20
$\begingroup$

In modern airliners, do systems like the in-flight entertainment system (IFE) share the same physical and/or logical network as the flight management systems (FMS)? Is there any communication between the IFE and the FMS? Also, is there any Airbus training or procedure that might deal with what to do if flight systems were being tampered with?

I'm asking because an information security researcher named Chris Roberts is in a bit of trouble with the FBI after claiming he hacked into the entertainment systems on Airbus and Boeing airliners and used the access to tamper with the airplanes' flight control systems. Apparently he would connect into a Seat Entertainment Box (SEB) and hack the IFE system. I am an information security professional myself and I have no reason to disbelieve this part given my personal experience.

What I am initially skeptical about is that he has claimed to have successfully tampered with flight control systems using the access gained from the compromised IFE. Specifically listed in this document he has allegedly claimed that he issued a climb command to one of the engines through the thrust management computer, causing it to spool up and temporarily cause the aircraft to yaw. This would only be possible if the IFE were able to communicate somehow with the FMS.

Improve this question
$\endgroup$
6
  • $\begingroup$ I've read that some people doubt the story entirely since the IFE is apparently connected to a read-only bus of the actual flight computers. Like many times in aviation it's a good idea to let the facts be presented and verified before jumping at conclusions :) $\endgroup$
    – Thunderstrike
    May 18, 2015 at 14:59
  • $\begingroup$ This doesnt answer your question but you should look into the vulnerabilities of nextgen air traffic control there was a defcon talk about this and I would bet that is how he manipulated the aircraft. I find it hard to believe that the IFE would be so easily linked to critical flight systems (but I've been wrong before)... $\endgroup$
    – Matthew Peters
    May 18, 2015 at 19:18
  • 1
    $\begingroup$ @MatthewPeters I've read that article and watched the defcon talk. I see no relationship between those and this question. $\endgroup$
    – Simon
    May 18, 2015 at 21:43
  • $\begingroup$ If FMS is pwned, the best response is most likely a prayer. $\endgroup$
    – Deer Hunter
    May 18, 2015 at 22:00
  • 3
    $\begingroup$ Note I am skeptical on the ability to issue commands from a compromised IFE, however I've learned never to discount the possibility of bad design, hence the question. If I had to bet on it I would put my money against the possibility. $\endgroup$
    – GdD
    May 19, 2015 at 9:07

2 Answers 2

Reset to default
8
$\begingroup$

Aircraft do have LAN Networks for their sensors to minimize wiring (and consequently weight), however I would assume these are closed circuit networks and NOT connected to the IFE system.

In terms of the FMS system on aircraft according to this they do have databases however I dug into it a bit and it seems that based on this walk through on updating you need to physically connect to the device to change that database (for Rockwell Collins Equipment). It also seems that the Honeywell FMS computers have a similar way of updating via USB. While I cant say for certain it does not seem the FMS is on any kind of network aside from its own.

The big question is autopilot/FBW systems and can they be overridden or tampered with. It seems that Boeing-Honeywell has a patent on some remote flying systems but has not yet implemented it on any aircraft. I am still looking for some solid evidence that the systems have a point of access on the network. It is clear that they can be altered if you can physically connect to them for update purposes. Keep in mind you would have to load them with false data.

This seems to be the autopilot for the 777 however Rockwell Collins does not seem to allow you to get the info on it very readily. Maybe someone else on here can comment on how its set up.

This nice paper overview of FBW systems on a 777, in section 11.4.4 lists the connections the FBW system has to other systems on the plane. While this is by no means an official document (at least I don't think so) it does not list the IFE system as a connection and is pretty clear on the fact that everything connects over the ARINC 629 style data busses.

Edit:

It does appear that ethernet technology is making its way onto aircraft however it seems that the tech still uses ARINC Specification 664. However page 2 of this spec documents seems to imply that through a "gateway" the system is connected to the "internet". However Page 38 clearly states

Although AFDX/ARINC 664 is a closed network, UDP port numbers should be selected from the Dynamic/Private range of numbers. The reason for this is that there could be potential conflicts with the standard port number assignments when a gateway is used to communicate between the AFDX network and the Internet

So it is connected to the internet but the flight control systems are on a closed network. They also advise you to use the private range of ports to avoid any possible conflicts. Here is another good paper on the technology. It does seem that they are moving towards some internet like devices on aircraft but it also seems that they will remain closed networks. Companies are looking to consume some modern tech for an age old application as its simpler and easier to use existing high speed bus technology than reinvent the wheel and make a new custom bus. Just because something has a router and ethernet cables does not mean its connected to the internet!

Improve this answer
$\endgroup$
6
  • $\begingroup$ I don't know for sure that they are currently in use, but Ethernet networks including both the flight control and IFE systems are at least planned for the near future. $\endgroup$
    – fooot
    May 18, 2015 at 15:59
  • $\begingroup$ @fooot -- that link is in reference to AFDX/ARINC 664, basically $\endgroup$
    – UnrecognizedFallingObject
    May 18, 2015 at 22:23
  • 2
    $\begingroup$ Note, that IFE definitely gets data from the avionics (so it can draw the map with current position and show current speed). It probably also does send some data back to the avionics, namely it reports faults so they can show up on the ECAM display in cockpit and be recorded for maintenance. And then bug in the gateway might allow faking some important data. $\endgroup$
    – Jan Hudec
    May 19, 2015 at 6:29
  • $\begingroup$ @Jan I did notice on one of the diagrams in the links there that there was a labeled data output for the maps on the IFE displays but no other detail on that connection was provided in the document so I did not want to speculate if it was a one way or full duplex bus. I was unaware the IFE issue would show up on the screens in the cockpit though. $\endgroup$
    – Dave
    May 19, 2015 at 12:54
  • 1
    $\begingroup$ @Jan, Interesting, Im still looking for some comprehensive documentation on the setup but its proving hard to find or hard to get a hold of. Next time I am down at the airport flying I plan to swing by the maintenance bay and see if anyone I know there can shed light on this mystery. $\endgroup$
    – Dave
    May 19, 2015 at 13:57
4
$\begingroup$

The Register reported on this subject

The links between the In-Flight-Entertainment (IFE) network and the Engine Indicating and Crew Alerting System (EICAS) is one-way. EICAS provides IFE with location and speed for display on maps.

"IFE systems on commercial airplanes are isolated from flight and navigation systems," Doug Alder, spokesman for Boeing Commercial, told El Reg. "While these systems receive position data and have communication links, the design isolates them from the other systems on airplanes performing critical and essential functions."

...

At last year’s DEFCON hackers' meeting Dr Phil Polstra, professor of digital forensics at Bloomberg University (and a qualified commercial pilot and flight instructor), delivered a lecture on the feasibility of inflight aircraft hacking. It turns out it’s a lot more difficult than you might think.

...

IFE systems do receive some information from the engine-indicating and crew-alerting system (EICAS), chiefly the aircraft’s location and speed for those little progress maps, but this data comes through a unidirectional Network Extension Device (NED).

The EICAS gets its data from a hydromechanical controller which has an electronic interface, known as an EEC, and Roberts appears to be claiming that he overrode the EEC on one engine to produce the change of course.

"In order for this to actually happen he would need to be on a plane where the levels are not directly connected to the EEC, successfully compromise the EICAS, get the EEC to accept input from the EICAS (recall this is really a monitoring system), send a bogus mode change to climb, and somehow prevent the throttle quadrant from immediately sending a correct command," he told the Reg.

"On top of this long list of conditions there are two basic facts that would make his actually flipping a plane on its side unlikely. First, jet engines do have a spool up time so this wouldn’t happen immediately. Second, the second a pilot touches the levers new signals will be sent to the EEC. When you put this all together it seems unlikely that Chris was able to ‘take over’ this plane as he claimed."

Improve this answer
$\endgroup$
1
  • 1
    $\begingroup$ "In order for this to actually happen he would need to [...]", and then a list of actions that are under the control of software. All that is working as long as the controlling firmware / programs are not overridden. If hackers can change these software, then they can do plenty of things without control, as they do with smart cars. Cryptographic keys exchange can protect further each connected device against such action, but this has also been hacked in several cases. $\endgroup$
    – mins
    Sep 1, 2015 at 8:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .