Wireless Attacks on Aircraft ILS -

Harshad Sathaye explores the wireless attack surface of aircraft Instrument Landing Systems (ILS), demonstrating how commercial off-the-shelf Software Defined Radios (SDR) can be weaponized to spoof critical radio navigation signals during the final landing approach.

The presentation details the radio frequency characteristics of ILS localizer (runway horizontal alignment) and glideslope (vertical descent slope) beacons, which modulate 90 Hz and 150 Hz audio tones onto VHF and UHF carrier frequencies. Sathaye demonstrates how an attacker can manipulate the difference in depth of modulation (DDM) to exercise precise, real-time control over an aircraft's Course Deviation Indicator (CDI). He introduces the "single-tone attack," an optimized transmission technique that significantly reduces the RF power required to override legitimate airport navigation transmitters.

Sathaye showcases an automated, closed-loop ILS spoofer that dynamically tracks an approaching aircraft's GPS coordinates to adjust spoofed RF signals, stealthily altering the glidepath without triggering cockpit warning flags or receiver alarm flags. The attack was successfully validated against an FAA-certified flight simulator (X-Plane) utilizing AI-based autoland, producing off-runway touchdown offsets ranging from 18 to over 50 meters. The talk concludes with an analysis of potential mitigations, explaining why legacy analog RF navigation cannot easily be retrofitted with conventional cryptographic authentication and discussing the architectural challenges of securing next-generation aviation systems.

(AI summary — Gemini Flash)