Apparently the DHS has issued a "hacking alert" for small aircraft:

The alert warns if a hacker gained physical access to certain small planes, they could attach a common device to its wiring. This could provide false flight data including altitude and airspeed, as well as possible access to the autopilot system, potentially leaving a pilot unable to tell whether the reading was accurate and potentially lose control of the aircraft.

This involves physical access to the aircraft, which the FAA said "is unlikely."

Is this particularly different from other attacks not involving "computer hacking" that could be mounted given physical access to an aircraft? For example, is this in some way much less likely to be caught via a pre-flight inspection than any other attack on avionics or other equipment, or much harder to mitigate in flight?

Or is this just more Security Theatre from Homeland Security, raising what's essentially already a known mode of failure (potentially from reasons other than a "hacking attack") for which the aviation community already has procedures in place to mitigate it and continues to monitor and improve these procedures as technology changes over time?

  • $\begingroup$ What percentage of small planes even HAVE autopilots? Or any electronic instrument other than the transponder (which produces no output that he pilot can see)? $\endgroup$
    – jamesqf
    Jul 31 '19 at 5:20
  • $\begingroup$ @jamesqf I can't give percentages, but from articles and advertising it appears to me that full glass cockpits are standard in a substantial percentage of new GA aircraft in the last dozen or so years, and even in older aircraft adding GPS (which is by definition computer-based) seems to be a popular option. In my exploration of 70s-90s era electronics and computing, I've seen plenty of projects related to embedded systems in aircraft using microcontrollers, which are mainly software-driven. (And it's not hard to pull a ROM from one of those and replace it with another.) $\endgroup$
    – cjs
    Jul 31 '19 at 5:34
  • $\begingroup$ But new GA airplanes are a small fraction of the fleet. $\endgroup$
    – jamesqf
    Jul 31 '19 at 17:50
  • $\begingroup$ @jamesqf Ah, ok, I understand now. It's just a small fraction of the fleet that could be affected by this, so it's safe to ignore. $\endgroup$
    – cjs
    Aug 1 '19 at 17:49

It sounds like just another theoretical scenario. If that "hacker" wanted to do harm, he could also loosen a few bolts, disrupt the engine timing, plant a bomb, you name it.

Sure, in today's world of aircraft loaded with electronic systems the operators have little knowledge of and trust implicitly, it's quite possible that something that deliberately feeds wrong data to those systems goes unnoticed than disrupting the cylinder timing or mixture control cables would have in the past, but it's still a highly remote possibility.

What it sounds to like me is someone taking the scare of "hackers" breaking into your car and taking over the engine electronics to the next level.

  • 1
    $\begingroup$ Getting into the wiring on a small or medium or large aircraft is not easy. Need to get past airport security, possibly into a locked hangar, then into the plane (pretty visible if just tied down outside too), then up under the panel to trace out bundled, unlabelled wiring with no schematics. Not too easy. $\endgroup$
    – CrossRoads
    Jul 31 '19 at 13:12
  • 1
    $\begingroup$ Pitot tube is not a vacuum instrument. It can be digitized and displayed (on a Garmin G5 for example) but also shows up on the airspeed indicator, which is strictly air pressure against a spring. $\endgroup$
    – CrossRoads
    Jul 31 '19 at 13:18
  • 1
    $\begingroup$ I was thinking driving in that my old Northstar GPS had to be turned in to factory for software updates. Or the soldered-in battery. I had to remove it from the panel to change the PCMCIA (2 Megabyte card) with approach info. New ones are software updated via uSD card, and an AP has to sign off on it. Database updates are done by users via USB stick. So to change programs, a corrupter would need the source code of a box - the OEMs (Garmin, Avidyne, etc.) don't release that, they only distribute the executable code, so it would take someone with inside access to develop a change. $\endgroup$
    – CrossRoads
    Aug 1 '19 at 12:15
  • 1
    $\begingroup$ @CrossRoads "...a corrupter would need the source code of a box..." I'm sorry this comes across as harsh, but you seriously have no clue about hacking. More often than not, the object-code-modders have better tools for finding vulnerabilities than the developers writing the source code. $\endgroup$
    – cjs
    Aug 1 '19 at 17:59
  • 1
    $\begingroup$ It's still quite the technical challenge to try to load a compromised binary, as the hardware in almost every LRU is going to be different. $\endgroup$ Aug 1 '19 at 19:07

CNN's take on the DHS announcement:


Washington (CNN) Physical hacking of airplane electrical systems is a realistic possibility that could bring down aircraft, the Department of Homeland Security warned Tuesday.

The government said researchers at a cybersecurity firm identified ways an attacker could cause aircraft displays to show false "engine telemetry readings, compass and attitude data, altitude, airspeeds, and angle of attack."

"The researchers have further outlined that a pilot relying on instrument readings would be unable to distinguish between false and legitimate readings, which could result in loss of control of the affected aircraft," wrote the Cybersecurity and Infrastructure Security Agency, which is part of DHS.

Rapid7, the research firm, said it investigated the risks with small aircraft rather than larger commercial planes.

Hackers must have physical access to the aircraft, the company said. The attack involves physically plugging a malicious device into the electronics systems that increasingly control the displays and functions of modern aircraft.

Similar -- but more secure -- technology is used in cars. The Rapid7 researchers attributed that difference to the fact that "even small, personal aircraft are rarely parked in unmonitored, open areas like open parking lots or public streets," as is the case for cars.

The DHS notice recommended that "aircraft owners restrict access to planes to the best of their abilities" and that manufacturers review the security of their electronic systems, and consider using protections similar to those used in cars.

Neither the company nor DHS identified specific aircraft or manufacturers.

CBS's article that was called out, with a picture of Cessna 172s and other planes to lead off:

Washington — The Department of Homeland Security (DHS) issued a rare security alert Tuesday for small planes. The alert warns if a hacker gained physical access to certain small planes, they could attach a common device to its wiring. This could provide false flight data including altitude and airspeed, as well as possible access to the autopilot system, potentially leaving a pilot unable to tell whether the reading was accurate and potentially lose control of the aircraft.

"We could do basically anything the plane can do, pretty much anything the pilot could do by himself," said Tod Beardsley, director of research at cyber security firm Rapid7.

In a laboratory setting, researchers at Rapid7 were able to hack what's essentially a plane's electronic central nervous system, allowing them to send the erroneous commands. "I do think it is something of a wake up call. This is something that needs to be taken seriously now rather than later, like after the disaster," Beardsley said.

Last year, Homeland Security researchers, who successfully hacked a 757 while it was parked, warned it's only "a matter of time before a cybersecurity breach on an airline occurs." DHS is now urging small plane makers to study the cyber security protections car makers added after hackers were able to exploit similar technology on the roads.

The Federal Aviation Administration tells CBS News a "scenario that involves unrestricted physical access is unlikely" but these findings are "an important reminder to remain vigilant." Rapid7 said it notified the company that built those two systems, but their findings prompted DHS to urge pilots to secure their aircraft and for manufacturers to take a look at options to better secure these systems.

I don't see this happening to anything but the large airplanes that have automated systems.

Most smaller prop planes have no automated controls except for the autopilot - and that is easily turned off by flipping a switch, or pulling the autopilot circuit breaker. Nothing that bad data on a display is going to override. Engine controls are manual only, so there will be no planes falling out of the sky. There are old-school backups for most of the rest - altimeter fed from a hose from the static ports, attitude from backup artificial horizon and turn coordinator, compass heading from a whiskey compass, airspeed from a hose from the pitot tube, angle of attack from the artificial horizon again. Engine readings, one can look at the engine controls and see there is nothing odd set: throttle, RPM, mixture.

DHS needs to be more responsible in describing the plane types that could be affected.

  • $\begingroup$ Main affected aircraft would be those with G1000 cockpits and similar. There digital displays replace all the flight instruments, often there are no analog backups at all. Only indication the pilot would have if the engine readings are off is that the engine sounds different from what the readings tell him it should. $\endgroup$
    – jwenting
    Aug 2 '19 at 3:28
  • 1
    $\begingroup$ Not true at all re:analog backups. Look at the Avionics presented here: cessna.txtav.com/en/piston/cessna-skyhawk#_model-avionics Airspeed indicator, Artificial Horizon, Altimeter, and compass on top of the dash are still old school dials. Engine control is still manual knobs, altho engine info display has gone digital (I have done the same, with JPI EDM900 to show all engine parameters). Similar can be seen in the other models. $\endgroup$
    – CrossRoads
    Aug 2 '19 at 12:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.