3
$\begingroup$

I recently searching Airbus Careers section, and I can say that I saw too many Cyber Security job positions. It was saying in the job description that there is a need of having knowledge about avionics and of other related sections. It was not focusing on Computer Science part.

My question is this: Is there a way that someone can hack an airplane? I mean each airplane is moving. How can someone "touch" a moving airplane, have the time to identify it and then to hack it?

Also, the airports are having really specialized machines and systems in order to communicate with an airplane. How can someone, without having specialized machines, can hack an airplane?

$\endgroup$
  • $\begingroup$ Possible duplicate of Can a Boeing 777 be hacked? $\endgroup$ – Ralph J Aug 28 at 11:32
  • 1
    $\begingroup$ It would depend on the type of airplane, wouldn't it? I very much doubt my 1960s vintage Cherokee could be hacked :-) $\endgroup$ – jamesqf Aug 28 at 17:38
  • $\begingroup$ Some Boeings don't need to be hacked, they already fly into the ground by themselves - well currently they don't fly at all. $\endgroup$ – Christian Sep 19 at 13:55
7
$\begingroup$

The answer to

Is it possible to hack an airplane while it's moving?

is "theoretically yes, movement has no effect on a plane hackability".

How can someone "touch" a moving airplane, have the time to identify it and then to hack it?

All the people inside the airplane are touching it during the whole flight, they know which airplane they are flying with, and they have a flight worth of time.

How can someone, without having specialized machines, can hack an airplane?

Theoretically, for some components, you don't need specialized machines (see below), you need a laptop and an ethernet cable

see here (TL;DR version ), or here, and finally, from here

First, the airplanes. The problem the GAO identifies is one computer security experts have talked about for years. Newer planes such as the Boeing 787 Dreamliner and the Airbus A350 and A380 have a single network that is used both by pilots to fly the plane and passengers for their Wi-Fi connections. The risk is that a hacker sitting in the back of the plane, or even one on the ground, could use the Wi-Fi connection to hack into the avionics and then remotely fly the plane.

The report doesn't explain how someone could do this, and there are currently no known vulnerabilities that a hacker could exploit. But all systems are vulnerable--we simply don't have the engineering expertise to design and build perfectly secure computers and networks--so of course we believe this kind of attack is theoretically possible.

As we read here, though, safety critical components are not that easy to compromise:

it’s essential to understand that aircraft systems can’t be updated in-flight or on the fly. This means that if an attacker is seated on the airplane, there’s no way they could modify systems. There are only three ways to update a system on a modern aircraft:
1. Take the hardware off the aircraft and return it to the manufacturer for a factory performed update.
2. Some larger airlines have their own maintenance organizations with the required specialized equipment to perform a bench update of a particular system using a portable data loader (PDL) or some other type of specialized data-loader.
3. On-wing update [...] Specialized hardware (physical switch(es)) must be set, to place the IMA and relevant systems in maintenance mode. Once the aircraft systems are in maintenance mode, a maintenance engineer needs to follow a sequence of steps to push the update to the target system. The concept of an automatic update does not exist for any safety-critical system.

So, to summarize: yes, researchers have identified non-critical systems that could be hacked (as the passenger entertainment devices), but so far nobody has demonstrated the feasibility of hacking a critical system

$\endgroup$
  • 1
    $\begingroup$ Wow. I had no idea. A socking part of an article that you gave me is this: "While we appreciate responsible engagement from independent cybersecurity researchers, we’re disappointed in IOActive’s irresponsible presentation." Amazing! So yes there is a high possibility to hack an airplane. The thing is that for now there are 0 attempts. Thanks for your answer. It was more than clear :) $\endgroup$ – avionerman Aug 28 at 6:06
  • 2
    $\begingroup$ I doubt the planes avionics can be affected as there is typically either an air gap or data verification/validation between systems of differing criticality. $\endgroup$ – selectstriker2 Aug 28 at 13:41
  • 2
    $\begingroup$ @selectstriker2 - you'd expect that, but it is not always the case. And where there is data verification/validation, it's always possible for the systems to get it badly wrong :-) $\endgroup$ – Rory Alsop Aug 28 at 15:01
  • 1
    $\begingroup$ @CrossRoads: The risk is more like: A passenger uses the plane's onboard Wi-Fi to browse to a rogue web site, which then causes their browser (connected to the plane's Wi-Fi, remember) to do something malicious. $\endgroup$ – Greg Hewgill Aug 28 at 20:41
  • 1
    $\begingroup$ @avionerman, the IOActive's presentation is irresponsible in that it is scaremongering. They admit they don't have the engineering experience to make proper analysis of how dangerous it actually is, and they are missing many steps to get to anything actually dangerous—because the system they got in is not safety critical, so all the serious protections only start behind it—yet present it as imminent danger. But defending against this kind of PR is part of a reason why avionics manufacturers need security experts. $\endgroup$ – Jan Hudec Sep 2 at 20:58
4
$\begingroup$

While it may be possible for an attacker to get into certain parts of a network - for example, the infotainment system or a crew system, the avionics portion of an aircraft's system is segregated or air-gapped (depending on the aircraft's age / specification) - so, while it may be possible to interact with certain domains of the aircraft's systems there will be difficulty in transitioning from a lower-security domain such as infotainment/crew to a high-security e.g. avionics domain. This was not covered in Ruben Santamara's talk as he didn't have access to the details regarding segregation and the specifications of other parts of the network, he also wasn't working with the most up-to-date version of Boeing's code. - Further, the in-flight wifi system, while vulnerable (weaknesses were highlighted in certain systems whereby routers were discoverable on the Internet and installed with default creds), are not connected to other systems within the aircraft save for power, and as yet (as far as I'm aware) no National Aviation Authority has sanctioned the use of over-the-air updates for avionics or any other aircraft system, and all changes will still be subject to updates with safety cases etc.

Of course, this depends on the manufacturer and air carrier correctly implementing security controls.

It's also worth noting that Airbus' cyber security consultancy does not just focus on aviation, but has many contracts within defence and government.

Edit: Worth noting that larger a/c will be almost completely different in terms of avionics compared to GA which uses the CANBus system also found on road vehicles etc - however, again, physical access would still be needed.

$\endgroup$
1
$\begingroup$

Yes

At Defcon this year there was an entire Aviation Hacking Village - demonstrating and discussing hack techniques and defences. The village is specifically created to identify vulnerabilities and inform manufacturers of them before they are used in the wild, allowing them to be remediated. See specifically, Harshad's talk at 1030 on Sunday for ILS system attacks, and the various CANbus exploits.

Speaking Schedule:

Friday 9th August – Bally’s Hotel Event Center – Track 1

Time Talk + Speaker

  • 1300 – 1315 Can the CAN bus fly ­Risks of CAN bus networks within avionics systems Patrick Kiley
  • 1315 – 1400 Behind the scenes of hacking airplanes Zoltan and Ben
  • 1400 – 1430 Hacking the Air Force and Beyond Dr. Will Roper and Jack Cable
  • 1430 – 1500 A Hacker Walks Into A Flight School And Says Ouch: Common Online Security Fails In Pilot Training Tarah

Saturday 10th August – Bally’s Hotel Event Center – Track 1

Time Talk + Speaker

  • 1000 – 1100 Panel – The Long Haul: The State of Aviation Security Policy Andrea, Stefan, Pete, Renderman
  • 1100 – 1200 A hackers first solo: airplane avionics security 101 Ken and Alex

Sunday 11th August – Bally’s Hotel Event Center – Track 1

Time Talk + Speaker

  • 1000 – 1030 Ideas whose time has come: CVD, SBOM, and SOTA Katie and Art
  • 1030 – 1100 Wireless Attacks on Aircraft Instrument Landing System Harshad
  • 1100 – 1130 In The Air And On The Air: Aviation Radio Systems Exploding Lemur
  • 1130 – 1200 An introduction to the ARINC standards Karl

Demos and Show-And-Tell:

Date / Time Event

  • All Day / Every Day CANBus Avionics Demo Patrick from Rapid 7
  • All Day / Every Day PTP Workshop
  • All Day / Every Day Bricks in the Loop DDS
  • All Day / Every Day ADS-B Workshop Renderman and Jim Workshop
  • Sat 10th / 1100 Talk: A Venture into the Dark Side John McCarthy Workshop
$\endgroup$
  • 3
    $\begingroup$ @quietflyer, "Fail" can certainly be used as a noun these days $\endgroup$ – selectstriker2 Aug 28 at 13:38
  • 2
    $\begingroup$ Without making a judgement on whether commercial aircraft are vulnerable to hacking, a convention on a topic does not make that topic plausible. For example, see any conspiracy theory conventions. Therefore, I wonder how does this answer the question? $\endgroup$ – AEhere supports Monica Aug 28 at 14:54
  • 2
    $\begingroup$ It's not a convention on the topic - that was part of the world's biggest hacking convention, demonstrating attacks, so it absolutely answers the question. Or maybe I should just start with the word- Yes :-) $\endgroup$ – Rory Alsop Aug 28 at 14:58
  • 2
    $\begingroup$ I haven't heard of anyone demonstrating anything, except in simulators $\endgroup$ – selectstriker2 Aug 28 at 15:09
  • 1
    $\begingroup$ Well - it's really worth following the links on that page to their twitter, and I think videos. I think there were two valid vulnerabilities over the last couple of years (It's not my field, I'm more critical infrastructure and private sector) $\endgroup$ – Rory Alsop Aug 28 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.