TCAS and ILS Spoofing Demonstration
Demonstrates how spoofed TCAS and ILS signals can induce automated autopilot climb or descent responses on commercial aircraft.
Summary
Traffic Alert and Collision Avoidance Architecture
The Traffic Alert and Collision Avoidance System (TCAS) interrogates Mode S and Mode C transponders of nearby aircraft to compute relative distance, bearing, and altitude for collision detection.
Automated Autopilot Resolution Advisories
When a collision trajectory is calculated, TCAS issues a Resolution Advisory (RA). Certain modern autopilots automatically couple to the RA, commanding climbs or descents without manual pilot stick inputs.
Spoofing RF Transponder Signals
Transponder communications lack cryptographic authentication, enabling software-defined radios to synthesize arbitrary phantom aircraft tracks and broadcast deceptive interrogations and replies.
Impact on Flight Management and Aircraft Control
Testing simulated and avionics hardware responses reveals how false TCAS targets can compel autopilot flight directors into uncommanded flight level deviations during critical flight regimes.
Related talks
Aerospace Village·23 min
Harshad Sathaye
Examines the fundamental protocol weaknesses that enable RF spoofing attacks against Instrument Landing Systems and ADS-B broadcasts.
Aerospace Village·24 min
Rick Hansen
Explores the application of software-defined radios for analyzing and testing RF communications across aerospace cyber environments.
Aerospace Village·23 min
Harshad Sathaye
Explains the principles of GPS signal manipulation and reviews hands-on spoofing attack scenarios and receiver mitigation techniques.