How I Developed a Low Cost Raspberry Pi Based Device for ADS B Spoof

How I Developed a Low Cost Raspberry Pi Based Device for ADS B Spoof

Speakers: Angelina Tsuboi

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=KytDyg5s-E8

Overview

Angelina Tsuboi's talk at DEF CON 32, titled "How I Developed a Low Cost Raspberry Pi Based Device for ADS B Spoof," introduces Fly Catcher, a personal project aimed at enhancing aviation security through the detection of aircraft spoofing. Fly Catcher is a low-cost, reliable device built on a Raspberry Pi platform, designed for effective ADS-B (Automatic Dependent Surveillance-Broadcast) monitoring. Its core innovation lies in a custom-developed convolutional neural network (CNN) that processes ADS-B inputs to differentiate between legitimate and potentially spoofed aircraft signals.

The significance of this project stems from the inherent vulnerabilities within the ADS-B system, which is a mandated technology for air traffic surveillance but lacks fundamental security features like authentication and encryption. These weaknesses make ADS-B susceptible to various attack vectors, including jamming, replay attacks, message injection, and critically, spoofing. Tsuboi's work addresses this critical gap by providing a practical, accessible solution for identifying fabricated aircraft data, thereby contributing to the safety and integrity of air traffic information.

Tsuboi, with a decade of software development experience and a focused interest in aerospace security, particularly aviation, leverages her piloting background to bring a unique perspective to this challenge. Fly Catcher represents a tangible step towards empowering individuals and smaller organizations to monitor and defend against sophisticated threats in the aviation domain, showcasing the power of accessible hardware and machine learning in addressing complex security problems.

Background

▶ Watch: Introducing Fly Catcher: Raspberry Pi ADS-B spoof detection (0:00)

Automatic Dependent Surveillance-Broadcast (ADS-B) is a cornerstone technology for modern air traffic control and surveillance, mandated for aircraft in many parts of the world. As its name suggests, it is "automatic" because it requires no manual input from the pilot, and "dependent" because it relies on Global Navigational Satellite System (GNSS) signals (like GPS) to determine an aircraft's precise position, velocity, and other telemetry. This information is then "broadcast" out to other aircraft, ground-based receivers, and air traffic control (ATC) via radio packets on the 1090 MHz frequency.

The operational flow of ADS-B involves three primary components within an aircraft: a GPS receiver to obtain positioning data from satellites, a transponder (typically using the Mode S protocol) to transmit comprehensive data packets, and an ADS-B In system, which allows pilots to continuously monitor other air traffic in their vicinity. Mode S is particularly crucial as it provides the most comprehensive data about the aircraft, including its unique ICAO designation, altitude, airspeed, and other flight parameters.

Despite its widespread reliance and critical role in air safety, ADS-B possesses fundamental security vulnerabilities that expose it to significant risks. The two most critical flaws are its unauthenticated and unencrypted nature. "Unauthenticated" means there is no verification mechanism for the transmitted data; any ground-based transmitter can inject ADS-B packets, and they will be automatically received and processed as legitimate. This lack of authentication makes it trivial for an attacker to impersonate an aircraft or create phantom ones. Simultaneously, the "unencrypted" nature means that anyone with a suitable receiver tuned to the 1090 MHz frequency can intercept and interpret ADS-B transmissions, making the data transparent and susceptible to analysis and manipulation.

These vulnerabilities give rise to several potent attack vectors:

• Jamming: A ground-based transmitter can flood the 1090 MHz frequency with garbled data, effectively disrupting ADS-B communications and blinding receivers to legitimate aircraft.
• Spoofing: This is a more sophisticated and selective form of attack where custom-fabricated data packets are transmitted. Spoofing can create "ghost planes" that appear on ADS-B feeds and ATC screens, despite no physical aircraft being present. Conversely, it can also mask the presence of real aircraft or misrepresent their positions.
• Replay Attacks: Attackers capture legitimate ADS-B packets from an earlier time and then re-broadcast them. This can create "duplicate" airplanes on the system, potentially causing confusion and misdirection for pilots and air traffic controllers.
• Message Injection: This involves manipulating individual ADS-B packet fields to alter specific telemetry data, such as altitude, airspeed, or positioning, leading to false information being displayed to other aircraft and ATC.

Angelina Tsuboi's project, Fly Catcher, specifically focuses on spoofing due to its customized nature and the potential for artificial intelligence to detect such fabrications. The ability to create ghost planes or manipulate critical flight data poses a direct threat to aviation safety and security, making the development of robust detection mechanisms paramount.

Key Findings

▶ Watch: Unauthenticated, unencrypted: ADS-B vulnerabilities and attack vectors (3:15)

The central finding and contribution of this research is the successful development and validation of Fly Catcher, a low-cost, Raspberry Pi-based device capable of monitoring ADS-B signals and detecting instances of aircraft spoofing using a custom machine learning model. This project demonstrates a practical and accessible approach to addressing a significant vulnerability in modern aviation.

Key findings include:

• Feasibility of Low-Cost ADS-B Spoofing Detection: The project successfully proves that effective ADS-B monitoring and spoofing detection can be achieved with readily available, inexpensive hardware components, primarily a Raspberry Pi and a software-defined radio (SDR). This significantly lowers the barrier to entry for aviation security research and independent monitoring.
• Development of a Portable ADS-B Ground Station: Tsuboi constructed a fully functional and portable ADS-B reception ground station. This system effectively receives and decodes 1090 MHz Mode S ADS-B signals, demonstrating the capability to collect real-time aviation data.
• Successful Implementation of a Custom CNN for Spoofing Detection: A core innovation is the creation of a convolutional neural network (CNN) specifically trained to parse ADS-B inputs and classify them as reliable or unreliable (spoofed). This highlights the potential of AI and machine learning in identifying subtle anomalies indicative of malicious interference in aviation communications.
• Validation through Real-World Data Collection: The device was not only built but also deployed in a real-world scenario. By stowing Fly Catcher on a Sport Cruiser aircraft and flying it across diverse airspaces in the South Bay Los Angeles area, Tsuboi successfully collected a broad dataset reflecting both general and commercial aviation traffic. This practical data collection was crucial for training and validating the machine learning model under realistic operating conditions.
• Integration of Open-Source Tools: The project effectively integrates popular open-source tools like dump1090 for ADS-B decoding and leverages existing data sources like ADS-B Exchange, FlightAware, and OpenSky, demonstrating an efficient and collaborative approach to research.

In essence, Fly Catcher provides a tangible, working prototype that not only identifies the threat of ADS-B spoofing but also offers a viable, cost-effective method for its detection, paving the way for enhanced aviation security measures.

Technical Deep Dive

▶ Watch: Fly Catcher's four-step build process: from reception to AI (5:00)

The development of Fly Catcher involved a meticulous four-step build process, beginning with the establishment of a robust ADS-B reception ground station, followed by the construction of a portable device, the training of a deep neural network, and finally, real-world flight testing for data acquisition.

1. ADS-B Reception Ground Station Setup:

The foundation of Fly Catcher lies in its ability to reliably receive and decode ADS-B signals. The ground station, which also formed the basis for the portable device, was composed of four key components:

• Software-Defined Radio (SDR): A FlightAware Pro Stick Plus SDR was chosen as the primary radio receiver. This device is specifically optimized for 1090 MHz ADS-B signals and relies on the widely compatible RTL 2832U chipset. The choice of this SDR ensures high configurability and compatibility with various ADS-B decoding software.
• Antenna: A simple yet effective 1090 MHz rubber ducky antenna was used. This choice prioritizes low cost and reliability for a portable setup, while still being specifically tuned to the ADS-B frequency.
• Processing Unit: A Raspberry Pi served as the central processing unit for analyzing the received ADS-B packets. Its compact size, low power consumption, and versatility made it an ideal choice for both the ground station and the portable Fly Catcher device.
• Visualization: The FlightAware GUI display was utilized to provide a visual output of the incoming ADS-B data, allowing for real-time monitoring and verification of signal reception.

2. ADS-B Signal Decoding and Processing:

Once ADS-B signals are received on the 1090 MHz frequency, they need to be decoded. The project specifically focused on signals transmitted via Mode S, which is the most comprehensive of the ADS-B modes (A, C, and S). Mode S packets contain advanced and detailed data about the aircraft.

The structure of an ADS-B Mode S message is critical for understanding the data being processed:

• It begins with a few bits outlining the downlink format.
• This is followed by information on the transponder capability.
• A crucial field is the ICAO designation, a unique 24-bit identifier assigned to every aircraft.
• The actual message data occupies bits 33 to 88.
• Finally, a parity ID is appended to the end for error detection.

To decode these signals, the open-source software dump1090 was embedded directly onto the Raspberry Pi. The workflow is as follows:

• The 1090 MHz ADS-B antenna captures signals.
• These signals are fed into the FlightAware Pro Stick Plus SDR.
• The SDR's output is then processed by the dump1090 decoder software running on the Raspberry Pi.
• Dump1090 parses the raw radio signals and outputs the decoded ADS-B data in a JSON format.
• This JSON output can then be further processed and visualized. For Fly Catcher, this data was fed into the FlightAware visualization dashboard to display live ADS-B broadcasts, providing an immediate graphical representation of surrounding air traffic.

3. Training a Deep Neural Network for Spoofing Detection:

The core intelligence of Fly Catcher lies in its ability to detect spoofed signals using machine learning. Angelina Tsuboi developed a convolutional neural network (CNN) for this purpose. The choice of a CNN is particularly suitable for analyzing sequential or structured data like ADS-B packets, which can be thought of as time-series or structured messages, allowing the network to identify patterns indicative of legitimate versus fabricated signals.

The training of this model required a substantial and diverse dataset:

• Historical ADS-B Records: Tsuboi leveraged historical data from established ADS-B data sources, including ADS-B Exchange (which provided datasets going back to the 2000s), FlightAware, and OpenSky. These sources offered a rich repository of legitimate ADS-B traffic patterns.
• Self-Collected Data: Crucially, data was also collected from the self-built ground station and the portable Fly Catcher device during its flight tests. This ensured that the training data reflected the specific reception characteristics and environmental factors relevant to the project's hardware.
• Data Preparation: All collected ADS-B signals, after being processed by the dump1090 decoder into JSON format, were converted and saved into CSV records. This standardized format is widely compatible with machine learning frameworks, allowing for efficient input into the CNN.

The rationale behind using AI for spoofing detection is rooted in the "customized nature" of spoofing. Unlike simple jamming, spoofing involves crafting specific, believable-looking data. A CNN can learn to identify subtle inconsistencies, unusual patterns, or deviations from expected flight characteristics (e.g., impossible speeds, altitudes, or trajectories for a given aircraft type and location) that might indicate a spoofed signal, even if the individual data points appear superficially valid.

4. Flight Testing and Data Acquisition:

The final step in the build process involved real-world deployment to gather data for training and refining the machine learning model.

• Device Portability: The Fly Catcher device was constructed to be portable, allowing it to be stowed on the back of an aircraft.
• Aircraft and Location: The device was flown on a Sport Cruiser aircraft around various airspaces in the South Bay Los Angeles area, including Santa Monica, Torrance, Malibu, Palisades, Burbank, and downtown Los Angeles.
• Diverse Airspace Coverage: Tsuboi deliberately chose popular commercial airspaces like LAX and Burbank, as well as local general aviation airports such as Santa Monica Airport and Van Nuys. This strategy ensured the collection of a broad spectrum of data, encompassing multi-engine aircraft, helicopters, and single-engine airplanes, thereby reflecting both general and commercial aviation traffic. This diversity is crucial for training a robust model that can generalize across different aircraft types and flight environments.

The data gathered during these flights, combined with historical datasets, formed the comprehensive training set for the convolutional neural network, enabling it to learn the intricate patterns of legitimate ADS-B transmissions and, by extension, to identify anomalies indicative of spoofing.

Demo / Proof of Concept

▶ Watch: Decoding ADS-B Mode S signals and packet structure (7:00)

While the talk did not feature a live, interactive demonstration of the Fly Catcher device actively detecting a spoofed signal in real-time, the project's core proof of concept was thoroughly demonstrated through its real-world deployment and data collection process. Angelina Tsuboi explicitly detailed how the device, once constructed to be portable, was stowed on the back of a Sport Cruiser aircraft.

This aircraft was then flown extensively across the South Bay Los Angeles area, covering a variety of airspaces including major commercial hubs like LAX and Burbank, as well as general aviation airports such as Santa Monica and Van Nuys. The primary objective of this flight testing was to gather a rich and diverse dataset of ADS-B transmissions. This data, encompassing both general and commercial aviation traffic, was crucial for training and validating the custom convolutional neural network designed to detect spoofing. The successful collection of this real-world data under operational conditions serves as a robust proof of concept for Fly Catcher's capability as a functional ADS-B monitoring and data acquisition platform, essential for developing its spoofing detection capabilities.

Defensive Implications

▶ Watch: Integrating Dump 1090 for data parsing and visualization (8:00)

The work presented in Fly Catcher highlights critical defensive implications for aviation security, particularly given the unauthenticated and unencrypted nature of ADS-B. The existence of a low-cost, accessible spoofing detection system underscores the urgent need for enhanced vigilance and proactive measures within the aviation ecosystem.

For Air Traffic Control (ATC) and pilots, the primary implication is the reinforced awareness of potential ADS-B spoofing. While ATC systems may have other radar sources, the integration of ADS-B data is increasingly vital, and spoofed signals could lead to significant confusion, misdirection, or even catastrophic incidents. Defenders should consider:

• Integration of Anomaly Detection: Systems like Fly Catcher demonstrate the viability of integrating machine learning-based anomaly detection into existing or supplementary ADS-B monitoring infrastructure. ATC and airport operators should explore deploying similar, perhaps more robust, solutions to continuously analyze ADS-B feeds for suspicious patterns.
• Cross-Verification: Reliance on a single source of truth for aircraft positioning is risky. ATC should emphasize cross-verification of ADS-B data with other surveillance technologies (e.g., primary radar, secondary radar with authentication like Mode S transponder interrogation) where available.
• Pilot Training and Awareness: Pilots need to be aware of the limitations and vulnerabilities of ADS-B. Training should include protocols for reporting suspicious or conflicting traffic information and understanding how to revert to alternative navigation and communication methods if ADS-B data appears compromised.
• Cybersecurity Posture for Aviation: The project reinforces the broader need for a robust cybersecurity posture across all aviation systems. This includes regular security audits, vulnerability assessments, and the development of incident response plans specifically tailored for aviation communication and navigation systems.

From a technological standpoint, the long-term defensive strategy involves pushing for more secure ADS-B standards or supplementary systems:

• Authentication and Encryption: Future iterations or next-generation surveillance technologies should incorporate strong authentication mechanisms to verify the source of ADS-B transmissions and encryption to protect the integrity and confidentiality of the data.
• Distributed Monitoring Networks: The low-cost nature of Fly Catcher suggests the possibility of building distributed networks of ADS-B monitors. A network of independent receivers, each running anomaly detection, could provide a more resilient and difficult-to-spoof aggregated view of air traffic, as a single spoofed signal would likely conflict with multiple legitimate observations.
• Open-Source Security Tools: The project demonstrates the power of open-source tools (like dump1090) and hardware (Raspberry Pi, SDRs) in developing security solutions. Fostering an open-source community around aviation security tools can accelerate the development of defensive capabilities.

Ultimately, Fly Catcher serves as a call to action, illustrating that while the threat of ADS-B spoofing is real and accessible to attackers, so too are the means to detect and mitigate it, particularly through innovative applications of machine learning and accessible hardware.

Key Takeaways

• ADS-B is Fundamentally Vulnerable: The Automatic Dependent Surveillance-Broadcast (ADS-B) system, crucial for air traffic control, is inherently unauthenticated and unencrypted, making it susceptible to various cyberattacks, most notably spoofing.
• Spoofing Poses a Significant Threat: Aircraft spoofing, where fabricated data packets create "ghost planes" or manipulate real aircraft telemetry, can lead to dangerous misdirection and compromise aviation safety.
• Fly Catcher Offers a Low-Cost Detection Solution: The project successfully developed Fly Catcher, a portable, Raspberry Pi-based device that utilizes a software-defined radio (SDR) and a custom convolutional neural network (CNN) to monitor ADS-B signals and detect spoofing.
• AI/ML is Effective for Anomaly Detection: Machine learning, specifically CNNs, proves to be a powerful tool for analyzing complex ADS-B data streams and identifying subtle anomalies indicative of spoofed transmissions, leveraging the "customized nature" of such attacks.
• Real-World Data is Crucial for Model Training: The project emphasized the importance of collecting diverse, real-world ADS-B data through flight tests in various airspaces to effectively train and validate the machine learning model.
• Defenders Need Proactive Monitoring: The existence of such a device highlights the critical need for air traffic control and aviation stakeholders to implement advanced monitoring systems and cross-verification methods to mitigate the risks posed by ADS-B vulnerabilities.

About the Speaker(s)

Angelina Tsuboi is an emerging talent in the cybersecurity field with a substantial background as a software developer, having accumulated a decade of experience in the domain. Her professional focus in recent years has shifted towards aerospace security, with a particular emphasis on aviation. This specialization is significantly informed and enriched by her personal experience as a pilot, providing her with a unique, practical understanding of aviation systems and their operational context. Tsuboi's work, such as the Fly Catcher project, demonstrates her commitment to leveraging her technical skills and aviation insight to address critical security challenges in the aerospace sector. She can be reached via email at [email protected], her website angelinatsuboi.com, or through her GitHub repository: https://github.com/ANG13T/fly-catcher.