San Diego – After identifying several dangerous vulnerabilities in the TCAS collision avoidance system and successfully validating them in the laboratory, researchers from the University of Genoa and the CASD – Scuola Superiore Universitaria, with the support of the PNRR SERICS partnership (Security and Rights in Cyber Space), analysed a real-world case: a series of TCAS collision avoidance alerts recorded over a three-hour period by ten commercial aircraft during landing at Ronald Reagan Washington National Airport on 1 March 2025. The analysis indicates that the observed behaviour is consistent with an in-flight cyberattack on the collision avoidance system, albeit in a previously undocumented variant. With a view to protecting future operational scenarios, the research group has also developed a new method to identify the source of the attack. The full results of the study will be presented at the international scientific conference Network and Distributed System Security (NDSS) Symposium, to be held in San Diego from 23 to 27 February. The study by researchers from the CASD – Scuola Superiore Universitaria (Giacomo Longo, Giacomo Ratto and Alessio Merlo) and the University of Genoa (Enrico Russo) proposes a form of defence that can be immediately applied to all attack scenarios: a monitoring system that leverages operational data already available to promptly identify anomalous signals. This approach makes it possible to detect, characterise and locate suspicious transmissions without modifying onboard equipment or relying on additional infrastructure. The researchers demonstrated that, when applied to the Washington case, the method would have provided useful indications to identify the possible location of the transmitter within 40 minutes of the first alert. (9colonne)