADS-B transmissions to start moving aircraft around in the sky. So where there's no real aircraft it could potentially cause it to climb or descend. Now I think it's really important to note that some of these systems are disengaged when aircraft are near the ground for example when they're in landing configuration and that there is a lot of separation in controlled airspace between other aircraft. So the chances of this actually causing an incident I think is very, very low but it could be enough to unsettle a pilot. And so I think airlines need to be quite careful when they couple collision avoidance systems with automatic systems in this way. They need to be conscious that ADS-B is only encrypted and broadcast, people can see it and manipulate it and spoof it and therefore relying on this as a security system is maybe not the best idea. So here's one of our flight data acquisition units not to be confused with the orange black box. So it's a pet thing, you know they're not black, they're orange. But the flight data record is black. So if you want to come and see a flight data acquisition unit come over to the village and you can have a look at the crazy Magneto optical drive. But these things store much more information than a copy of voice recorder or a flight data recorder. They only store a few hundred parameters and for an hour a flight data acquisition unit stores pretty much everything, thousands and thousands of parameters and for much longer, no, 72 hours or more. So maybe the bit that's kind of more interesting is in the passenger domain. Now what are you seeing when you sit there? All of this stuff is up to now has kind of been hidden away from you. So a lot of the stuff flying you probably know is really tiny screens, really crappy IFE, that's really fuzzy and it's quite old. But you know 20 year old stuff is not uncommon to find on aircraft and it's still current and flying. They're starting to move maybe towards Android tablets but again they're of an older vintage. Some of them have a USB on them, not only for charging but so you can play your media through the screen. There's an integration with the flight management system. So that moving map you see with the aircraft moving, there is a connection to the aircraft's navigational systems to do that. Now this is crossing domains from the flight control domain into the passenger domain. But it's going from a highly trusted area to a less trusted area and there are data diodes in use so that this is a unidirectional connection only. Now I think there has been some previous alarmist reporting on being able to control the aircraft through IFE systems and I find that highly, highly unlikely. That there are multiple layers you would have to jump through and aircraft networks are segregated and segmented and frankly I have seen way worse network segmentation when I go and break into corporate IT offices than I see on aircraft. So I think you should, as with everything in IT, take some things with a bit of a pinch of salt. So there is also the delightfully named FAP, the flight attendant panel. So when you come onto the aircraft there is a touch screen now that allows the flight crew to dim the lights, set the boarding music, all that kind of stuff. And if you look there's often USB on there. USB is used for updating the music but also to tell the aircraft about new seating arrangements. Airlines like to move and resize business class and where I sit at the back in cattle class. So in order to kind of adjust air conditioning and stuff like that they need to update the seat layout and that's done via USB. But USB inputs on the flight attendant panels are heavily filtered so that they don't accept any old inputs. Again there's Wi-Fi, there is a passenger domain Wi-Fi and there is a crew domain Wi-Fi. The crew Wi-Fi gives them more access, they don't have to pay for it for a start but it also gives them maybe dedicated access through to the airline system so they can rebook you and stuff through iPads. We've got some IFEC seat boxes at the village. So here's kind of, yeah it looks pretty old and it is but you still see them flying. So it's an X86 based system, it's actually got AT, if you look on it it's got a sound blaster card in it, it's like properly vintage and really, really retro. And yeah, there are PLCC's on there, there's all that kind of good stuff from 20 years ago. Up at the point at the end, I mean I was lucky to grow up when you were still allowed to go up to the cockpit when I was in flight and I'm not sure many people get that opportunity these days but if you haven't been up there, that's what a flight dad looks like. I think they're really, really cool, interesting places. They have really, really fancy screens but what do the screens do? Well, there's again redundancy for everything. We've got two humans in the cockpit, captain and a first officer and we duplicate, in fact, triplicate the really, really important stuff. So on the left hand side, the left most screen is the primary flight display so that's showing you which way is sky and which way is earth, how fast you're going, how high you're going, which way you're pointing. The really, really critical things for flying an aircraft. The one next to it is showing a navigational display where the autopilot is planning to take the aircraft next and this is duplicated on the first officer's side. In fact, there's another primary flight display which is completely segregated from all these systems. So if all else fails, they can still fly the aircraft by hand. So up on the top is the autopilot and navigational mode display so the autopilot has many, many, many modes. So you can get it to climb at a certain rate, hold a heading, hold an altitude, hold a speed, configure for landing, all that kind of stuff and all that is done from the glass shield above. So both pilots can see what mode the aircraft is setting. In the middle here, depending on which airframe manufacturer is the crew alerting system or alert management system and this is designed to kind of tell you when there are problems, show you what state the avionics are in or the engines are doing, stuff that isn't, need to be right there in front of you but needs to be readily accessible and shows you when there is a problem. We don't want to give you unnecessary information but we want to be sure that you can see it and be alerted to it when there is actually a problem. At the bottom here is all the radio settings so for voice and data and for HF and for navigation and for interfacing with ACARS and we have our two MCDUs or interfaces into the flight management system. Again, we've got a really awesome vintage one on our stands so if you want to come and have a look at one, inside, beautiful wire wrapping and the levels of redundancy again that go into the design of these, please come and have a look but these are designed to be kind of a multiple interface, interface to multiple systems on the aircraft. So this is what drives your route, how you update the navigation system, all that kind of thing. So on more modern aircraft, we're starting to integrate what are called electronic flight bags. Back in the day, you would see the pilot come on with a big suitcase, powerful flight manuals, paper charts and plates and they would get repetitive strain injury from carrying these things through airports. So initially, this transition to just having an iPad or similar that the crew carried on to the aircraft with these things in electronic form and these were termed sort of class one devices. They had power from the aircraft but nothing else. They would sit on the side of the glare shield and just be sort of an electronic replacement for the paper charts and manuals that they already carried. But now we're starting to move on to more integrated systems, class two and class three devices that actually integrate with aircraft systems. They can connect via cable or through Wi-Fi and actually start transferring a route directly onto the flight management system itself. So you can start to see that there is an enterprise IT management segment. It's not just avionics anymore, we're having to manage not only pilot iPads, backend systems for electronic flight bags but also for maintenance crews. When they come onto the aircraft, they want to do updates, they want to retrieve data, they have to plug in their laptop somehow. And again, there's an enterprise IT management issue in how those laptops are maintained, made malware free. So it's not just black boxes and aircraft anymore, these are now connected systems. But how are these things all kind of connected together? Well, back in the 1970s, we came up with Aring-429. And because it's the 1970s, cryptography wasn't a thing back then, or at least to Joe Public. So there is no encryption and there is no authentication on Aring-429, but that's okay because it's a point-to-point protocol, it's used to connect line replaceable units in the aircraft together. There is no bus, you can see, you can't connect to Aring-429 from the passenger domain. So again, the physical access controls kick in. So it's a single source to single sync protocol, it uses a differential voltage type setup. So it's looking for sort of plus 10 and minus 10 volts in order to eliminate interference issues. You can readily obtain Aring-429 decoders, either sort of USB ones, people have written Raspberry Pines faces, if you've got a PicoScope, there's a 429 decoder. Now you can see 429 in aircraft cockpits, but on a very limited way. These are used for interfacing with the flight management system and other bits and pieces, although data load is a separate protocol itself. But if you did have access to 429, then yeah, you can intercept, you can replay messages, there's none of no replay connection, there's no encryption. But it is a point-to-point protocol and the chances of you being able to find that on an aircraft are low. So it does have a really strange message structure, I probably don't want to go into it. But there was an attempt to fix this issue of all this proliferation of cabling. So when Boeing designed the 777, they came up with a protocol called 629. So this is a bus and there are inductive couplers and again you can take a look at one in the village. And inductive couplers connect to a pair of wires, there is an A bus and a B bus and this is a multi-source multi-sync true bus protocol. But again, these wires run through bits of the aircraft that you're never going to get to see. They don't run through the passenger domain. So the physical access control is sufficient mitigation to deal with the fact that you can just clip on to one of these cables. Now decoding 629 is really tough. In fact, there's kind of pretty much only one manufacturer that we found. So shout out to them, who lent us kit in the past. So if you want to decode it with max technologies and you want to buy one, that's $30,000 if you want to buy this piece of kit and look at one. So 629 is only found on the 777. But as we now go to modern aircraft, so A350, A380, 787, 737 max family for example, we've gone to Ethernet. So this is starting to sound quite familiar to the people here at Defconn. So it's got a posh name, AFDX or ARIN 664, but under the hood it is kind of Ethernet. And in fact, if you go to avionics test beds, they use commodity Ethernet switches to save money. Now we don't use commodity Ethernet switches on aircraft. They're going to be optical, they are highly resilient, we use them in multiple redundant pairs, they're segmented and they use what are called virtual links rather than IP addressing. But it is still common to find ICMP, UDP, SNMP floating around on these networks. So it's all stuff that's really familiar to us. So again, you're starting to see maybe the bar of access starting to decrease rather than these kind of esoteric protocols. CAN also appears on aircraft. On the A380, the overhead panel with all the buttons and environmental sensors and temperature and environmental controls is all run on CAN. So again, a differential voltage protocol to minimize interference. And shout out to people in the village who have talked about CAN, but in general aviation in the last couple of weeks. In this case it was a fuel sender. But again, CAN, yes, is an unencrypted, unauthenticated protocol, but you have to have the skull access to manipulate this. And we put aircraft, air side, we put things behind locked cockpit doors. So there are mitigations. Again, if it was a general aircraft, it's going to be in a hangar, you're going to lock the door hopefully. If someone has physical access to your plane, they're probably going to rob it more than mess with the fuel senders on it. Now, power on aircraft is really weird. So it's 115 volt AC, 400 hertz, or 28 volt DC in some places. So if you're working on an aircraft, you're going to have to take your own power. There's no way for you to plug your laptop in. If you want to hoover vacuum and aircraft, then you're going to have to buy a very special $400 vacuum cleaner to do that. This is what, you know, when they clean the aircraft, this is what they're bringing on to do it. So you're going to have to consider this when you're working in an aircraft environment. And it is tricky. So we brought some avionics and I used with us. They're all of a certain vintage, but they are still flying today, even though they're 20 years old. But that hardware reverse engineering strategy is pretty similar to everything else. Is that you take boards apart, you look for data sheets, you look for them part numbers, start tracing tracks. Everything that's like really familiar to us. What's kind of really irritating is it's dipped in a conformal coating. So if you want to start tracing and buzzing out, it's really irritating to do. But, you know, they're designed to be living in a hostile environment, so you would expect that. There are PLCCs on there, so you can try and drop the firmware out of it. A lot of them have readout protection on them, but some of them maybe don't. But all of the tools that you're familiar with, Sega's, Sala's, you are, all that kind of stuff is completely applicable. So if you've done any hardware RE, then you can start looking at these from a black box perspective. As Ken has said, you know, if you're starting to find stuff, then you need to be reporting that through the appropriate channels. But these things are designed for redundancy. You see PLCCs a lot. They are designed just in ICS and SCADA. They are designed to be used in a highly resilient and fail safe and safety critical way. But things are kind of starting to change. So we're now starting to see common compute systems, common compute resources. So rather than having discrete line replaceable units and black boxes in avionics base, there are line cards and commodity processes that run software. So VXWorks is quite common to see. And there are firmware updates for this. So you can go to a vendor website and you can download and modify the behavior of the aircraft in limited ways. So on those nice flat screens in the aircraft, you might want to have different checklist items for start up and take off, for example. And airlines can customize that to a certain degree using airline provided tools that are then uploaded. And these are actually cryptographically signed. So again, you can see there is significant mitigation. It's not like someone hacking a text file. These are quite controlled devices. But because it's, you know, VXWorks, there's hypervisors, there's Linux kernels. Again, you can see that the bar of access is starting to drop down. So as my voice is starting to give out, we've kind of come to the end. And what I want to say is that, yes, stuff back in the day was predicated on the physical access model. But we've always had humans in the loop. You know, if the aircraft starts behaving a bit weirdly, the autopilot can be disengaged, the human could start flying it. And that, and I think is fine. And I think people need to keep that perspective. But yes, in the drive for efficiency, airlines and manufacturers are starting to put on Wi-Fi, 4G, SATCOM. And these carry a security risk. And they have done due diligence. But there is room to meet in the middle. And that's why we're running the aviation village here. It's to bring together the minds of people who've worked on automotive and hardware security and to bring that unpredictability of that threat together with aviation so that everything is safer. We all want to carry on flying. And 20 years ago, maybe the threat model was, who would want to hurt aircraft? And now I think that has definitely changed. And that is a good place to be. But there are many, many mitigations as we've talked about. There's built-in redundancy, there's lots of systems. You can't just go hack a plane. So forgive for the slightly click-baity title. But hopefully that's a quick run-through of all of the acronyms and things you might find on aircraft. And hopefully when you're flying, you're going to feel a bit safer. So thank you. If there's any questions, we've got a few minutes to take them. But otherwise, we're going to be at the aviation village. Do come and find us. Thank you. Thank you.
 Thank you so much for coming today. My name is Ken, this is my colleague Alex, and we're  here to talk about aviation security. And the first thing I want to say is don't hack  planes. It is illegal, it's dangerous, you'll go to jail. But what we want to show you today  is some of the 101, some of the terminology you'll find up on planes, some of the systems  you'll find, some of the security levels you'll find. There are huge levels of redundancy,  some isolation and security on planes. You can't hack planes. But there are lots of interesting  technologies you're going to find on there. A little background to us, so Alex and I are  both light aircraft pilots. Alex, I found out five minutes ago, he's actually a qualified  aeronautical engineer. I didn't know that. But it's actually quite a useful set of skills  to bring together. Sort of things that we've done in the past, looking at embedded system  security. So we're well known for our work in automotive, so car hacking, also in shipping,  and IoT. You've probably seen lots of our work out there in the press. Some of you might  be familiar with John McAfee's cryptocurrency wallet, the BitFi, the unhackable one that  we hacked. But hey, all very useful and relevant experience when you come to looking at embedded  system security. We've even tested all rigs and shown how from the public internet we  could shift a rig off station. Crazy stuff, hey? Now, Alex is the clever one. I'm just  the monkey who gets to hold probes in ports. That's him working. We've had some really  interesting experience of late. One of the huge challenges for a security reach as a  researcher is there are big barriers to entry, not least cost of components. We've got an  avionics device out there on our table, a switch that's $75,000 to buy new. So there  are huge barriers to entry. And there are also huge challenges with understanding, getting  access to data sheets and understanding how the technology works. Now, we've been very  lucky. We found a friendly boneyard that we asked nicely and they said, can we come and  have a look at some of your end of life airframes? And they said, yeah. So usually when they fly  in to be parted out, they're going to be sat there for two, three, four days whilst they  get the engines off, which have already been pre-sold. But the ground power systems are  still working. But you're working on an end of life device that isn't going to fly anymore.  So you can look at it. You can inspect it. You can play with it without fear for affecting  people's safety. And that was been really, really interesting. We learned a huge amount  about that. Now, words of caution. Airplanes last a long time. If you find issues with  them, they're very difficult to fix. They have to go through testing, recertification,  and that takes a long time. So vulnerability disclosure in this industry isn't 90 days.  It takes a long time to get that code checked, recertified, deployed for safety reasons.  So don't expect manufacturers to come back to you and go, hey, yeah, that's fine. Publish  that. It doesn't work like that. You need to be safe. I fly. I travel a lot. And I want  to feel safe when I'm flying. I don't want people messing around with planes. However,  in the past, the security model was fundamentally physical with huge layers of redundancy.  So for example, in the case of autopilots, if you want to do a CAT 3C auto land in zero  viz, three autopilots need to be working and operating if one does something odd, the other  two disregard it and can land safely. There's huge areas of redundancy and failover. There  are routes to disclose responsibly. You can work direct with manufacturers. You can work  direct with regulators. There are routes to get vulnerabilities disclosed confidentially  and safely. So please, if you find anything, do it responsibly. There is no value to publishing  a story in the press that scares everyone off flying. That doesn't help anybody. Disclose  responsibly. So how do we get started? Well, we got access to end of life airframes in the  Boneyard. That one don't work so well anymore. There's more missing than present, I think.  But we've had access to various airplanes, landed the day before, and got the chance  to start looking at them. So it's my turn to hand over to Alex who's going to tell you  what sort of things we looked at and what to find and what's there.  Well, thanks, Ken. So I'm going to walk through kind of all the interfaces you might find  on an aircraft. Some of them might be familiar to you and others not. But broadly, the aircraft  is split or the avionics are split into three domains. Passenger, information, and control.  So control is the highest level of safety. So this is anything that is going to be safety  or flight critical, so autopilot, engines, that kind of stuff. There's an information  domain. So this is nice to have info. So weather, navigational routing updates, efficiency,  connections to airline systems so they might be able to help you if the aircraft is running  late, they might be able to rebook you on to another flight actually from the aircraft  itself. So they're not flight critical, but they're kind of nice to have. And then finally  there's the passenger domain. So that's where you have your in-flight entertainment, the  screens on the seat back, in-flight Wi-Fi, that kind of stuff. So these are from the  least trusted to the most trusted. And there should be no route from the least trusted to  the most trusted domain. So there should be no way to get from the passenger domain to  the flight control domain, as you would expect. So I know this is going to sound a bit 101,  but that was the title of the talk I came up with. But here's an airplane. There's a  pointy bit in a hangar. When it's in a hangar, it actually has ground power connected to  it and will touch on the challenges around power and testing later. But, you know, if  it's in a hangar, it's going to be connected to a main supply. There are going to usually  be two avionics bays and accesses through a hatch in the side of the aircraft. So this  is how the physical control of security is implemented. These things are airside, all  these avionics are behind locked doors and avionics bays. Inside these avionics bays,  it looks something quite dank and horrible and it's really noisy. They have forced air  conditioning, so when the power is up and running, it's deafening. So if you're thinking  of working there, take care of plugs, please. It's really horrible to work in. So these  are what are termed line replaceable units. So there is a rack and they lift out via a  handle and they push into conaxes. The idea being that these are interchangeable units.  So if there's a fault on one, they can be easily pulled out and swapped back in again.  Hence, LRUs. So you can see at the back, lots of discrete cabling and this is the traditional  way that aircraft have been built is that there are line replaceable units and they  are cabled via their own cable routes up to the cockpit. So these cable routes have to  be checked and certified so that things don't interfere with each other. If you want to  install a new bit of kit, then everything has to be re-certified all over again so  that there's no interference between neighboring cable runs. So really starting with the basics,  what do we have on aircraft? Well, we have radios. We have VHF and HF radios. VHF is  used for speaking to air traffic control but also for navigational aids that we'll touch  on later. If you want to travel further, then we have HF radios. VHF is line of sight only.  So although aircraft fly really high, you still have a fairly limited range. So if you're  flying across a big ocean, then you're going to need a HF radio system. The VHF and HF radios  also integrate with a system called ACARS and ACARS is a short text messaging service.  And of course, you know, ideally we would have afforded our own aircraft to come here  today but it's quite a long way so the best we can do is to have a party fly on ACARS.  But we have hundreds and hundreds of thousands of aircraft airborne every day. We can't have  encrypted communications over radio. It's just not feasible to manage the cryptographic  keys between aircraft themselves and the ground. So VHF and HF is all unencrypted. You can  buy a $20 receiver and you can listen into your local airport, you can listen into stuff.  We'll even broadcast it on the internet. So you can sit there and listen to planes talking  in decipherable gibberish with air traffic. So the ACARS system actually is really, really  interesting in that you can actually push out routes to ACARS and do other things with  it, size from just text message. Those routes have to be approved by the pilot and accepted.  So there is always a human in the loop there. Obviously these days aircraft will have some  sort of satellite navigation system like GPS. The precision levels of GPS aren't quite  there for full automatic landing so there are these overlay services. So there is a GPS  ground station that is in a very known fixed position and that is compared with the GPS  signal that is coming down and a differential between the known location and what GPS location  says is applied. So you can have sort of atmospheric effects that distort the signal. So this is  then broadcast over radio and satellite to give a much higher degree of precision, sub-meter  levels of precision. But we all know that GPS, although there are encrypted levels, the  unencrypted system used on civil levels can be jammed. So I've got an example here, sorry  at the back, but here's an example of a notice to airmen. I'm sorry, it's a really gendered  terminology, but notice to airmen that in the UK the military are operating a jamming  exercise in this area. And it's really interesting that when you read the note, actually for  you know, 100 miles around this area potentially GPS could be affected. So GPS spoofing and  jamming is definitely an issue. The military and foreign governments have certainly been  known to do it. There are over term legacy navigational systems on the aircraft as well  so we're not just reliant on GPS as the sole navigational system, there are radio navigational  aids. So some of these date from the 1930s. So for example, VOR and NDB and DME, these  are all date from the 1930s along with the instrument landing system, but ILS is in use  daily. So ILS is used to guide the aircraft in to land. And there has been work shown  relatively recently on how spoofed ILS signals could cause an aircraft to land off-center.  But I think it's really important to take that in context in that if you've got visual  with the runway, then a pilot is going to notice that you're landing off-center. But  obviously if it's zero visibility, then you may not actually be able to see the painting  paint on the runway to be able to realize that that's happening. So there is this interoperability  between GPS, the overlay services and other radio navigational aids to kind of bring a  holistic view and kind of mitigate some of these risks. So if we look on an aviation  chart, we can actually see some of these legacy beacons listed. So the if I can zoom in, doesn't  work. Great. But the circle in the center labeled EGLL, that's London Heathrow. We're  starting to replace these legacy navigational aids with just waypoints in a database. So  rather than rely on fixed radio navigational beacons, we have waypoints, three dimensional  waypoints in the sky and we give them cute names. And air traffic controllers kind of  get to name them and name these routes. And these are programmed in the flight management  system. So there has to be a regular update of the flight management system, waypoint  database, to every time new ones are issued, that these are set up. So air traffic control  might tell you to route to whiskey or to bravo or to star or Juliet or whatever and you  would find that waypoint name in your database and the aircraft will then fly to it. It's  a virtual thing. There is no physical beacon that shows you where that is. It's all based  on the navigational systems in the aircraft itself. So in this you can see that sort of  traditionally some of the upper airways and navigational routes have converged on these  legacy beacons just because of how they are. But now they're starting to converge on these  virtual waypoints instead. So this is kind of the way that we're moving because we want  to maximize efficiency of airspace. So having and running physical beacons is expensive  and difficult to maintain and less flexible. So we're moving now to these waypoints in  databases instead. Aircraft have satcom on them. They're not only used for inflight and  entertainment purposes but they're used for by people like Rolls-Royce. I think it's an  apocryphal story but I think it might be true that Rolls-Royce lose money on every engine  sale that they make. If you buy an engine or from Rolls-Royce you buy it for less than  it costs Rolls-Royce to make it. But they make all the money back over the lifetime  on sales and maintenance and if you pay them a giant budget money they will monitor your  engine in real time over things like satcom. So they can see and then EWC Center in Derby  in the UK if one of your engines is running out of performance they can even get a part  to wait for that aircraft to land. When you land at JFK for example they could have a  part waiting for you so you can get it on and get that aircraft away really quickly.  So it's not only engine data but it's for passenger Wi-Fi and also tracking as the MH370  that disappeared in Malaysia showed that it must have done some really great work on being  able to look at Pings and find out where the aircraft potentially was although sadly never  been found. Now we've done an awful lot of work on satcom in maritime and not all of  it great.  So this is some of the work we started looking at in shipping. Now shipping tends to be much  less secure than aviation but we started to notice a lot of commonalities. So for example  this is a terminal that we were looking at on a particular vessel. We've actually got  one of these terminals sat over in the maritime village right now and we tend to find is in  maritime people don't really pay attention to keeping the software up to date and this  particular terminal we found on a boat we found we could remotely compromise it and route  all the way through the vessel networks into the OT systems and take control of the engine.  So this is why it's so important to keep software and technology bang up to date. And  that's another interesting challenge for aviation is lots of different systems needing  checked validation certification confidence they're secure which is all difficult to do  when you're trying to keep up with security and security vulnerabilities. It's just another  challenge to add the layer of complexity that you've got. Now I don't believe that these  these sort of vulnerabilities are to be found in aircraft. I think aviation manufacturers  are much more responsible they have much more vested interest in keeping it that way but  we do find significant problems in satcoms in maritime.  So sorry to continue with the acronym BLAST I mean IT is notorious for acronyms but aviation  is way way worse and you bring the two together and it's just horrific. But I think it's maybe  less than known that when you're on Wi-Fi you kind of assuming that on your plane that  everything is going up in the sky by satellites when you're browsing Twitter or whatever.  But actually in most of Europe and US there is a termed a complementary ground component.  So when you're over land there are actually just LTE masks that operate on the 2 gigahertz  band so it's just the same as your mobile phone except that the antennas are pointed  upwards rather than horizontally. So next time you're kind of surfing the internet and  you're flying over the continental US the chances are that your internet traffic is going out  at the bottom of the airplane and back over the mobile phone network rather than satcom  connection. So there is Wi-Fi on aircraft not only for passenger access but also for  GateLink and GateLink started as a sort of proprietary radio protocol and it was used  for exchanging data about the past sector that the aircraft has just flown back to the  airline but also for receiving information about the next sector it's going to fly. So  it's trying to cut down on the time it takes for the people at the gate to print out the  load sheet, get you your waypoints and routing. Again it's just trying to maximize the efficiency  of the aircraft by minimizing the amount of time that it's actually on the ground. Every  time it's got weight on wheels then you know the aircraft isn't really making money so  you want it flying kind of all the time. So GateLink has kind of morphed and there are  now GateLink boxes and aircraft that use Wi-Fi. So GateLink set up access points at participating  airports and when the aircraft detects that it's landed so there's weight on wheels, it  will also receive a feed from the GPS system so it knows which airport it's at and it will  look in its box and it will work out which Wi-Fi SSIDs to connect to, what the passphrase  is, what the security etc. So when as the aircraft arrives at the gate it will join that Wi-Fi  network and it will then again exchange information back with the airlines, receive data for the  next segment and again try and maximize efficiency. But again I think it's showing that where  there were proprietary protocols it's now moving to commodity ones and it's kind of lowering  that bar to malicious actors. Where GateLink was something you might have to really decipher  and spend thousands of dollars trying to understand what Wi-Fi is, stuff that we all know out  here at DEF CON. There are other sources of data on aircraft so flying data acquisition  units and quick access recorders. So again airlines want to do sort of almost big data  analytics on their fleet. They want to know when in advance that there is a problem, not  a safety critical one but an efficiency one. If there's a problem with the engines where  they're consuming a bit more fuel than they anticipate then they want to start trying  to bring forward maintenance to address that. Fuel is the major cost in airline operations.  So if something is consuming more fuel than you expected you kind of want to address that.  And traditionally the way of doing this was having a flight data acquisition unit in the  aircraft that sucked in lots of parameters from all sorts of systems. And we've got one  out on our stand in the aviation village so you can come and have a look. And the one  that we've got uses a magneto optical drive. Yeah, really. But you've also seen ones with  PC cards but these require someone to climb into the AVA on X-Bay, eject that disk and  then ship it back to the airline. So again to maximize efficiency they're starting to  put in wireless ones. So they're putting in Wi-Fi and they're putting in wireless 4G  modems so that when the aircraft lands all this data is kind of instantly transmitted  back. So this is a wireless quick access recorder off the FCC website. So again it's showing  that the bar to access this information whereby you may be previously had to buy avionics,  a huge premium. You can just go to the FCC website and this information is public. So  here you can see what wireless cards are in use, there's a USB port on the other side.  So this is all kind of interesting information when you're trying to explore the interfaces  to aircraft. So radar is an interesting one. There are primary radar so the big spinny  thing you see are airports, sends out pulses of radio waves and listens for the responses.  But primary radar is not great. You get returns of things like thunderstorms, flocks of birds,  insects I saw recently, like a whole, like ants, flying ants in the UK showed up on  radar. Passing trucks will even give radar returns. And all of this adds clutter to traffic  and it's difficult for them to work out what is noise versus real aircraft. So we started  putting transponders in aircraft. So as soon as they're illuminated by primary radar source  they send back over a different radio channel information about their height, a serial number  so that traffic control, air traffic control can associate and see much better what aircraft  are doing, what height they are and assign them kind of a unique code so they can track  them better. Now this has started to evolve a bit and there is a protocol called ADS-B.  And ADS-B has started to become mandatory in the US from next year. So if you fly a light  aircraft you will have to have an ADS-B transmitter fitted to your aircraft. And ADS-B interfaces  with GPS to provide also rather than just a code but also your exact height and location  information in that return. And Renderman who was in the panel previously, you probably  heard has done some work on ADS-B spoofing. This is all unencrypted information so you  can view ADS-B transmissions from aircraft so you can see where they are. I think maybe  it's not a known thing that if you look on something like Flightradar they do actually  filter out certain ADS-B channels from military, police helicopters, things like that. But  you can buy a $5 TV dongle off eBay and you can listen to ADS-B returns on your own. And  if you come to the village people will show you how to do that. So you can see unfiltered  ADS-B responses. And again I don't think regulators have quite caught on something that was a  safety critical service. Now it's kind of security implications because it's an unencrypted  broadcast protocol. There is another service on commercial airliners called T-CAS which  is a traffic collision avoidance system. T-CAS operates on its own bands and aircraft communicate  with themselves to try and keep them away from each other. But T-CAS can also take a feeding  from ADS-B. So only large commercial aircraft will have T-CAS fitted but smaller light aircraft  may also infringe into the airspace of commercial aircraft and therefore you kind of want to  know where they might be coming from. So T-CAS can use ADS-B transmissions to give you a  deconfliction advice. Now on really, really modern aircraft A350s, A380s there is an option  for T-CAS to be coupled with the autopilot. And if a pilot doesn't take evasive action  then T-CAS will drive the autopilot and move the aircraft for you. So you can see the potential  risk for spoofed ADS-B transmissions to start moving aircraft around in the sky. So where  there's no real aircraft it could potentially cause it to climb or descend. Now I think  it's really important to note that some of these systems are disengaged when aircraft  are near the ground for example when they're in landing configuration and that there is  a lot of separation in controlled airspace between other aircraft. So the chances of  this actually causing an incident I think is very, very low but it could be enough to  unsettle a pilot. And so I think airlines need to be quite careful when they couple  collision avoidance systems with automatic systems in this way. They need to be conscious  that ADS-B is only encrypted and broadcast, people can see it and manipulate it and spoof  it and therefore relying on this as a security system is maybe not the best idea. So here's  one of our flight data acquisition units not to be confused with the orange black box.  So it's a pet thing, you know they're not black, they're orange. But the flight data  record is black. So if you want to come and see a flight data acquisition unit come over  to the village and you can have a look at the crazy Magneto optical drive. But these  things store much more information than a copy of voice recorder or a flight data recorder.  They only store a few hundred parameters and for an hour a flight data acquisition unit  stores pretty much everything, thousands and thousands of parameters and for much longer,  no, 72 hours or more. So maybe the bit that's kind of more interesting is in the passenger  domain. Now what are you seeing when you sit there? All of this stuff is up to now has  kind of been hidden away from you. So a lot of the stuff flying you probably know is really  tiny screens, really crappy IFE, that's really fuzzy and it's quite old. But you know 20  year old stuff is not uncommon to find on aircraft and it's still current and flying.  They're starting to move maybe towards Android tablets but again they're of an older vintage.  Some of them have a USB on them, not only for charging but so you can play your media  through the screen. There's an integration with the flight management system. So that  moving map you see with the aircraft moving, there is a connection to the aircraft's navigational  systems to do that. Now this is crossing domains from the flight control domain into the passenger  domain. But it's going from a highly trusted area to a less trusted area and there are  data diodes in use so that this is a unidirectional connection only. Now I think there has been  some previous alarmist reporting on being able to control the aircraft through IFE systems  and I find that highly, highly unlikely. That there are multiple layers you would have to  jump through and aircraft networks are segregated and segmented and frankly I have seen way  worse network segmentation when I go and break into corporate IT offices than I see  on aircraft. So I think you should, as with everything in IT, take some things with a  bit of a pinch of salt. So there is also the delightfully named FAP, the flight attendant  panel. So when you come onto the aircraft there is a touch screen now that allows the  flight crew to dim the lights, set the boarding music, all that kind of stuff. And if you  look there's often USB on there. USB is used for updating the music but also to tell the  aircraft about new seating arrangements. Airlines like to move and resize business  class and where I sit at the back in cattle class. So in order to kind of adjust air conditioning  and stuff like that they need to update the seat layout and that's done via USB. But USB  inputs on the flight attendant panels are heavily filtered so that they don't accept  any old inputs. Again there's Wi-Fi, there is a passenger domain Wi-Fi and there is a  crew domain Wi-Fi. The crew Wi-Fi gives them more access, they don't have to pay for it  for a start but it also gives them maybe dedicated access through to the airline system so they  can rebook you and stuff through iPads. We've got some IFEC seat boxes at the village. So  here's kind of, yeah it looks pretty old and it is but you still see them flying. So it's  an X86 based system, it's actually got AT, if you look on it it's got a sound blaster  card in it, it's like properly vintage and really, really retro. And yeah, there are  PLCC's on there, there's all that kind of good stuff from 20 years ago. Up at the point  at the end, I mean I was lucky to grow up when you were still allowed to go up to the  cockpit when I was in flight and I'm not sure many people get that opportunity these  days but if you haven't been up there, that's what a flight dad looks like. I think they're  really, really cool, interesting places. They have really, really fancy screens but what  do the screens do? Well, there's again redundancy for everything. We've got two humans in the  cockpit, captain and a first officer and we duplicate, in fact, triplicate the really,  really important stuff. So on the left hand side, the left most screen is the primary  flight display so that's showing you which way is sky and which way is earth, how fast  you're going, how high you're going, which way you're pointing. The really, really critical  things for flying an aircraft. The one next to it is showing a navigational display where  the autopilot is planning to take the aircraft next and this is duplicated on the first officer's  side. In fact, there's another primary flight display which is completely segregated from  all these systems. So if all else fails, they can still fly the aircraft by hand.  So up on the top is the autopilot and navigational mode display so the autopilot has many, many,  many modes. So you can get it to climb at a certain rate, hold a heading, hold an altitude,  hold a speed, configure for landing, all that kind of stuff and all that is done from the  glass shield above. So both pilots can see what mode the aircraft is setting. In the  middle here, depending on which airframe manufacturer is the crew alerting system or alert management  system and this is designed to kind of tell you when there are problems, show you what  state the avionics are in or the engines are doing, stuff that isn't, need to be right  there in front of you but needs to be readily accessible and shows you when there is a problem.  We don't want to give you unnecessary information but we want to be sure that you can see it  and be alerted to it when there is actually a problem. At the bottom here is all the radio  settings so for voice and data and for HF and for navigation and for interfacing with  ACARS and we have our two MCDUs or interfaces into the flight management system. Again,  we've got a really awesome vintage one on our stands so if you want to come and have  a look at one, inside, beautiful wire wrapping and the levels of redundancy again that go  into the design of these, please come and have a look but these are designed to be kind  of a multiple interface, interface to multiple systems on the aircraft. So this is what drives  your route, how you update the navigation system, all that kind of thing. So on more  modern aircraft, we're starting to integrate what are called electronic flight bags. Back  in the day, you would see the pilot come on with a big suitcase, powerful flight manuals,  paper charts and plates and they would get repetitive strain injury from carrying these  things through airports. So initially, this transition to just having an iPad or similar  that the crew carried on to the aircraft with these things in electronic form and these  were termed sort of class one devices. They had power from the aircraft but nothing else.  They would sit on the side of the glare shield and just be sort of an electronic replacement  for the paper charts and manuals that they already carried. But now we're starting to  move on to more integrated systems, class two and class three devices that actually integrate  with aircraft systems. They can connect via cable or through Wi-Fi and actually start  transferring a route directly onto the flight management system itself. So you can start  to see that there is an enterprise IT management segment. It's not just avionics anymore, we're  having to manage not only pilot iPads, backend systems for electronic flight bags but also  for maintenance crews. When they come onto the aircraft, they want to do updates, they  want to retrieve data, they have to plug in their laptop somehow. And again, there's an  enterprise IT management issue in how those laptops are maintained, made malware free.  So it's not just black boxes and aircraft anymore, these are now connected systems.  But how are these things all kind of connected together? Well, back in the 1970s, we came  up with Aring-429. And because it's the 1970s, cryptography wasn't a thing back then, or  at least to Joe Public. So there is no encryption and there is no authentication on Aring-429,  but that's okay because it's a point-to-point protocol, it's used to connect line replaceable  units in the aircraft together. There is no bus, you can see, you can't connect to Aring-429  from the passenger domain. So again, the physical access controls kick in. So it's a single  source to single sync protocol, it uses a differential voltage type setup. So it's looking  for sort of plus 10 and minus 10 volts in order to eliminate interference issues. You  can readily obtain Aring-429 decoders, either sort of USB ones, people have written Raspberry  Pines faces, if you've got a PicoScope, there's a 429 decoder. Now you can see 429 in aircraft  cockpits, but on a very limited way. These are used for interfacing with the flight  management system and other bits and pieces, although data load is a separate protocol  itself. But if you did have access to 429, then yeah, you can intercept, you can replay  messages, there's none of no replay connection, there's no encryption. But it is a point-to-point  protocol and the chances of you being able to find that on an aircraft are low. So it  does have a really strange message structure, I probably don't want to go into it. But there  was an attempt to fix this issue of all this proliferation of cabling. So when Boeing  designed the 777, they came up with a protocol called 629. So this is a bus and there are  inductive couplers and again you can take a look at one in the village. And inductive  couplers connect to a pair of wires, there is an A bus and a B bus and this is a multi-source  multi-sync true bus protocol. But again, these wires run through bits of the aircraft that  you're never going to get to see. They don't run through the passenger domain. So the physical  access control is sufficient mitigation to deal with the fact that you can just clip  on to one of these cables. Now decoding 629 is really tough. In fact, there's kind of  pretty much only one manufacturer that we found. So shout out to them, who lent us kit  in the past. So if you want to decode it with max technologies and you want to buy one,  that's $30,000 if you want to buy this piece of kit and look at one. So 629 is only found  on the 777. But as we now go to modern aircraft, so A350, A380, 787, 737 max family for example,  we've gone to Ethernet. So this is starting to sound quite familiar to the people here  at Defconn. So it's got a posh name, AFDX or ARIN 664, but under the hood it is kind of  Ethernet. And in fact, if you go to avionics test beds, they use commodity Ethernet switches  to save money. Now we don't use commodity Ethernet switches on aircraft. They're going  to be optical, they are highly resilient, we use them in multiple redundant pairs, they're  segmented and they use what are called virtual links rather than IP addressing. But it is  still common to find ICMP, UDP, SNMP floating around on these networks. So it's all stuff  that's really familiar to us. So again, you're starting to see maybe the bar of access starting  to decrease rather than these kind of esoteric protocols. CAN also appears on aircraft. On  the A380, the overhead panel with all the buttons and environmental sensors and temperature  and environmental controls is all run on CAN. So again, a differential voltage protocol  to minimize interference. And shout out to people in the village who have talked about  CAN, but in general aviation in the last couple of weeks. In this case it was a fuel sender.  But again, CAN, yes, is an unencrypted, unauthenticated protocol, but you have to have the skull access  to manipulate this. And we put aircraft, air side, we put things behind locked cockpit  doors. So there are mitigations. Again, if it was a general aircraft, it's going to be  in a hangar, you're going to lock the door hopefully. If someone has physical access  to your plane, they're probably going to rob it more than mess with the fuel senders on  it. Now, power on aircraft is really weird. So it's 115 volt AC, 400 hertz, or 28 volt  DC in some places. So if you're working on an aircraft, you're going to have to take  your own power. There's no way for you to plug your laptop in. If you want to hoover  vacuum and aircraft, then you're going to have to buy a very special $400 vacuum cleaner  to do that. This is what, you know, when they clean the aircraft, this is what they're  bringing on to do it. So you're going to have to consider this when you're working in an  aircraft environment. And it is tricky. So we brought some avionics and I used with us.  They're all of a certain vintage, but they are still flying today, even though they're  20 years old. But that hardware reverse engineering strategy is pretty similar to everything else.  Is that you take boards apart, you look for data sheets, you look for them part numbers,  start tracing tracks. Everything that's like really familiar to us. What's kind of really  irritating is it's dipped in a conformal coating. So if you want to start tracing and buzzing  out, it's really irritating to do. But, you know, they're designed to be living in a hostile  environment, so you would expect that. There are PLCCs on there, so you can try and drop  the firmware out of it. A lot of them have readout protection on them, but some of them  maybe don't. But all of the tools that you're familiar with, Sega's, Sala's, you are, all  that kind of stuff is completely applicable. So if you've done any hardware RE, then you  can start looking at these from a black box perspective. As Ken has said, you know, if  you're starting to find stuff, then you need to be reporting that through the appropriate  channels. But these things are designed for redundancy. You see PLCCs a lot. They are  designed just in ICS and SCADA. They are designed to be used in a highly resilient and fail  safe and safety critical way. But things are kind of starting to change. So we're now starting  to see common compute systems, common compute resources. So rather than having discrete  line replaceable units and black boxes in avionics base, there are line cards and commodity  processes that run software. So VXWorks is quite common to see. And there are firmware  updates for this. So you can go to a vendor website and you can download and modify the  behavior of the aircraft in limited ways. So on those nice flat screens in the aircraft,  you might want to have different checklist items for start up and take off, for example.  And airlines can customize that to a certain degree using airline provided tools that are  then uploaded. And these are actually cryptographically signed. So again, you can see there is significant  mitigation. It's not like someone hacking a text file. These are quite controlled devices.  But because it's, you know, VXWorks, there's hypervisors, there's Linux kernels. Again,  you can see that the bar of access is starting to drop down. So as my voice is starting to  give out, we've kind of come to the end. And what I want to say is that, yes, stuff back  in the day was predicated on the physical access model. But we've always had humans  in the loop. You know, if the aircraft starts behaving a bit weirdly, the autopilot can  be disengaged, the human could start flying it. And that, and I think is fine. And I think  people need to keep that perspective. But yes, in the drive for efficiency, airlines  and manufacturers are starting to put on Wi-Fi, 4G, SATCOM. And these carry a security risk.  And they have done due diligence. But there is room to meet in the middle. And that's  why we're running the aviation village here. It's to bring together the minds of people  who've worked on automotive and hardware security and to bring that unpredictability of that  threat together with aviation so that everything is safer. We all want to carry on flying.  And 20 years ago, maybe the threat model was, who would want to hurt aircraft? And now I  think that has definitely changed. And that is a good place to be. But there are many,  many mitigations as we've talked about. There's built-in redundancy, there's lots of systems.  You can't just go hack a plane. So forgive for the slightly click-baity title. But hopefully  that's a quick run-through of all of the acronyms and things you might find on aircraft. And  hopefully when you're flying, you're going to feel a bit safer. So thank you. If there's  any questions, we've got a few minutes to take them. But otherwise, we're going to be  at the aviation village. Do come and find us. Thank you.  Thank you.
Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_0_71.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_72_2123.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_2124_3887.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_3888_6251.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_6252_6599.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_6600_6731.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_6732_6791.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_6792_7067.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_7068_8771.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_8772_8891.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_8892_9203.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_9204_9683.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_9684_11375.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_11376_12251.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_12252_13163.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_13164_13223.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_13224_13535.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_13536_16247.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_16248_18119.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_18120_18299.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_18300_18755.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_18756_20771.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_20772_22151.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_22152_22811.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_22812_25115.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_25116_30647.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_30648_31715.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_31716_38291.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_38292_39395.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_39396_43679.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_43680_44567.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_44568_47543.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_47544_47771.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_47772_48671.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_48672_51215.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_51216_52223.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_52224_52571.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_52572_53867.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_53868_54035.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_54036_54419.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_54420_54659.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_54660_54899.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_54900_55439.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_55440_56267.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_56268_56639.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_56640_57107.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_57108_57299.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_57300_57527.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_57528_57599.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_57600_58043.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_58044_58967.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_58968_59915.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_59916_60995.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_60996_62111.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_62112_64139.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_64140_64739.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_64740_65831.png Ken_and_Alex_-_A_Hackers_First_Solo_Airplane_Avion_n9MnloQhw9Q_65832_66824.png