Spoofing Aircraft Instrument Landing Systems with an SDR

Recently Arstechnica ran an in depth story about how a $600 USRP software defined radio could be used to trick an aircraft that is making use of the Instrument Landing System (ILS). ILS is a radio based system that has been used as far back as 1938 and earlier. It's a very simple system consisting of an array of transmitter antennas at the end of a runway and a radio receiver in the aircraft. Depending on the horizontal and vertical position of the aircraft, the ILS system can help the pilot to center the aircraft on the runway, and descend at the correct rate. Although it is an old technology, it is still in use to this day as a key instrument to help pilots land especially when optical visibility is poor such as at night or during bad weather/fog.

Researchers from Northeastern University in Boston have pointed out in their latest research that due to their age, ILS systems are inherently insecure and can easily be spoofed by anyone with a TX capable radio. Such a spoofing attack could be used to cause a plane to land incorrectly. In the past ILS failures involving distorted signals have already caused near catastrophic incidents.

However, to carry out the attack the attacker would require a fairly strong power amplifier and directional antenna lined up with the runway. Also as most airports monitor for interference the attack would probably be discovered. They write that the attack could also be carried out from within the aircraft, but the requirements for a strong signal and thus large power amplifier and directional antenna would still be required, making the operation too suspicious to carry out onboard.

Wireless Attacks on Aircraft Landing Systems

One comment

  1. snn47

    Unlike other article on ARS technical this article is cherry picking what it needs to support the headline, but lacks some important facts necessary for the understanding ILS-system. Therefore the ars technica article and the post on RTL-SDR needs to be revised and amended in explanations, why the proposed jamming is very hard to unlikely to achieve in reality, even though it sounds plausible, when demonstrated on a test bench.

    Both ILS-LLZ- and ILS-GP-Receiver of an aircraft derive the information fly left/right (ILS-LLZ) and fly lower/higher (ILS-GP) from the difference in Depth Of Modulation (DOM) between the 90 Hz and 150 Hz tone of the Amplitude Modulation in relation to the carrier received.

    However the Difference in DOM between the 90 Hz and 150 Hz tone of the AM received by the ILS receivers exists in space, is not generated as AM in the ILS-LLZ- and ILS-GP-transmitter.

    – The difference in Depth Of Modulation (DOM) between the 90 Hz and 150 Hz modulation of the Amplitude Modulated ILS-LLZ and ILS-GP signal signals varies in space and therefore with the 3d position of an aircraft.
    – ILS-LLZ and ILS-GP transmitter generate only signals with a constant Depth Of Modulation (DOM).
    – The varying DOM of the 90 Hz and 150 Hz in space requires for generation several signals (with and without carrier, CSB and SBO) which are feed through elaborate phase and amplitude shifting networks to feed a minimum of 3 ILS-LLZ and ILS-LLZ-antennas.

    The aircraft ILS-LLZ- and ILS-GP-Receiver receives the
    – ILS-LLZ 90 Hz signal is stronger, when an aircraft flies left of the RWY center line
    – stronger for the 150 Hz signal, when the aircraft is flying right of the center line.
    – For an aircraft flying directly on the extended center line the Difference in DOM is 0, because both 90 Hz and 150 Hz have identical DOM.
    – ILS-GP is similar and differs only in so far that the 90 Hz is the signal above, and the 150 Hz the signal below the Glide slope.

    It is not easy to estimate the volume of space of and consequently volume of possible interference such a proposed transmitter can create, because it will differ among other factors with the interferers location, antenna pattern and EIRP it will create compared to signal in space generated by the ILS-LLZ- and ILS-GP-antenna/-EIRP pattern and the varying aircraft 3d-position in relation to the interferer and ILS-LLZ and ILS-GP.

    The Instrument Landing Systems (ILS) is standardized by ICAO since 1949 in Annex 10 and related documents and consists of
    – ILS-Localizer (ILS-LLZ) providing fly left/right for the aircraft to maintain the extended Runway (RWY) center line (108 -112 MHz)
    – ILS-Glide-Path (ILS-GP) providing fly lower/higher Glide-Slope normally of 3° ending at the touchdown (329-335MHz)
    – Outer-, Middle- and Inner-Marker identifying distance to the touchdown (75 MHz) and/or
    – Distance Measuring Equipment (DME (960 – 1215 MHz) which can replace or augment the Marker

Leave a Reply to snn47 Cancel reply

You may use the following HTML:
<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

This site uses Akismet to reduce spam. Learn how your comment data is processed.