All this confusion over flight 370 has me wondering if it would be possible to hack into an airplane and control the autopilot or other on-board systems in a way that the pilots couldn't regain control.

I know some basic searching reveals some articles such as this one. If the plane can't be hacked, could someone with the proper knowledge snip or disable the pilot's override?

Disclaimer: I know 0 about aviation, but I am a programmer. So my guess would be that anything that doesn't have a physical disconnect would be vulnerable to being hacked without being able to override it.

Additional Disclaimer: This is a question about curiousity / possibility, not a how-to.

  • most systems on an aircraft do have a physical disconnect, and the fly by wire lets the pilot full control if he needs it – ratchet freak Mar 14 '14 at 23:46
  • 3
    @ratchet physical disconnect? How can I envision that -- like Scotty crawling through smoking engine shafts?-- My favourite joke is from the German c't magazine... an airplane passenger opens his notebook and freaks when he sees this dialog pop up: "New Bluetooth device detected: Airbus A380. Reset [yes] [no]?" – Peter A. Schneider Mar 15 '14 at 3:25
  • 2
    @PeterSchneider I meant there is a fusebox right behind the pilot where he can turn off the power to just about all systems – ratchet freak Mar 15 '14 at 3:30
  • @ratchet ok, but he wouldn't like that during takeoff or landing. Or flying, as such. – Peter A. Schneider Mar 15 '14 at 3:34
  • 1
    How about stowing a trained monkey in the wheel well. It may not count as hacking, but you might be able to accomplish the same objective. A trained monkey could be really bad news, especially if it was charming, had a snazzy outfit and had evil intentions. – David Mar 15 '14 at 8:07
up vote 27 down vote accepted

As of currently, the answer to this question is in principle no for commercial aircraft, at least not remotely. There are two parts to this:

From a system perspective:

  • Aircraft systems could probably be 'hacked'- assuming you could for instance screw up the flight computer by changing the chips in the belly- but there is no way you could really pull this off without the pilots noticing the course being way off from the compass for instance, so they'd figure out and shut it off. Many systems are not connected in a way that allows them to be cause damage to others. Systems are also pretty dedicated- if it's supposed to fly the plane, that's what it does, if it's supposed to navigate, that's what it does.

  • Systems on aircraft generally a have limited, if any, connection to the outside world. There are a few systems that have the ability to connect to the ground, and this is generally limited to simple text messages. Most of the electronics on the 777 are from the type's introduction in 1994. A decent analogy I think is trying to hack an early cell phone remotely.

And from a practical standpoint:

  • Aircraft are generally very stiff when it comes to changes- they are often approved in a certain configuration, and that then sticks, so there's little need to change stuff, and hence it's not possible. This applies to the autopilot and flight controls- once it's there, it stays there.

  • As a few people have pointed out, these systems are proprietary and closed source, making it difficult to program them if you're an outsider, but in theory it might be possible.

The fact that no aircraft, even the computer-intensive Airbus, have really been hacked to any extent, the notion that the entire aircraft would be taken over and flown somewhere is impossible.

As for original question link:

“The FAA has determined that the hacking technique described during a recent computer security conference does not pose a flight safety concern because it does not work on certified flight hardware,” he said.

“The described technique cannot engage or control the aircraft’s autopilot system using the FMS or prevent a pilot from overriding the autopilot,” said Dorr.

“Therefore, a hacker cannot obtain ‘full control of an aircraft,’ as the technology consultant has claimed,” said Dorr.

On a similar accord, I think I heard a story about a Bombardier Dash 8 that got a computer virus once, but I think it never got beyond the navigation system, the most processing intensive part. Unfortunately, I can't find a source for this.

  • 7
    Also, from a software development perspective, hacking a set of avionics would involve massive amounts of work and specialized knowledge. Home computers and business computers (servers, etc) are run on common operating systems, like Linux, Windows, Unix, OSX, etc. Avionics, not so much, they're proprietary and getting ahold of the schematics would be difficult if not illegal. You'd have to to have incredibly specialized system knowledge to hack that system in the first place and that's even before you run into all the problems that you've mentioned. Point being, hacking is highly unlikely. – Jay Carr Mar 15 '14 at 3:11
  • 3
    Since I worked in the automotive industry: Any modern vehicle is fully wired, if only for diagnostics. If you get at the diagnostics port you can most likely hack the vehicle. @JayCarr: Yes, you would need immense specialized knowledge. It was frequently difficult to e.g. flash car devices although we were legit and had the encryption keys, hardware and documentation. But then it's sometimes difficult to log into a windows computer -- doesn't mean it can't be hacked. If you drill at the right location you may get to the wire, in case the port is outside or in the pilot's footspace ;-). – Peter A. Schneider Mar 15 '14 at 3:32
  • 1
    @PeterSchneider More what I meant is that you're more likely to see a Windows hacker because there are, literally, billions of users and billions of boxes to practice on. Avionics software...not so much. But yes, still hackable if you had a mind to do it ;). – Jay Carr Mar 15 '14 at 3:34
  • 5
    +1. Also, people seem to frequently have a "movie" view of hacking, where any piece of copper or antenna can be tapped into and magically used to control the device. This isn't really true; imagine, for example, trying to hack a computer through a microphone jack or a VGA port, or trying to flash a car ECU through the radio's FM antenna, or trying to steal pictures off a cell phone through the GPS transceiver (well, presuming reasonable vendor extensions on that last one). – Jason C Mar 15 '14 at 8:58
  • 1
    I agree with @JayCarr the systems are highly proprietary so it would take a really good inside knowledge and then like this answer says it is probably near impossible to do it remotely. And if you're going to physically take apart systems why screw with the navigation why not just put a bomb or something? I mean I get that piracy is one of the theories but there was a Lear Jet that crashed 3 miles from an airport in New Hampshire (USA) back in 1996 it took 3 YEARS to find it. Oceans are much bigger. – p1l0t Mar 15 '14 at 14:47

There are certain communication systems that theoretically could be hacked into. CPDLC is used to communicate digitally between pilots and controllers, so if it were to be hacked someone could send instructions to the pilot that would look like they were coming from a controller, and the pilots would not know the difference.

Flight plans can also be uploaded to the Flight Management System in some cases and could be used to program a different route.

One thing to keep in mind though is that the pilots are still intimately involved. They see and approve all changes. Minor changes might go unnoticed, but if they were instructed to fly in a completely different direction or to a different destination, they would probably start asking questions. If they were sent directly towards a mountain or another airplane, they would likely notice or other safety systems would step in to warn them.

Even in a "worst case" scenario where someone were able to reprogram the autopilot (I don't believe that this is even possible right now) then the pilot can always just turn it off and fly manually.

In short, this isn't really something to worry about.

Everything is possible. For example, NSA could have forced a manufacturer to include some backdoor in the system for their use.

  • 1
    Haha, I like the way they come up everywhere ;) – Sunny R Gupta Mar 16 '14 at 8:21
  • As somebody who actually wrote automated test software for some controller going into an airplane and looked into the procedures which are done to ensure that the part goes into the airplane in a 100% documented and known state, I think that this is highly unlikely. If anything they would have to hack the manufacturer and add additional (which I think is easier, but very criminal, since you would be breaking the laws of dozens of countries at the same time). – Sascha Jan 7 '17 at 21:41
  • @Sascha Yet that A400M crashed because of bad software (we are told). – curiousguy Jul 2 at 19:56

"Hack" has a variety of definitions, from reading private data off a non-critical system, to disrupting or confusing an avionics mode, to taking control of the plane and locking out pilots. This complicates the discusion of how likely planes are to be "hacked".

In general, the recent consensus seems to be that under some definitions of "hack", this certainly is possible, even without insider knowledge. There's some reports of successful hacks out there, though since the details are confidential it's hard to tell what researchers accomplished or their method of attack. Both researchers and plane manufacturers seem to agree that even with insider knowledge or prolonged access the plane it would be extremely difficult, but not impossible, to take control of an airplane for more than a few seconds.

Current policy guidance by the FAA can be found in PS-AIR-21.16-02. I've heard that the FAA will eventually recognize DO-326 as a means of compliance.

I'm going to provide some information on safety and integrity measures that are standard in the industry and make hacking avionics difficult. In particular, hacking avionics is a type of safety-critical embedded device hacking, not server or personal computer hacking. Safety critical embedded devices have a much smaller attack surface and many more mitigation methods in place, as outlined below.

Threat model and differences from computers

The threats you face on planes are very different from servers and laptops. Personal computers are ripe for viruses because they use a lot of dangerously flexible techniques. They execute arbitrary code. They have software that reconfigures itself. They take in text and even commands from unverified sources. Most of these are not true for avionics, so it's hard to specify a threat model.

Especially for the most critical systems like displays and autopilots, datatypes are strict, messaging is scheduled, processing time is limited, and strings are rarely used. To accomplish most tasks, you would have to break these protocols. This is similar to other kinds of embedded programming where the software is so inflexible that the attack surface is small.

Some things that definitely help attackers here include physical access to the software update process, being able to work with the plane for several days, insider knowledge, simple RF equipment, or ability to hijack satellite communications to the plane. If your attacker has some of those the threat is much more serious.

Availability

Is it possible to mess with the availability of aircraft systems? Yes, if you can manipulate the right signals. You could, for example, make the flight control computer think a sensor has gone bad. You could throw off a lot of sensors with powerful enough radio signals. Also, most flight computers use off-the-shelf processors with lots of weird behaviors, and especially if an exploit lets you execute arbitrary assembly code, you could exploit some of these to take the avionics system offline.

However, availability isn't as big of a concern as integrity of the avionics. Most people don't stay up at night worrying about their pilot having to fly by hand because of a hacker. Most people are really concerned about a hacker taking complete control of the plane.

Partitioning

Different functions, especially ones at different safety levels, are by regulation insulated from each other. Aircraft have historically had dedicated hardware for each component, like one computer for the autopilot, another computer for the warning system, another computer for the data processing. Nowadays much of this software is run on shared LRU computers (this is called an IMA architecture). But despite sharing hardware, the software processes are strictly insulated from each other and it is assumed that no processor faults, error conditions, overflows, etc. could transfer from one process to another, especially not a higher level process. Yes, signals pass between partitions, but any signals passing from a lower safety level to a higher level are individually justified to ensure they won't cause safety issues.

In order for an exploit to have catastrophic effect, it would have to get around these by either by 1) working directly with level-A hardware and processes 2) finding a poor assumption about the impact of a lower-level signal.

See DO-297 and DO-178C for more information on this partitioning.

Testing

Many hacks in personal computers happen because of inadequate testing that lets exceptions and faults into the system. Level A software is tested far more comprehensively than most apps or PC software. Every line is tested for MC-DC coverage (not exhaustive, but every decision has to be exercised as both True and False). Structural coverage is also evaluated to make sure unintended interactions don't occur. If faults do occur, the RTOS is designed to take care of these faults predictably and reliably.

Software updates

Ok, say you can't find a way to execute arbitrary code, can you mess up the software update process? This initially seems viable, especially given the new tendency to update avionics firmware over networks. There are several issues here.

  • Most aircraft are not directly connected to the internet for avionics updates. They are connected to a local network which gets the latest software from the web. So you'd have to get access to the local network for updates and then also get access to the planes using this network. This extra layer provides some mitigation.
  • Most software updates use a high-fidelity integrity check, for which you'd need an incredibly difficult hash collision. Some update processes don't have high fidelity checks, but if this is the case they must qualify to authorities that their update process is stable and error-proof. So your only option would be to forge the CRC as well for the update and/or to find an exploit in a qualified loading process.
  • Network based updates also keep track of the version numbers and may keep track of the integrity checks for the software. So you can't exactly force an update from version 13 to a hacked v. 13.1 without someone noticing.
  • Currently supply chain attacks are becoming more and more frequent. While I'm sure a supply chain attack might be feasible, regulations such as DO-330 tool qualification and DO-178 configuration control have protected against inadvertent changes during software builds for years already. Tested and reviewed versions of code are under careful control and compared against the final versions, software build environments are locked down and qualified, and lists of included libraries are documented and approved. You'd have to find a blind spot in these processes to attack the software supply chain.
  • Software updates (not navigational database updates) are performed infrequently, maybe once every three years if that, greatly mitigating the opportunity to hack a software load. Interlocks are in place to prevent reloading the software when not desired. This infrequency also leads to greater scrutiny of the entire process.

For more analysis of safety measures to prevent corrupt software or databases from being uploaded, I'd suggest you consult the standards for this process: DO-200A, Chapter 5 of FAA Order 8110.49,and FAA AC 20-153.

Manual and Automatic Disconnect

Usually the autopilot and other software is managed by another system which has interlocks and disengage logic. These have safety standards and tests written to make sure they work reliably, making it tricky to find an exploit here without, say, already being able to execute arbitrary code.

Even if this disengagement software doesn't work, pilots have circuit breakers and can disable the entire avionics system, then fly the airplane by hand. See BigHomie's answer for a discussion of how feasible it is to hack this.

In theory, this should work, but in certain situations the plane could be put in an unsafe situation before the pilot could regain control. A sudden pitch down on approach would be difficult to recover from, even if you can manually disengage the autopilot.

Note: I'm not an expert in avionics or embedded device security. Hacking tends to be about thinking outside the box, so let me know if anything I assume here is inaccurate or if I miss anything.

  • 1
    "Software updates use a high-fidelity integrity check" We were told that the A400M crashed in Seville because the fuel control software was corrupted... – curiousguy Jul 2 at 19:54
  • @curiousguy In that crash the torque parameters were wiped during a software load, although I can't find out what that means exactly. It sounds like they weren't following directives to make sure their "update process is stable and error-proof.", and even though the software program itself was configured correctly (matching CRC's and such), some of the airplane-specific data was missing. – Cody P Jul 5 at 22:31
  • Most aircraft don't get their updates from a network at all, they require a hard link to the storage medium holding the data/updates. Think a USB stick in modern aircraft or some other data cartridge in older ones (compact flash cards come to mind, or even magnetic tape). Of course those can be fed with corrupted data, but it adds yet another layer of security. – jwenting Jul 10 at 5:04

Any computer can be hacked. I'm not saying I have the knowledge to do it, or even know much about airplanes to tell you how. However if someone with the knowledge required had the proper time, motivation, and access to an aircraft, it could most definitely be done. If you're asking if a plane can be taken over from the ground midflight, without any prior modification, I can't answer that because I don't know enough about the system.

Theoretically discussing how to hack a plane midflight, with or without prior modifications, would probably get me flagged and placed on a list somewhere, so I decline to go into detail on that.

However, one must think about what wireless protocols are used for a plane to talk to the ground, what computer subsystems can access that physical link, and if those subsystems can control the plane, or access other subsystems that can control the plane.

'Locking a pilot out' probably involves disabling a manual switch somewhere, tricky to do via computer, but can be done given enough amperage was passed through the switch to blow it, or if it were rigged before hand (prior modification).

If we're talking how to, this is a episode of Numb3rs with a similar theme, however it wouldn't be far off from what would need to take place in real life.

  • 1
    Taking it over from the ground without prior access to the craft would be, for all practical purposes, impossible. Even if you did get access to the craft and compromised the autopilot, the pilot could just turn it off. Even if you managed to blow the switch, he could pull the fuse or switch off the breaker. And, barring that, he could just shut down the power bus it was using. The odds of someone successfully taking control of a 777 autopilot without having previously been an engineer involved in designing that system are extremely low. – reirab Mar 25 '14 at 16:14
  • 1
    Passing amperage through a switch to blow it would only work in an incredibly bad novel/film. It's not realistic in an avionics perspective. -source: Avionics technician for ten years... – davewasthere Jul 6 '14 at 14:42
  • 1
    @davewasthere why? I'm not doubting you, just curious, because from an Engineering perspective, the switch has a current limit, which hopefully is at least twice its nominal rating. Can you discuss what safeguards are in place to prevent damage? – MDMoore313 Jul 6 '14 at 15:01
  • Any computer can be hacked. If the computer has no connectivity, only if you can get physical access to it. There are commercial systems, inside very secure buildings, with no connectivity to the outside world. They are unhackable. The critical systems on aircraft have no connectivity except within the aircraft. Therefore, you would need physical access to the aircraft. Now we are in the realms of James Bond. – Simon Feb 5 '16 at 16:25
  • 1
    @BigHomie Er, I think that's exactly what I said ;) – Simon Feb 5 '16 at 19:39

protected by Community Mar 19 '14 at 15:12

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.