Learn TCAS: aeroplane hacking for fun

Two aircraft are closing on each other at a combined speed of more than 1,500 km/h. Air traffic control hasn’t spotted it yet. A few seconds later, both cockpits hear a synthetic voice: one crew is told to climb, the other to descend. Nobody on the ground made that decision. The aircraft worked it out between themselves.

That’s TCAS, the Traffic alert and Collision Avoidance System. I got curious about it as a security engineer: it’s a safety-critical system that runs on radio messages flying through the air around every airport. This post covers how it works, what you can safely listen to at home, and what public security research has to say.

TCAS and ACAS in one minute

ACAS (Airborne Collision Avoidance System) is the international standard, and TCAS II is the system that implements it on today’s airliners. Large commercial aircraft are required to carry it.

The key idea is that TCAS is independent of the ground. It doesn’t need air traffic control or radar. Each equipped aircraft interrogates the transponders of the aircraft around it, works out their range, bearing and altitude, and predicts whether any of them is becoming a threat.

Traffic advisories and resolution advisories

TCAS gives the crew two levels of warning:

Traffic advisory (TA): “Traffic, traffic.” Another aircraft is getting close. The crew looks for it and gets ready, but doesn’t manoeuvre yet.
Resolution advisory (RA): an instruction such as “Climb, climb” or “Descend, descend”. The crew follows it promptly, even if it conflicts with an ATC instruction.

RAs are vertical only: TCAS II tells crews to climb, descend or hold their vertical speed, never to turn. When both aircraft carry TCAS II, they coordinate their RAs over the air, so one climbs while the other descends instead of both doing the same thing.

What’s inside

A TCAS installation has a few main parts:

The TCAS processor: the computer that tracks nearby aircraft and decides when to issue a TA or RA.
Antennas: typically one on top of the fuselage and one underneath, so it can tell where other aircraft are.
A Mode S transponder: the radio that answers interrogations and carries the coordination messages between aircraft.
Cockpit displays and aural alerts: the traffic picture and the voice the crew hears.

The radio side uses two frequencies. Interrogations go out on 1030 MHz and replies come back on 1090 MHz. TCAS measures range from how long a reply takes to arrive, and altitude from what the other aircraft reports.

Listening with an RTL-SDR

This is where it gets fun for a hobbyist. A cheap USB TV dongle built around the RTL2832U chip can act as a software-defined radio (SDR), and it can tune to 1090 MHz. With a decoder such as dump1090, you can watch the traffic over your house in real time.

# Receive only: decode Mode S and ADS-B traffic on 1090 MHz
dump1090 --interactive

You’ll see a table of aircraft with their identifiers, altitudes and, for many of them, positions. That last part comes from ADS-B.

Listening is the whole point here. Never transmit on aviation frequencies. It’s illegal without authorisation, and interfering with these systems can put lives at risk.

ADS-B and hybrid surveillance

ADS-B (Automatic Dependent Surveillance–Broadcast) lets an aircraft broadcast its own GPS position, altitude and identity on 1090 MHz, several times a second, to anyone listening. Ground stations, other aircraft and your RTL-SDR all receive the same messages.

Modern TCAS can use these broadcasts through hybrid surveillance. For aircraft that are far away and not a threat, TCAS tracks them passively from their ADS-B messages, which cuts down on radio interrogations. As an aircraft gets closer and could become a threat, TCAS switches back to active interrogation, and RAs are based on those active measurements.

That design detail matters for security, as the next section shows.

What security research says

ADS-B messages are not authenticated or encrypted. Anyone can receive them, and in principle anyone with the right equipment could transmit fake ones. That observation has driven more than a decade of public research and talks, including:

Andrei Costin at Black Hat 2012, on the insecurity of ADS-B and practical attacks against ADS-B devices;
RenderMan at DEF CON 20 and later at Hackfest 2014, on what happens when hackers look at aircraft systems;
academic work from the University of Oxford on the security of ADS-B and aviation surveillance;
Ken Munro and Pen Test Partners, whose aviation security research looks at aircraft and avionics more broadly.

A recurring theme is that aviation systems were designed for safety and interoperability, not against an active attacker. Hybrid surveillance is a good example of defence in depth: TCAS may use unauthenticated ADS-B data to save radio time, but it relies on its own active measurements when it actually issues an RA.

Why this is worth learning

You don’t need to work in aviation to get something out of this:

It’s a great RF playground. A cheap dongle and an antenna on a window are enough to decode real, live traffic.
It teaches protocol thinking. Who can send this message? Who checks it? What happens if it’s wrong?
It shows how safety and security interact. Some of the most interesting design decisions are about what a system should trust, and when.

If you try it, keep it receive-only, keep it legal, and enjoy watching the sky.

This post is a refreshed and finished version of an article I first published on LinkedIn on 2 November 2022.