Is it possible to hack an airplane while it's moving (in general)?

Question

I recently searching Airbus Careers section, and I can say that I saw too many Cyber Security job positions. It was saying in the job description that there is a need of having knowledge about avionics and of other related sections. It was not focusing on Computer Science part.

My question is this: Is there a way that someone can hack an airplane? I mean each airplane is moving. How can someone "touch" a moving airplane, have the time to identify it and then to hack it?

Also, the airports are having really specialized machines and systems in order to communicate with an airplane. How can someone, without having specialized machines, can hack an airplane?

Answer 1

The answer to

Is it possible to hack an airplane while it's moving?

is "theoretically yes, movement has no effect on a plane hackability".

How can someone "touch" a moving airplane, have the time to identify it and then to hack it?

All the people inside the airplane are touching it during the whole flight, they know which airplane they are flying with, and they have a flight worth of time.

How can someone, without having specialized machines, can hack an airplane?

Theoretically, for some components, you don't need specialized machines (see below), you need a laptop and an ethernet cable

see here (TL;DR version ), or here, and finally, from here

First, the airplanes. The problem the GAO identifies is one computer security experts have talked about for years. Newer planes such as the Boeing 787 Dreamliner and the Airbus A350 and A380 have a single network that is used both by pilots to fly the plane and passengers for their Wi-Fi connections. The risk is that a hacker sitting in the back of the plane, or even one on the ground, could use the Wi-Fi connection to hack into the avionics and then remotely fly the plane.

The report doesn't explain how someone could do this, and there are currently no known vulnerabilities that a hacker could exploit. But all systems are vulnerable--we simply don't have the engineering expertise to design and build perfectly secure computers and networks--so of course we believe this kind of attack is theoretically possible.

As we read here, though, safety critical components are not that easy to compromise:

it’s essential to understand that aircraft systems can’t be updated in-flight or on the fly. This means that if an attacker is seated on the airplane, there’s no way they could modify systems. There are only three ways to update a system on a modern aircraft:
1. Take the hardware off the aircraft and return it to the manufacturer for a factory performed update.
2. Some larger airlines have their own maintenance organizations with the required specialized equipment to perform a bench update of a particular system using a portable data loader (PDL) or some other type of specialized data-loader.
3. On-wing update [...] Specialized hardware (physical switch(es)) must be set, to place the IMA and relevant systems in maintenance mode. Once the aircraft systems are in maintenance mode, a maintenance engineer needs to follow a sequence of steps to push the update to the target system. The concept of an automatic update does not exist for any safety-critical system.

So, to summarize: yes, researchers have identified non-critical systems that could be hacked (as the passenger entertainment devices), but so far nobody has demonstrated the feasibility of hacking a critical system

Answer 2

While it may be possible for an attacker to get into certain parts of a network - for example, the infotainment system or a crew system, the avionics portion of an aircraft's system is segregated or air-gapped (depending on the aircraft's age / specification) - so, while it may be possible to interact with certain domains of the aircraft's systems there will be difficulty in transitioning from a lower-security domain such as infotainment/crew to a high-security e.g. avionics domain. This was not covered in Ruben Santamara's talk as he didn't have access to the details regarding segregation and the specifications of other parts of the network, he also wasn't working with the most up-to-date version of Boeing's code. - Further, the in-flight wifi system, while vulnerable (weaknesses were highlighted in certain systems whereby routers were discoverable on the Internet and installed with default creds), are not connected to other systems within the aircraft save for power, and as yet (as far as I'm aware) no National Aviation Authority has sanctioned the use of over-the-air updates for avionics or any other aircraft system, and all changes will still be subject to updates with safety cases etc.

Of course, this depends on the manufacturer and air carrier correctly implementing security controls.

It's also worth noting that Airbus' cyber security consultancy does not just focus on aviation, but has many contracts within defence and government.

Edit: Worth noting that larger a/c will be almost completely different in terms of avionics compared to GA which uses the CANBus system also found on road vehicles etc - however, again, physical access would still be needed.

Answer 3

Let's distinguish the two types of "hacking" we're talking about

Total control of the airplane

This is the stuff of Hollywood and is often over-dramatized. The new season of Dr. Who started off with a car being "hacked" and trying to drive itself off a parking deck. If you're not shaking your head, you should be. This wasn't a self-driving car, it was just a regular one (it had a driver before it vaporized him with a laser from the console screen). The idea that most modern cars could be hacked to drive themselves somewhere dangerous is laughable at present. That, and hacking is so wildly overblown that it's noteworthy when someone tries to make a movie or show with realistic intrusions.

Most aircraft have two computers (at least). For simplicity, we'll call the one that controls the aircraft movement the flight control computer. Most airplanes have a way to disengage any other on-board computer and fall back to this device, which takes inputs from the control systems (i.e. the steering yoke). This computer is almost certainly not hackable because they generally don't take any input from the network. If you were going to hack this computer, you would need physical access to the plane, intimate working knowledge of the on-board computers, and a new OS/firmware you could upload into the computers (plus some way to add a way for you to control it remotely).

Messing with your head

A far more realistic scenario is that a hacker gains control of some other subsystem that is hooked to the network and wreaks havoc

In his 2014 research, Santamarta found that an in-flight airline WiFi network was vulnerable to malicious behavior via vulnerable Cobham AVIATOR 700 satellite terminals on the WiFi. The danger there was an attacker gaining control over the Satellite Data Unit or the SwiftBroadband Unit interface by taking advantage of the weak password reset feature, hardcoded credentials, or the insecure protocols in the terminal.

"More specifically, a successful attack could compromise control of the satellite link channel used by the Future Air Navigation System (FANS), Controller Pilot Data Link Communications (CPDLC) or Aircraft Communications Addressing and Reporting System (ACARS)," he wrote in his 2014 research paper. "A malfunction of these subsystems could pose a safety threat for the entire aircraft."

Imagine that ACARS suddenly starts feeding erratic data. Ground stations begin to get notices the engines have shut down or are malfunctioning. The air crew might divert out of an abundance of caution. This is costly for everyone involved, because now you're taking a plane out of service for inspection and having to reroute passengers. Worse, you have a crew potentially no longer trusting on-board systems.

These "soft" intrusions are no less dangerous, but they are very real. Often times, network security is a low priority and anything that touches the network is potentially vulnerable. You can't directly crash a plane, but messing with a crews' head can be just as dangerous.

Answer 4

Yes

At Defcon this year there was an entire Aviation Hacking Village - demonstrating and discussing hack techniques and defences. The village is specifically created to identify vulnerabilities and inform manufacturers of them before they are used in the wild, allowing them to be remediated. See specifically, Harshad's talk at 1030 on Sunday for ILS system attacks, and the various CANbus exploits.

Speaking Schedule:

Friday 9th August – Bally’s Hotel Event Center – Track 1

Time Talk + Speaker

• 1300 – 1315 Can the CAN bus fly ­Risks of CAN bus networks within avionics systems Patrick Kiley
• 1315 – 1400 Behind the scenes of hacking airplanes Zoltan and Ben
• 1400 – 1430 Hacking the Air Force and Beyond Dr. Will Roper and Jack Cable
• 1430 – 1500 A Hacker Walks Into A Flight School And Says Ouch: Common Online Security Fails In Pilot Training Tarah

Saturday 10th August – Bally’s Hotel Event Center – Track 1

Time Talk + Speaker

• 1000 – 1100 Panel – The Long Haul: The State of Aviation Security Policy Andrea, Stefan, Pete, Renderman
• 1100 – 1200 A hackers first solo: airplane avionics security 101 Ken and Alex

Sunday 11th August – Bally’s Hotel Event Center – Track 1

Time Talk + Speaker

• 1000 – 1030 Ideas whose time has come: CVD, SBOM, and SOTA Katie and Art
• 1030 – 1100 Wireless Attacks on Aircraft Instrument Landing System Harshad
• 1100 – 1130 In The Air And On The Air: Aviation Radio Systems Exploding Lemur
• 1130 – 1200 An introduction to the ARINC standards Karl

Demos and Show-And-Tell:

Date / Time Event

• All Day / Every Day CANBus Avionics Demo Patrick from Rapid 7
• All Day / Every Day PTP Workshop
• All Day / Every Day Bricks in the Loop DDS
• All Day / Every Day ADS-B Workshop Renderman and Jim Workshop
• Sat 10th / 1100 Talk: A Venture into the Dark Side John McCarthy Workshop