ADS-B and GNSS Spoofing: Why Aviation Position Data Lacks Authentication
TL;DR — Why does ADS-B have no security? ADS-B is the satellite-derived broadcast that is replacing ground radar as the backbone of air traffic surveillance — and it is transmitted in the clear, with no authentication and no encryption. The same is true of the GNSS signals it depends on. Researchers demonstrated ghost-aircraft injection in 2012; since 2022, jamming and spoofing around conflict zones have become a routine operational hazard, with a 500% year-over-year increase in spoofing reported for 2023. This post maps the protocols, the attack classes, the documented incidents, and why fixing it is a fleet-certification problem, not a software patch.
Our eight-part Electronic Flight Bag series ended on a structural observation: aviation’s classic data links were designed in an era when being on the wire was the credential. Part 6 showed what that means for the ARINC 429 bus inside the aircraft. This article extends the same analysis outward — to the two radio protocols that tell the world where the aircraft is: ADS-B and GNSS. Neither authenticates. Neither encrypts. Both are load-bearing infrastructure in 2026.
What ADS-B Is and Why It Replaced Radar
ADS-B (Automatic Dependent Surveillance–Broadcast) is the surveillance layer of the modern airspace modernization programs — the FAA’s NextGen in the United States and SESAR in Europe. “Automatic” because it requires no interrogation by ground radar; “Dependent” because the aircraft computes its own position from GNSS; “Broadcast” because it transmits that state to anyone listening, about once per second.
Two data links carry it: 1090 MHz Extended Squitter (1090ES), the global standard carried on the Mode S transponder, and 978 MHz UAT, the dual-link used in the United States below 18,000 feet. Regulators have made transmission mandatory — ADS-B Out has been required in most controlled U.S. airspace since 1 January 2020, and Europe’s mandate followed — originally 7 June 2020, delayed to 7 December 2020 for in-service aircraft, with retrofit programs running to June 2023.
The payload is rich: the aircraft’s ICAO 24-bit address (a global hardware identifier), GNSS-derived position, velocity, altitude, and flight identity. Receivers are cheap — a $30 USB dongle and open-source software will decode the sky over a city, which is exactly how flight-tracking networks like the OpenSky Network and ADS-B Exchange were built. Surveillance infrastructure that anyone can read was a deliberate design choice: it lowers the cost of ground stations and enables airborne traffic awareness (ADS-B In). It is also the protocol’s security problem in one sentence.
The Signal Has No Authentication
There is no cryptographic signature on an ADS-B message, no shared key, no challenge-response. The receiver’s implicit trust model is: whoever is transmitting has a certified transponder and an honest GNSS receiver. Both assumptions are attackable, and neither the 1090 MHz waveform nor the message format itself can distinguish a genuine transmission from a synthesized one.
Academic security research mapped this surface more than a decade ago. Andrei Costin and Aurélien Francillon’s Ghost in the Air(Traffic) (Black Hat USA 2012) demonstrated practical attacks with low-cost hardware: injecting ghost aircraft, replaying recorded messages, and denial-of-service against receivers. Martin Strohmeier, Vincent Lenders, and Ivan Martinovic’s survey Security of ADS-B: State of the Art and Beyond systematized the attack classes and the proposed defenses — and documented why none of the defenses were deployable at the time. A decade later, the protocol is unchanged.
The attack classes, briefly
| Attack | Mechanism | Effect |
|---|---|---|
| Ghost aircraft injection | Broadcast messages for a non-existent ICAO address | Phantom traffic, controller confusion, fighter-jet scrambling |
| Trajectory spoofing | Modify position/velocity fields of a target’s messages | Aircraft appears to deviate, squawk wrong, or violate airspace |
| Disappearance | Cease broadcasting or flood the target’s address | Surveillance loss on a real aircraft |
| Receiver flooding | High-rate message injection toward ground stations | DoS on surveillance feeds |
GNSS: The Weaker Layer Underneath
ADS-B’s position field is only as honest as the GNSS receiver feeding it — and civil GNSS signals are unauthenticated one-way broadcasts that arrive at the receiver buried roughly fifteen to twenty decibels beneath the thermal noise floor. A spoofing transmitter that overpowers the genuine signal can dictate position and time to the receiver; a jammer can simply deny them. Because ADS-B broadcasts what the onboard receiver believes, GNSS spoofing corrupts not only the aircraft’s own navigation but the surveillance picture every other aircraft and ground station sees. One weak link, two dependent systems.
What was long a theoretical scenario became operational reality around the conflict zones that opened in 2022. The Irish Aviation Authority’s ASAM 50 noted a marked increase in GNSS jamming and spoofing reports affecting civil aviation from February 2022 onward. By 2023, crews were reporting receivers confidently displaying false positions — in some cases clocking impossible ground speeds or showing the aircraft at an airport it had never departed — around the Black Sea, eastern Mediterranean, and Baltic regions. The OPS Group’s GPS spoofing final report counted a 500% year-over-year increase in spoofing for 2023 and catalogued dozens of specific safety concerns. EASA has repeatedly revised its Safety Information Bulletin on GNSS interference (SIB 2022-02, through R2 in November 2023 and beyond), telling operators to expect jamming and spoofing, to cross-check navigation sources, and to report every event.
The pattern for security readers: this is the same unauthenticated-protocol failure class as ARINC 429 (EFB Part 2), played out over radio at continental scale — with the added twist that the “endpoint” being spoofed is a certified receiver that every downstream system implicitly trusts.
Detection in Practice: How Ground Segments Catch Ghosts
Until cryptography arrives (if ever), the deployed answer is making lies expensive to keep consistent. The techniques that work today:
- Multilateration (MLAT). Time-difference-of-arrival across several receivers measures the aircraft’s true position geometrically. A spoofer controlling one transmitter cannot make its false position agree with MLAT; a ghost with no physical origin fails immediately. Most major flight-tracking networks and ANSPs fuse MLAT with ADS-B precisely for this kind of validation.
- Primary radar fusion. Classical radar reflects off the airframe and ignores transponders entirely — the ultimate independent channel where it still exists. Disagreement between radar returns and ADS-B claims is a high-confidence spoof flag.
- Plausibility and kinematic checks. Ground speed jumps, impossible climb rates, ICAO addresses colliding with known airframes, and trajectory discontinuities are cheap filters that catch crude injections.
- Statistical and learning-based detectors. Research since the mid-2010s has produced ML classifiers that flag anomalous message streams; production deployments exist in the research networks, and the arms race between injection quality and detection continues.
The detection stack mirrors enterprise security’s “assume breach, verify independently” doctrine: the protocol stays open, and trust is reconstructed from corroborating channels. It works — well enough that most ghost-aircraft stunts are publicly identified within hours — but it is detective, not preventive. The aircraft’s own GNSS receiver remains the single point where an attacker’s signal becomes the cockpit’s truth, which is why the procedural and inertial-referential fallbacks of the previous section carry so much weight.
Why There Is No Quick Fix
The research literature has no shortage of proposals: cryptographically signed ADS-B messages, symmetric broadcast authentication with time-delayed key release, and hybrid schemes adding integrity to the waveform itself. None has reached fleet deployment, for reasons that will be familiar from the certification post in the EFB series:
- Legacy fleet economics. Hundreds of thousands of transponders would need replacement or costly retrofit; certification cycles run in years, and mandates need global coordination (FAA, EASA, ICAO).
- Key distribution at global scale. Every aircraft, every ground station, and every ADS-B In receiver — a PKI larger than any aviation system fielded to date, with 1970s-born waveform constraints on message overhead.
- Performance and anonymity tensions. Authentication adds latency and processing to a safety-critical broadcast loop; some proposals conflict with military identity requirements.
So the deployed mitigation stack is detection and procedure, not cryptography: multilateration (independent position measurement from multiple receivers, which a spoofer cannot consistently fool), cross-checking ADS-B against primary radar and multilateration at ground stations, receiver-side plausibility checks, and ML-based anomaly detection — an active research area since the mid-2010s. On the GNSS side: inertial reference dead-reckoning, conventional navaids (VOR/DME/ILS) as cross-checks, receiver autonomous integrity monitoring, and crew procedures that treat GNSS as fallible.
What Operators and Defenders Actually Do Now
| Layer | Practice |
|---|---|
| Procedure | GNSS-interference procedures: cross-check against IRS/VOR/DME, suspect-position reporting, ATC coordination |
| Surveillance ground segment | Multilateration and radar fusion to validate ADS-B; anomaly flags on impossible kinematics |
| Regulatory reporting | EASA SIB guidance; national reporting (e.g., IAA ASAM 50); OPS Group community reporting |
| Security monitoring | Flight-data networks publish spoofing/jamming zone intelligence that operators route around |
Notice the shape of that stack: assume the protocol is hostile, verify independently, report, and route around it. It is defense-in-depth under scarcity — the same architecture philosophy EFB Part 7 built for the flight-deck boundary, minus the option of cryptography.
Key Takeaways
- ADS-B is unauthenticated, unencrypted broadcast surveillance — mandated globally since 2020, readable and forgeable with commodity hardware.
- Ghost injection, trajectory spoofing, and disappearance have been demonstrated since 2012 (Costin & Francillon; Strohmeier et al.).
- GNSS is the weaker layer underneath: one-way, unauthenticated signals that both the aircraft’s navigation and its ADS-B broadcast trust blindly.
- Since 2022, conflict-zone jamming and spoofing are routine operational facts — a 500% increase in spoofing was reported for 2023; EASA’s SIB 2022-02 has been revised repeatedly.
- No cryptographic fix is deployable at fleet scale; the real mitigations are independent verification (multilateration, inertial/radar cross-checks) and procedures.
- The design lesson generalizes: any protocol where receivers trust transmitters by default will be abused once transmitting becomes cheap.
FAQ
Can ADS-B be hacked?
The protocol has no security mechanisms to hack — forging messages is trivial with software-defined radio. What limits abuse is detection (multilateration, radar cross-checks) and the operational sophistication needed to make spoofing consequential.
Has ADS-B spoofing actually happened?
Yes — false and impossible aircraft tracks over the Baltic region (aircraft appearing to circle on public trackers) were widely reported from 2022 onward, and GNSS-spoofing events (which corrupt ADS-B positions) have been systematically documented by OPS Group and EASA since 2022–2023.
Why not just encrypt ADS-B?
Retrofit cost across the global fleet, certification timelines, a key infrastructure larger than any aviation PKI to date, and safety-critical latency constraints. Proposals exist; deployment is a decades problem.
Does GPS spoofing crash aircraft?
No accident has been attributed to it. Documented effects are navigation degradation, false surveillance data, diversions, and workload spikes — managed through cross-checks and procedures.
Is this the same problem as the EFB series covered?
Yes — the same unauthenticated-protocol failure class as ARINC 429, applied to position data instead of cockpit data links. Both trace to pre-threat-model design eras.
What replaced radar, then?
Nothing — radar remains as the independent verification layer. That redundancy is precisely what makes unauthenticated ADS-B tolerable in practice.
References
- A. Costin, A. Francillon, Ghost in the Air(Traffic): On insecurity of ADS-B protocol and practical attacks on ADS-B devices (Black Hat USA 2012, EURECOM)
- M. Strohmeier, V. Lenders, I. Martinovic, Security of ADS-B: State of the Art and Beyond (preprint, Oxford Research Archive; published in the International Journal of Critical Infrastructure Protection)
- OPS Group, GPS Spoofing: Final Report (500% spoofing increase in 2023; catalogued safety concerns)
- EASA newsroom — updates to Safety Information Bulletin 2022-02 on GNSS jamming and spoofing
- Irish Aviation Authority, ASAM 50 (GNSS jamming/spoofing increase since February 2022)
- FAA — ADS-B Equipage (rules and deadlines)
- Inside GNSS — EASA updated advisory on GNSS outages and navigation disruptions
- Parts 2, 6 and 7 of the EFB series on hmmnm.com — ARINC 429, the EFB attack surface, and the defense architecture
Current as of September 2026 · standards and incidents verified against published sources.
Educational reference only — for operational guidance, follow your operator’s procedures and your NAA’s current bulletins.
Author: hmmnm.com editorial team · hmmnm.com
