Is "hacking small planes" a separate or larger problem from/than general small-aircraft security?

Question

Apparently the DHS has issued a "hacking alert" for small aircraft:

The alert warns if a hacker gained physical access to certain small planes, they could attach a common device to its wiring. This could provide false flight data including altitude and airspeed, as well as possible access to the autopilot system, potentially leaving a pilot unable to tell whether the reading was accurate and potentially lose control of the aircraft.

This involves physical access to the aircraft, which the FAA said "is unlikely."

Is this particularly different from other attacks not involving "computer hacking" that could be mounted given physical access to an aircraft? For example, is this in some way much less likely to be caught via a pre-flight inspection than any other attack on avionics or other equipment, or much harder to mitigate in flight?

Or is this just more Security Theatre from Homeland Security, raising what's essentially already a known mode of failure (potentially from reasons other than a "hacking attack") for which the aviation community already has procedures in place to mitigate it and continues to monitor and improve these procedures as technology changes over time?

Answer 1

It sounds like just another theoretical scenario. If that "hacker" wanted to do harm, he could also loosen a few bolts, disrupt the engine timing, plant a bomb, you name it.

Sure, in today's world of aircraft loaded with electronic systems the operators have little knowledge of and trust implicitly, it's quite possible that something that deliberately feeds wrong data to those systems goes unnoticed than disrupting the cylinder timing or mixture control cables would have in the past, but it's still a highly remote possibility.

What it sounds to like me is someone taking the scare of "hackers" breaking into your car and taking over the engine electronics to the next level.

Answer 2

CNN's take on the DHS announcement:

https://www.cnn.com/2019/07/30/politics/airplane-hacking-risk/index.html

Washington (CNN) Physical hacking of airplane electrical systems is a realistic possibility that could bring down aircraft, the Department of Homeland Security warned Tuesday.

The government said researchers at a cybersecurity firm identified ways an attacker could cause aircraft displays to show false "engine telemetry readings, compass and attitude data, altitude, airspeeds, and angle of attack."

"The researchers have further outlined that a pilot relying on instrument readings would be unable to distinguish between false and legitimate readings, which could result in loss of control of the affected aircraft," wrote the Cybersecurity and Infrastructure Security Agency, which is part of DHS.

Rapid7, the research firm, said it investigated the risks with small aircraft rather than larger commercial planes.

Hackers must have physical access to the aircraft, the company said. The attack involves physically plugging a malicious device into the electronics systems that increasingly control the displays and functions of modern aircraft.

Similar -- but more secure -- technology is used in cars. The Rapid7 researchers attributed that difference to the fact that "even small, personal aircraft are rarely parked in unmonitored, open areas like open parking lots or public streets," as is the case for cars.

The DHS notice recommended that "aircraft owners restrict access to planes to the best of their abilities" and that manufacturers review the security of their electronic systems, and consider using protections similar to those used in cars.

Neither the company nor DHS identified specific aircraft or manufacturers.

CBS's article that was called out, with a picture of Cessna 172s and other planes to lead off:

Washington — The Department of Homeland Security (DHS) issued a rare security alert Tuesday for small planes. The alert warns if a hacker gained physical access to certain small planes, they could attach a common device to its wiring. This could provide false flight data including altitude and airspeed, as well as possible access to the autopilot system, potentially leaving a pilot unable to tell whether the reading was accurate and potentially lose control of the aircraft.

"We could do basically anything the plane can do, pretty much anything the pilot could do by himself," said Tod Beardsley, director of research at cyber security firm Rapid7.

In a laboratory setting, researchers at Rapid7 were able to hack what's essentially a plane's electronic central nervous system, allowing them to send the erroneous commands. "I do think it is something of a wake up call. This is something that needs to be taken seriously now rather than later, like after the disaster," Beardsley said.

Last year, Homeland Security researchers, who successfully hacked a 757 while it was parked, warned it's only "a matter of time before a cybersecurity breach on an airline occurs." DHS is now urging small plane makers to study the cyber security protections car makers added after hackers were able to exploit similar technology on the roads.

The Federal Aviation Administration tells CBS News a "scenario that involves unrestricted physical access is unlikely" but these findings are "an important reminder to remain vigilant." Rapid7 said it notified the company that built those two systems, but their findings prompted DHS to urge pilots to secure their aircraft and for manufacturers to take a look at options to better secure these systems.

I don't see this happening to anything but the large airplanes that have automated systems.

Most smaller prop planes have no automated controls except for the autopilot - and that is easily turned off by flipping a switch, or pulling the autopilot circuit breaker. Nothing that bad data on a display is going to override. Engine controls are manual only, so there will be no planes falling out of the sky. There are old-school backups for most of the rest - altimeter fed from a hose from the static ports, attitude from backup artificial horizon and turn coordinator, compass heading from a whiskey compass, airspeed from a hose from the pitot tube, angle of attack from the artificial horizon again. Engine readings, one can look at the engine controls and see there is nothing odd set: throttle, RPM, mixture.

DHS needs to be more responsible in describing the plane types that could be affected.