peer reviewed

Very Small Aperture Terminals (VSAT) have revolutionized maritime operations. However, the security dimensions of maritime VSAT services are not well understood. Historically, high equipment costs have acted as a barrier to entry for both researchers and attackers. In this paper we demonstrate a substantial change in threat model, proving practical attacks against maritime VSAT networks with less than $400 of widely-available television equipment. This is achieved through GSExtract, a purpose-built forensic tool which enables the extraction of IP traffic from highly corrupted VSAT data streams.The implications of this threat are assessed experimentally through the analysis of more than 1.3 TB of real-world maritime VSAT recordings encompassing 26 million square kilometers of coverage area. The underlying network platform employed in these systems is representative of more than 60% of the global maritime VSAT services market. We find that sensitive data belonging to some of the world's largest maritime companies is regularly leaked over VSAT ship-to-shore communications. This threat is contextualized through illustrative case studies ranging from the interception and alteration of navigational charts to theft of passport and credit card details. Beyond this, we demonstrate the ability to arbitrarily intercept and modify TCP sessions under certain network configurations, enabling man-in-the-middle and denial of service attacks against ships at sea. The paper concludes with a brief discussion of the unique requirements and challenges for encryption in VSAT environments.

Attacker models are the cornerstone of any security assessment. As attacker's capabilities evolve over time, it is key to re-evaluate periodically if attacker models that were deemed unrealistic in the past might not pose a possible threat today. In this work, we evaluate the threat of wireless radio signal cancellation attacks in the face of recent advancements in software-defined radio attacker capabilities. Unlike classical radio interference or jamming attacker models which add noise to the legitimate communication, signal cancellation attacks aim at interfering destructively with the legitimate signal in order to remove those signals from the spectrum. While signal cancellation attacks were deemed unrealistic in the analogue domain, we analyse the system requirements to perform such attacks digitally using SDRs and evaluate the feasibility to launch such attacks against wireless communication systems such as GPS. Our evaluation reveals that signal cancellation attacks that manage to attenuate up to 40 dB of the signal at the receiver are feasible over the air. We further show that even complex CDMA signals such as GPS can be attenuated by 30 dB, even below a receiver's noise floor. These results indicate that digital signal cancellation attacks - especially against systems like GPS - should not be considered impossible per se, but deserve consideration when assessing the threat of attacks on wireless communication systems.

Demands for ubiquitous global connectivity have sparked a satellite broadband renaissance. Secure satellite broadband is vital to ensuring that this growth does not beget unanticipated harm. Motivated by this need, this paper presents an experimental security analysis of satellite broadband signals using the Digital Video Broadcasting for Satellite (DVB-S) protocol. This analysis comprises 14 geostationary platforms encompassing over 100 million square kilometers of combined coverage area.

The quality of SLS products is dramatically degraded by excessive temperature gradients in the thermal profile of the powder bed. Thermal gradients in the presintering temperature, which is defined as powder temperature before laser scans, are inevitable in commercial SLS machines due to various reasons. Such a gradient will propagate to the postsintering temperature, which is defined as the material temperature right after laser scans, if constant laser power is used for sintering. To eliminate thermal gradients in the postsintering temperature, this paper proposes an automatic laser control system to adjust laser power according to the presintering temperature. Infrared cameras are used for presintering temperature measurements, which are used to compute optimal laser power profiles. Two control granularities are implemented: 1) vector-level control eliminates thermal gradients in the postsintering temperature of a single scan line and 2) layer-level control minimizes the difference of postsintering temperature of several areas, each of which consists of a number of scan lines, on the build surface. Experimental results show that variations in the postsintering temperature have been reduced by both implementations (to 60% and 20% respectively) compared to the presintering temperature.

Up-to-date meteorological information about upper air conditions is crucial for accurate weather modeling and forecasting. Existing techniques to sense meteorological parameters in the atmosphere are costly and provide only limited temporal and spatial sensing resolutions. In this paper, we propose crowdsourcing air traffic control data as a new cost-efficient method to achieve a high temporal and spatial resolution, and large coverage. Our solution leverages Secondary Surveillance Radar Mode S and ADS-B transponder signals that are continuously transmitted by aircraft for air traffic control purposes. It builds on signals captured by the OpenSky Network, a global-scale sensor network crowdsourcing 15+ billions of transponder messages per day from aircraft up to an altitude of 13 km. Based on the decoded data, we infer meteorological conditions such as air temperature, wind speed, wind direction and atmospheric pressure. Our evaluation demonstrates that our approach is effective at estimating these parameters with high resolutions along the tracks of more than 50 percent of all aircraft monitored by the OpenSky Network. Our method delivers estimations for temperature with 0.11°C, wind speed with 0.09 m/s, wind direction with 1.00°, and air pressure with 0.10 hPa average deviation, making those measurements suitable for the assimilation in numerical weather models.

The aviation industry's increasing reliance on GPS to facilitate navigation and air traffic monitoring opens new attack vectors with the purpose of hijacking UAVs or interfering with air safety. We propose Crowd-GPS-Sec to detect and localize GPS spoofing attacks on moving airborne targets such as UAVs or commercial airliners. Unlike previous attempts to secure GPS, Crowd-GPS-Sec neither requires any updates of the GPS infrastructure nor of the airborne GPS receivers, which are both unlikely to happen in the near future. In contrast, Crowd-GPS-Sec leverages crowdsourcing to monitor the air traffic from GPS-derived position advertisements that aircraft periodically broadcast for air traffic control purposes. Spoofing attacks are detected and localized by an independent infrastructure on the ground which continuously analyzes the contents and the times of arrival of these advertisements. We evaluate our system with real-world data from a crowdsourced air traffic monitoring sensor network and by simulations. We show that Crowd-GPS-Sec is able to globally detect GPS spoofing attacks in less than two seconds and to localize the attacker up to an accuracy of 150 meters after 15 minutes of monitoring time.

Abstract Despite the Aircraft Communications, Addressing and Reporting System (ACARS) being widely deployed for over twenty years, little scrutiny has been applied to it outside of the aviation community. Whilst originally utilized by commercial airlines to track their flights and provide automated timekeeping on crew, today it serves as a multi-purpose air-ground data link for many aviation stakeholders including private jet owners, state actors and military. Such a change has caused ACARS to be used far beyond its original mandate; to date no work has been undertaken to assess the extent of this especially with regard to privacy and the various stakeholder groups which use it. In this paper, we present an analysis of ACARS usage by privacy sensitive actors-military, government and business. We conduct this using data from the VHF (both traditional ACARS, and VDL mode 2) and satellite communications subnetworks. Based on more than two million ACARS messages collected over the course of 16 months, we demonstrate that current ACARS usage systematically breaches location privacy for all examined aviation stakeholder groups, explaining the types of messages used to cause this problem.We illustrate the challenges with three case studies-one for each stakeholder group-to show how much privacy sensitive information can be constructed with a handful of ACARS messages. We contextualize our findings with opinions on the issue of privacy in ACARS from 40 aviation industry professionals. From this, we explore recommendations for how to address these issues, including use of encryption and policy measures.

Multilateration techniques have been proposed to verify the integrity of unprotected location claims in wireless localization systems. A common assumption is that the adversary is equipped with only a single device from which it transmits location spoofing signals. In this paper, we consider a more advanced model where the attacker is equipped with multiple devices and performs a geographically distributed coordinated attack on the multilateration system. The feasibility of a distributed multi-device attack is demonstrated experimentally with a self-developed attack implementation based on multiple COTS software-defined radio (SDR) devices. We launch an attack against the OpenSky Network, an air traffic surveillance system that implements a time-difference-of-arrival (TDoA) multi-lateration method for aircraft localization based on ADS-B signals. Our experiments show that the timing errors for distributed spoofed signals are indistinguishable from the multilateration errors of legitimate aircraft signals, indicating that the threat of multi-device spoofing attacks is real in this and other similar systems. In the second part of this work, we investigate physical-layer features that could be used to detect multi-device attacks. We show that the frequency offset and transient phase noise of the attacker's radio devices can be exploited to discriminate between a received signal that has been transmitted by a single (legitimate) transponder or by multiple (malicious) spoofing sources. Based on that, we devise a multi-device spoofing detection system that achieves zero false positives and a false negative rate below 1%.