Next-Gen Air Traffic Control Vulnerable To Hackers Spoofing Planes Out Of Thin Air

A hacker attack that leads to planes dropping from the sky is the stuff of every cyberwar doomsday prophesy. But some security researchers imagine a less sensational, if equally troubling possibility: Hundreds or thousands of aircraft radioing their approach to an air traffic control tower, and no way to sort through which are real and which are ghost plane signals crafted by a malicious hacker.

At the Black Hat and Defcon security conference this week in Las Vegas, two security researchers plan to give separate talks on the same troubling issue: By 2020, a new system known as Automated Dependent Surveillance-Broadcast or ADS-B will be required as the primary mode of aircraft tracking and control for commercial aircraft in the U.S.–earlier in other countries such as Australia. And both researchers say that ADS-B lacks both the encryption necessary to keep those communications private and the authentication necessary to prevent spoofed communications from mixing with real ones, potentially allowing hackers to fabricate messages and even entire aircraft with radio tools that are cheaper and more accessible than ever before.