Commercial aircraft navigation systems compromised by spoofing attacks

midian182

Posts: 9,353   +119
Staff member
In brief: Hacking commercial aircraft to cause complete navigation failures sounds like something you'd only see in movies, but an unknown group has been carrying out spoofing attacks on flights over the Middle East for weeks now. In one incident, a business jet almost strayed into Iranian airspace without clearance.

In September, OPSGROUP, an 8,000-strong international group of pilots, dispatchers, schedulers, controllers, and flight technicians, began highlighting incidents in which commercial aircraft in the Middle Eastern region received spoofed GPS navigation signals. These attacks also impacted the fallback navigation systems, resulting in total failure, writes Motherboard.

There have been more than 50 incidents in the last five weeks, centered around Baghdad, Cairo, and Tel Aviv. The attacks use a specific vector that OPSGROUP describes as "unthinkable" and exposes a "fundamental flaw in avionics design." The spoofing affects the aircraft's Inertial Reference System (IRS), used to help planes navigate.

"The IRS should be a standalone system, unable to be spoofed," wrote OPSGROUP. "The idea that we could lose all on-board nav capability, and have to ask [air traffic control] for our position and request a heading, makes little sense at first glance – especially for state of the art aircraft with the latest avionics. However, multiple reports confirm that this has happened."

One report says that an Embraer 650 business jet crew en route from Europe to Dubai lost both GPS navigation units aboard the airplane and GPS signals to both pilot/co-pilot iPads. The crew said the IRS didn't work anymore, and they only realized something was wrong when the autopilot started turning left and right. After the aircraft flight management system showed a GPS error message, the crew requested radar vectors from air traffic control showing they were 80 nautical miles off course and had nearly entered Iranian airspace with no clearance.

UT Austin professor Todd Humphreys, who researches satellite communications, told Motherboard his team of students are constantly studying the signals in the region.

"Apart from run-of-the-mill jamming (e.g., with chirp jammers), we have captured GPS spoofing signals in our radio trawling," he said. "But, interestingly, the spoofing signals never seemed to be complete. They were either missing key internal data or were not mutually consistent, and so would not have fooled a GPS receiver. They seemed to be aimed at denial of service rather than actual deception. My students and I came to realize that spoofing is the new jamming. In other words, it is being used for denial of service because it's more effective for that purpose than blunt jamming."

Humphreys said the new attacks were highly significant as unlike GPS jamming, spoofing, which he says acts like a zero-day exploit against aviation systems, also corrupts the IRS and backups, posing more of a threat to an aircraft's safety.

GPS spoofing has also been used by Israel to try and protect itself from Hezbollah missile strikes, potentially endangering commercial aircraft. Israel has warned pilots landing in the country that they shouldn't rely on GPS to land, instead relying on other methods.

Permalink to story.

 
flight-tickets.png


 
This is very interesting. Normally you can turn off the GPS as one of the inputs and a lot of airlines will do that when they navigate around areas with frequent jamming/spoofing. I wonder if that technique works to prevent this. The article says there is no defense, so maybe the IRS will still look at the GPS signals but don't act on them, and spoofing somehow still gets through and corrupts the IRS. Either way, software updates would probably be able to fix it, though it takes a while to certify and deploy them.
 
Last edited:
As a retired airline pilot this is kind of surprising as modern commercial airlines (cannot speak for bizjets from Gulfstream, etc.) rely on an integrated navigation system that gets its navigation signals from on-board INS (Inertial Navigation Systems), ground based VOR or TACAN, and GPS. If 2 of 3 disagree then the two that agree (I.e. INS and TACAN with GPS disagree) then the Flight Navigation will continue to operate while the Pilots get a warning light in the cockpit about the GPS fault. Ground based TACAN/VOR are older systems so they could also be jammed at the same time (although I'm not aware of them being spoofed, just jammed so as not to receive any signal at all) then the system would default to on board INS which is quite accurate over the short term (it is constantly updated by the other systems) but is susceptible to drift over long (longer than an hour) since it is based on on-board gyroscopes. May have changed since I retired (and while I didn't fly the international aircraft like the Boeing 767 and 777 I flew the 737 and the navigation systems for International range aircraft was the same for domestic airliners. And while I didn't fly to Europe the domestic designation did include Canada, Mexico, and Central America and long over seas routes (out of range of land based navigation) like Puerto Rico.
 
Back