RF Attacks on Aviation's Defense Against Mid-Air Collisions
Demonstrates practical RF attacks against TCAS II collision avoidance systems to forge resolution advisories and disable collision detection.
Summary
Aviation Collision Avoidance Architecture
The Traffic Alert and Collision Avoidance System (TCAS II) serves as an onboard safety net preventing mid-air collisions. Historically, TCAS attacks remained theoretical due to timing constraints and implicit receiver properties.
Practical RF Exploitation with COTS Hardware
Researchers built practical radio frequency attack tooling using commercial off-the-shelf software-defined radios. The tooling successfully injects crafted transponder signals to manipulate cockpit collision avoidance displays.
Forging Traffic and Resolution Advisories
Crafted RF transmissions generate phantom aircraft and force TCAS to trigger false Traffic Advisories (TA) and Resolution Advisories (RA), commanding pilots to execute unnecessary evasive maneuvers.
Disabling TCAS Collision Capabilities
A secondary attack mechanism remotely suppresses an aircraft's TCAS processing, blinding collision detection systems and highlighting urgent vulnerabilities in legacy avionics protocols.
Related talks
Creator Stage·22 min
Ken Munro
Analyzes how GPS coarse time spoofing invalidates digital certificates on aircraft, grounding fleets and disrupting avionics communications.
Aerospace Village·23 min
Harshad Sathaye
Explains the principles of GPS signal manipulation and reviews hands-on spoofing attack scenarios and receiver mitigation techniques.
Creator Stage·24 min
Martin Strohmeier
Presents an in-depth security analysis of the satellite ADS-C aviation protocol, demonstrating message injection and position tampering using SDRs.