Hacking Electronic Conspicuity Devices - or - Making Light Aircraft Fly Into Conflict

The talk starts with the problem of traffic separation for general aviation. Commercial TCAS is too expensive for light aircraft, so pilots increasingly fit small electronic conspicuity devices that receive ADS-B, relay traffic between aircraft and share a map over a Wi-Fi network. The presenters, who are penetration testers and one of them a pilot, argue these units are useful but were built with security as an afterthought.

The middle of the talk covers what they found on one popular unit. The manufacturer's install advice left the Wi-Fi passphrase blank, and the network name made the devices easy to locate online. The first hardware version, based on a Raspberry Pi, had an administration web app with several endpoints that allowed unauthenticated remote code execution and root access. Its VPN update script added another path to full control. A later ESP32-based version used a trivial default passphrase, had predictable VPN certificate details tied to the MAC address, and suffered a stack overflow in its web server. The team used that overflow to load their own code into RAM, with a demonstration running on the device. The practical impact they described is altered traffic and position data, or suppressed traffic alerts.

The closing section covers disclosure. The team reported issues in late 2023, received slow and partial responses from the manufacturer, and got little help from the aviation regulator. Their advice to pilots is to change the passphrase, keep firmware current and avoid leaving devices powered on. They urge manufacturers to treat security as core to safety and point to new EU and UK product security rules that restrict default passwords.