Has anyone ever taken control of a manned aircraft from the pilot by exploiting security vulnerabilities in the electronics system?
$\begingroup$
$\endgroup$
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
7
As an information security consultant this is an interesting subject for me, and I've kept my ear to the ground. No manned aircraft has ever been controlled by a hacker unless the incident has been kept out of the public domain. The only aircraft I know of that was ever hacked was when Iran used a GPS spoofing attack to fool an American RQ-170 drone into landing in Iran instead of its home base in Afghanistan. It's unlikely that would work with a manned aircraft as pilots would catch on. Even that wasn't directly manipulating the drone's systems, instead attacking the GPS signals it used to navigate. There's been some speculation that Malaysia Flight 370 was remotely taken over, there doesn't appear to be any factual basis for that.
Hackers have successfully attacked entertainment systems in the past, however in Airbus and Boeing airplane those are separated from the flight systems so the compromise of the entertainment system would not allow the compromise of the flight systems. I am not familiar with the security design of other manufacturers. There have been stories in the news saying hackers have managed to control airplanes in flight from their seats, these have not been verified and I do not consider them credible.
There are many things working against such an attack:
- Remote control capability isn't built into passenger aircraft, partly because there's no need, but it's also a recognized security risk
- The airplane's subsystems for flight controls and navigation are proprietary, and the protocols are not open. To successfully hack and control the airplane would require substantial knowledge on the hardware and software. Security through obscurity offers some protection in this case
- Certified passenger airplanes have a high standard of testing, although as far as I know security testing isn't mandated a rigorous development process ensures a higher level of quality. Airplane's don't run on beta versions
That doesn't mean it isn't theoretically possible, so I hope manufacturers are paying attention to these.
-
3$\begingroup$ "...in Airbus and Boeing airplane [entertainment systems] are separated from the flight systems..." There's an element here which bothers me. Boeing has in the past said that these two subsystems were airgapped /and/ firewalled: since either one of those would in principle be adequate I'm concerned that somebody was just throwing buzzwords and hoping one would stick. The fact is that automotive experience suggests that at some point somebody will connect something to both systems to "enhance the customer experience", and somebody else will then find a weakness deep inside some embedded chip. $\endgroup$ Commented Jul 28, 2023 at 6:11
-
$\begingroup$ You aren't wrong to be concerned @MarkMorganLloyd. In my line of work I've seen many wake-up calls been ignored. I have a reasonable faith in the certification system, what I would like to see is a record of professional penetration testing and security certification. $\endgroup$– GdDCommented Jul 28, 2023 at 7:42
-
$\begingroup$ I was thinking also of this fairly recent report hackaday.com/2023/04/15/sufficiently-advanced-tech-has-bugs but it took me a while to find it. Then there was some of the original car hacking stuff which worked because one chip- for the very best of reasons- was connected to both the entertainment/environmental bus and the engine/safety bus. $\endgroup$ Commented Jul 28, 2023 at 7:52
-
$\begingroup$ Car manufacturers definitely have a way to go on security. $\endgroup$– GdDCommented Jul 28, 2023 at 7:55
-
1$\begingroup$ @MarkMorganLloyd : yes, saying they have firewalls on them is worrying. xkcd.com/463 "Imagine you're at a parent-teacher conference, and the teacher reassures you that he always wears a condom while teaching. Strictly speaking, it's better than the alternative, yet someone is clearly doing their job horribly wrong." $\endgroup$– vszCommented Jul 28, 2023 at 10:22
$\begingroup$
$\endgroup$
No, because if so it would be a famous case that all aviation enthusiasts would soon be aware of.
Assuming that it became known to the authorities that that was what happened.
(Hypothetical outlier cases that are difficult to completely rule out-- could something of that nature have happened to MH370 where little of the wreckage was ever recovered-- etc)
answered Jul 27, 2023 at 15:41