Category: Airband

Spoofing Aircraft Instrument Landing Systems with an SDR

Recently Arstechnica ran an in depth story about how a $600 USRP software defined radio could be used to trick an aircraft that is making use of the Instrument Landing System (ILS). ILS is a radio based system that has been used as far back as 1938 and earlier. It's a very simple system consisting of an array of transmitter antennas at the end of a runway and a radio receiver in the aircraft. Depending on the horizontal and vertical position of the aircraft, the ILS system can help the pilot to center the aircraft on the runway, and descend at the correct rate. Although it is an old technology, it is still in use to this day as a key instrument to help pilots land especially when optical visibility is poor such as at night or during bad weather/fog.

Researchers from Northeastern University in Boston have pointed out in their latest research that due to their age, ILS systems are inherently insecure and can easily be spoofed by anyone with a TX capable radio. Such a spoofing attack could be used to cause a plane to land incorrectly. In the past ILS failures involving distorted signals have already caused near catastrophic incidents.

However, to carry out the attack the attacker would require a fairly strong power amplifier and directional antenna lined up with the runway. Also as most airports monitor for interference the attack would probably be discovered. They write that the attack could also be carried out from within the aircraft, but the requirements for a strong signal and thus large power amplifier and directional antenna would still be required, making the operation too suspicious to carry out onboard.

Wireless Attacks on Aircraft Landing Systems

Tracking Dictators Around the World with ADS-B Data

Over on Reddit freelance investigative journalist Emmanuel Freudenhal has put up a very interesting post about how he is using ADS-B tracking to keep an eye on the travel habits of dictators around the world. If you were unaware, ADS-B is a signal transmitted by aircraft which contains aircraft ID info, and data such as speed, altitude and GPS location. Websites like ADS-B Exchange aggregate ADS-B data from volunteer ground stations that are running (mostly) RTL-SDR dongles. Emmanuel notes that by watching the movements of aircraft registered to dictators, it is possible to keep an eye on their travel habits.

One story that Emmanuel has written using this data is a piece on Paul Biya, Cameroon's president. His article discusses how Paul Biya is often seen in Geneva Switzerland, away on private visits. In a comment, Emmanuel notes that since his story ran, Paul Biya has almost stopped travelling to Switzerland.

Emmanuel has also been running a Twitter bot that uses ADS-B data to automatically tweet when a dictator aircraft is detected at Geneva airport. A list of known dictator aircraft is kept on a publicly accessible Excel file.

Now he is hoping to expand his tracking operation, and is asking for more people to feed the ADS-B Exchange aggregation website. ADS-B Exchange is the site recommend to feed because it is the only ADS-B aggregation website that does not censor any aircraft. Other aggregation sites such as Flightradar24 and FlightAware have come under scrutiny in the past for their willingness to upon request censor and block the tracking of military/political aircraft and private jets owned by several companies. In particular several aircraft owned by dictators are reportedly censored. However, the counter argument is that not censoring aircraft may result in ADS-B tracking eventually being made illegal, or that costly legal suites may be brought against ADS-B aggregation companies.

On the Reddit post Emmanuel writes:

I'm a freelance investigative journalist (www.emmanuel-freudenthal.com / @emmanuelfreuden). I'm getting into SDR/ADSB and very glad I found this group because I need your help to track aircrafts!

With a colleague, we started a project to look into the travels of dictators around the world. It's an evolution of a Twitter bot (https://twitter.com/GVA_Watcher) started a few years ago. This bot tweets every time an aircraft owned by a dictatorship lands or takes off at the Geneva airport, Switzerland. And dictators visit Geneva, a lot. There's secretive banks and good healthcare, enjoyed by Algeria's departing president or Cameroon's president Paul Biya.

We want to expand this project to all of the world's airports. See our place-holding website: https://dictatoralert.org(which will get expanded soonish). To do so, we've partnered with ADSB-Exchange, which as you probably know, is the only website that doesn't censor flights. Usually the planes owned/chartered by dictatorships don't show up on flightaware or flightradar24 (anyone can asked to be removed). Some planes also don't share their GPS coordinates (e.g. Mode S) and so they don't show up.

In addition to the Dictator Alerts, we'll also use the data to do investigations into dictatorships, human rights violation and corruption.

The idea is to allow everyone to keep tabs, so the data will be available publicly, via Twitter bots and on a dedicated website (with e.g. a page per dictatorship and per airport).

To succeed, we need a lot more antennas! So, it'd be great if you could feed ADSB-Exchange. You can do that in addition to feeding other services. See how to do it here: https://www.adsbexchange.com/how-to-feed/ If you want to feed, please contact me on [email protected], my twitter DM are open. It's quite important that you contact me before feeding, so that we also capture aircrafts that don't share their GPS coordinates.

That also means, you'll be able to see ALL of the data that you're collecting online.

What do you think? Would you be keen to participate? Any questions?

Your feedback is very welcome, i'm still learning!

Best,

Emmanuel

Dictator Alert. A Twitter bot reporting on dictator movements via ADS-B data. dictatoralert.org
Dictator Alert. A Twitter bot reporting on dictator movements via ADS-B data. dictatoralert.org

Other stories of interest: A similar story we ran last year was about tracking police and military aircraft at the G7 summit with an RTL-SDR, and three years ago we ran a story about tracking World Economic Forum Attendees with an RTL-SDR.

SignalsEverywhere: ADS-B Aircraft Tracking with RTL-SDR, dump1090 and Virtual Radar Server

Over on his YouTube channel Corrosive from the SignalsEverywhere YouTube channel has uploaded a tutorial that shows how to set up ADS-B aircraft tracking with an RTL-SDR, dump1090 and Virtual Radar Server. The decoder software is dump1090 which is a multiplatform command line tool, and Virtual Radar Server is a Windows and Linux compatible program that is used to display the data on Google maps.

ADS-B is used as a more accurate and modern replacement for traditional aircraft radar. Instead of relying on radar reflections, ADS-B simply transmits a radio signal containing plane data such as GPS location, speed, and identification codes. Other aircraft can use this data for collision avoidance, and ground control use it for traffic management. Setting up your own RTL-SDR based ADS-B receiver allows you to see and track on a map almost all the aircraft currently flying in your area.

ADS-B Receiver With RTL SDR | Tracking Aircraft In Real-time!

A Portable RTL-SDR Based ADS-B Receiver with Display and 3D Printed Enclosure

Over on Hackaday.io user nathan.matsuda has written about his RTL-SDR based hand held ADS-B aircraft receiver with display and 3D printed enclosure.

His initial idea was to create a flexible and open portable SDR device, however keeping the device open and built for general use meant increased complexity which quickly slowed his progress. Instead [Nathan] decided to focus on just ADS-B for his portable device as living near an airport he’d been interested in aircraft tracking since his first SDR arrived.

The device consists of a Raspberry Zero, RTL-SDR, 3.5″ IPS LCD and a battery pack for portability. For software he uses dump1090 with some custom code for the map plotting. Together with a 3D printed case and some buttons, the result is a very professional looking portable aircraft tracking device.

Hopefully Nathan will continue updating his project page so that others may replicate it on their own.

Raspberry Pi Zero and RTL-SDR Portable ADS-B Receiver
Raspberry Pi Zero and RTL-SDR Portable ADS-B Receiver

RadarBox24 Specialty ADS-B RTL-SDR Reduced to $9.95 + Shipping

RadarBox24.com is a flight data aggregation service similar to sites like FlightAware.com and FlightRadar24.com. They aggregate ADS-B aircraft data obtained from (mostly) volunteer RTL-SDR based feeders based all over the world and use this to power their flight tracking map and flight information database.

Last year RadarBox24 came out with a specialty ADS-B RTL-SDR dongle. This is a custom RTL-SDR which contains a built in 1090 MHz tuned amplifier and filter. We have not tested this dongle yet, but we expect that the design and performance would be very similar to the FlightAware ADS-B dongles. A network analyzer report from RB24 is provided here.

These dongles can only receive 1090 MHz and do so better than a standard RTL-SDR due to the built in LNA and filter. The LNA reduces the noise figure of the dongle leading to greater sensitivity, and the filter removes any strong out of band signals that could overload and desensitize the dongle. This results in greater reception range, and more flights tracked. Please note that these dongles cannot be used as wideband general purpose RTL-SDRs due to the filtering.

Recently in an attempt to gather more volunteer contributors, RadarBox24 has decided to sell their ADS-B dongles at a loss, pricing them at only US$9.95 + shipping (or on Amazon USA with Prime). Shipping appears to be anywhere from US$5-$8 depending where you are in the world, and shipping does not increase with two or more dongles being ordered.

ADS-B data can easily be shared to RadarBox24 with their Raspberry Pi image and RadarBox24 write that if you share data to their site, you will receive the following kickbacks:

  • Free Business Account while sharing (worth $39.95 /mo). This allows you to access RAW and historic flight data as well as enabling other features such as more advanced data filtering, and a weather layer.
  • Strong and enthusiastic Community on Whatsapp
  • Track your own station's flights in real-time not only on website but also on RadarBox apps
RadarBox ADS-B RTL-SDR Dongle
RadarBox ADS-B RTL-SDR Dongle

Feeding the dump1090 Aircraft Database with VDLM2DEC

For ADS-B decoding, dump1090 is an RTL-SDR compatible program that is commonly used. In order to provide information about the aircraft being detected (e.g. icao24 hex address, registration/tail number and sometimes the type of aircraft like A380), dump1090 uses an offline database. Unfortunately this database has not been maintained in a very long time, so it is now out of date, and so cannot display information about many aircraft.

Recently Thierry had the idea to use the data from VDL2 aircraft transmissions to update his dump1090 database. VDL2 is a short data messaging system used by aircraft that will eventually replace the older ACARS messaging system. With an RTL-SDR and vdlm2dec decoder, the VDL2 signal which broadcasts at around 136 MHz can be received and decoded.

Contained within the data is the icao24 hex address and registration/tail number. By collecting this VDL2 data over a number of days, a new database can be generated which can then be imported into the dump1090 database. It however, doesn't seem to acquire aircraft type data.

An aircraft registration/tail number displayed on the fuselage.
An aircraft registration/tail number displayed on the fuselage. Image source: Wikipedia

An Open Source VOR Receiver for Airspy and RTL-SDR

Thank you to Thierry Leconte (TLeconte) for writing in and submitting his new command line based open source software called vortrack. Vortrack is a simple VOR decoder which calculates the angle towards the VOR. It is compatible with both RTL-SDR and Airspy radios, and runs on Linux.

In the past we've seen several other posts about RTL-SDRs being used to decode VOR signals, but Thierry's implementation appears to be the easiest way to get a bearing straight away. You'll get the most use out of the software if you install it on a portable device like a Raspberry Pi and take it out for a drive as you'll be able to see the VOR angle changing then.

VOR stands for VHF Omnidirectional Range and is a way to help aircraft navigate by using fixed ground based beacons. The beacons are specially designed in such a way that the aircraft can use the beacon to determine a bearing towards the VOR transmitter. VOR beacons are found between 108 MHz and 117.95 MHz, and it's possible to view the raw signal in SDR#.

A DVOR Ground Station at an Airport. Source Wikipedia.
A DVOR Ground Station at an Airport. Source Wikipedia.

An Overview of Aircraft Communication Modes from HF to UHF

Over on YouTube icholakov has uploaded an informative video that gives an overview of the main communication modes that aircraft use from HF to UHF. In the video he also gives examples of those modes being received and decoded with an SDR.

The modes that he explains and demonstrates are VHF voice, VHF ATIS automated weather, ACARS short data messages, HF voice, HF automatic weather, HF data selective calling (SELCAL), HF data link (HFDL) and UHF ADS-B aircraft positioning.

Monitoring airplane communications