Sliding into the Flight Deck’s DMs - Practical Message Attacks on CPDLC

The talk looks at CPDLC, the data link that lets air traffic controllers send text clearances such as climb, descend or turn to commercial aircraft. The speakers note that the protocol has no cryptography or authentication, and that aviation standards and industry have long treated concerns about such radio systems as overblown. To test this, they built a bench with certified avionics and a VHF antenna, then connected it to a live test ground station, so the experiments ran against a real network rather than a simulation.

The middle section walks through the protocol stack, from the data link layer up through link setup, routing and transport to the application. The speakers describe a stateless disconnect frame that, sent to a broadcast address, drops every nearby aircraft from its ground station, which they say needs only a few bytes over the air. Using a fake ground station, they could take over a session, advertise routes so an aircraft would accept them, and send arbitrary controller messages. Undocumented parameters and checksums, some turning out to be MD4, made the reverse engineering slow.

The closing part covers disclosure to manufacturers, regulators, airlines and pilot groups, with mixed responses and slow engagement from the FAA. The practical takeaways are that complexity does not provide security, that monitoring for unexpected messages and physical protection of ground stations are feasible now, and that cryptography will take years because the move to IP-based links keeps slipping. The speakers said they would not release code, but the paper would give the details.