On The Security of Mobile Cockpit Information Systems

Abstract

Click fraud is a scam that hits a criminal sweet spot by both tapping into the vast wealth of online advertising and exploiting that ecosystem's complex structure to obfuscate the flow of money to its perpetrators. In this work, we illuminate the intricate nature of this activity through the lens of ZeroAccess-one of the largest click fraud botnets in operation. Using a broad range of data sources, including peer-to-peer measurements, command-and-control telemetry, and contemporaneous click data from one of the top ad networks, we construct a view into the scale and complexity of modern click fraud operations. By leveraging the dynamics associated with Microsoft's attempted takedown of ZeroAccess in December 2013, we employ this coordinated view to identify "ad units" whose traffic (and hence revenue) primarily derived from ZeroAccess. While it proves highly challenging to extrapolate from our direct observations to a truly global view, by anchoring our analysis in the data for these ad units we estimate that the botnet's fraudulent activities plausibly induced advertising losses on the order of $100,000 per day.

Cybersecurity Attacks on Software Logic and Error Handling Within ADS-B Implementations: Systematic Testing of Resilience and Countermeasures

“…Portable ADS-B transceivers (e.g., SkyEcho2, Sentry, and echoUAT) connected to smartphones are popular, especially in the GA sector. However, according to Lundberg et al [22], [23], these mobile setups are not part of the aircraft on-board systems. Thus, they do not meet and are not required to meet the reliability standards applied to traditional avionics.…”

GDL90fuzz: Fuzzing - GDL-90 Data Interface Specification Within Aviation Software and Avionics Devices–A Cybersecurity Pentesting Perspective

“…Portable ADS-B transceivers (e.g., SkyEcho2, Sentry, echoUAT), which are operated with iPads and other tablets are favored by many general aviation pilots due to the ease of setup, ease of use, and affordable pricing. As these devices are not per-se part of the onboard avionics, Lundberg et al [55], [56] pointed out that these devices do not, nor do they need to, meet the standards of traditional avionics (e.g., RTCA, ARINC, EUROCAE). The authors also found vulnerabilities on all of their test samples and recommended further product development steps to the device and software designers.…”

On the (In)Security of 1090ES and UAT978 Mobile Cockpit Information Systems–An Attacker Perspective on the Availability of ADS-B Safety- and Mission-Critical Systems

“…Many GA pilots use MCIS, which is very handy and easy to install. Lundberg et al [30] found that this type of mobile setup is not a part of the onboard systems. Thus, its reliability does not meet the standards applied to traditional avionics such as radio technical commission for aeronautics, aeronautical radio incorporated, and the European organisation for civil aviation equipment.…”

“…Even though the security of ADS-B is heavily researched, Lundberg et al [30] have provided as the sole contribution to MCIS security. However, technology and the demand for MCIS have drastically changed since that study.…”