  Traffic Collision Avoidance Systems (TCAS) are safety-critical systems
required on most commercial aircrafts in service today. However, TCAS was not
designed to account for malicious actors. While in the past it may have been
infeasible for an attacker to craft radio signals to mimic TCAS signals,
attackers today have access to open-source digital signal processing software,
like GNU Radio, and inexpensive software defined radios (SDR) that enable the
transmission of spurious TCAS messages. In this paper, methods, both
qualitative and quantitative, for analyzing TCAS from an adversarial
perspective are presented. To demonstrate the feasibility of inducing near
mid-air collisions between current day TCAS-equipped aircraft, an experimental
Phantom Aircraft generator is developed using GNU Radio and an SDR against a
realistic threat model.
