# Have any aircraft ever been attacked by chemical, biological, radiological or nuclear weapons? Information security compromises?

Have any aircraft, military or civilian, ever been attacked by chemical, biological, radiological or nuclear weapons?

Terrorist attacks and test firings included. Attacks on persons on-board the aircraft (rather than the aircraft itself) included.

Information security attacks on the aircraft itself (such as computer viruses) would also be of interest, although I'll exclude jamming of communications and sensors such as radar.

Definition of 'chemical weapon': sure, explosives are made out of chemicals (as is everything else) but I'm talking about chemical weapons as defined by the Organisation for the Prohibition of Chemical Weapons:

The term chemical weapon is applied to any toxic chemical or its precursor that can cause death, injury, temporary incapacitation or sensory irritation through its chemical action. Munitions or other delivery devices designed to deliver chemical weapons, whether filled or unfilled, are also considered weapons themselves.

The toxic chemicals that have been used as chemical weapons, or have been developed for use as chemical weapons, can be categorised as choking, blister, blood, or nerve agents. The most well known agents are as follows: choking agents—chlorine and phosgene, blister agents (or vesicants)—mustard and lewisite, blood agents—hydrogen cyanide, nerve agents—sarin, soman, VX.

any device, including any weapon or equipment, other than a nuclear explosive device, specifically designed to employ radioactive material by disseminating it to cause destruction, damage, or injury by means of the radiation produced by the decay of such material

Ford, J. (March 1998). Radiological Dispersion Devices: Assessing the transnational threat. National Defense University - Institute for National Strategic Studies - Strategic Forum, No. 136. as cited in Rickert, Paul R., "The Likely Effect of a Radiological Dispersion Device" (2005). Faculty Publications and Presentations. Paper 47.

'Biological weapons' as defined by the United Nations:

Biological weapons are complex systems that disseminate disease-causing organisms or toxins to harm or kill humans, animals or plants. They generally consist of two parts – a weaponized agent and a delivery mechanism. In addition to strategic or tactical military applications, biological weapons can be used for political assassinations, the infection of livestock or agricultural produce to cause food shortages and economic loss, the creation of environmental catastrophes, and the introduction of widespread illness, fear and mistrust among the public.

Almost any disease-causing organism (such as bacteria, viruses, fungi, prions or rickettsiae) or toxin (poisons derived from animals, plants or microorganisms, or similar substances produced synthetically) can be used in biological weapons. The agents can be enhanced from their natural state to make them more suitable for mass production, storage, and dissemination as weapons. Historical biological weapons programs have included efforts to produce: aflatoxin; anthrax; botulinum toxin; foot-and-mouth disease; glanders; plague; Q fever; rice blast; ricin; Rocky Mountain spotted fever; smallpox; and tularaemia, among others.

• a conventional rocket is much more effective and cheaper (happened at least 3 times of the top of my head) Nov 4 '14 at 19:09
• @ratchetfreak: Yes, many aircraft have been attacked with conventional rockets, missiles and bombs. But my question is about CBRN and informational attacks.
– A E
Nov 4 '14 at 19:56
• and a conventional rocket uses chemical explosives, so it's technically a chemical weapon ;) Many also use radiation of some sort (IR, radar, etc.) to home in on their target... Nov 5 '14 at 8:02
– A E
Nov 5 '14 at 9:47

What immediately comes to mind is the Lockheed XF-90, an early US jet fighter, which had a very strong and heavy airframe. For that reason, the second prototype (of only two ever built) was subjected in 1952 to three nuclear bomb tests in the Nevada desert (not in flight, however. It was sitting on the ground).

At this time, an unguided nuclear-armed air-to-air missile, the Douglas AIR-2 Genie, was developed and tested once in 1957. Several USAF officers were standing below the test spot, but no aircraft were used as targets. The missile was fired by an F-89 Scorpion and could be carried by the F-101, the F-104 and the F-106.

The purpose of the AIR-2 was to attack tight formations of Tupolev Tu-4 bombers in the days before guided SAM missiles were available.

I am sure the Russians had their own score of nuclear tests on aircraft, but I do not know anything specific.

• but what is the point of it? A plane is too small of a target, a SAM missile is more than enough to shoot down a jet. Nov 4 '14 at 20:22
• @TaherElhouderi simple. Shoot a 1kt nuke in the general direction of a formation of bombers, explode it in the middle of the formation, and you kill all of them. No need for complex guidance systems (which were in their infancy at the time, large, cumbersome, unreliable, and heavy). Nov 5 '14 at 8:04

I've found a few instances myself:

As part of the Litvinenko case:

During the investigation into his death it was learned that a number of British Airways aircraft that flew between Moscow and London had been contaminated with the radioactive material [Polonium-210].

... 33,000 passengers potentially exposed ... very low traces ... the risk to public health proved to be low

Information Security

In theory, a hacker could use a plane's onboard WiFi signal or inflight entertainment system to hack into its avionics equipment, potentially disrupting or modifying satellite communications, which could interfere with the aircraft's navigation and safety systems, Santamarta said.

He acknowledged that his hacks have only been tested in controlled environments, such as IOActive's Madrid laboratory, and they might be difficult to replicate in the real world. Santamarta said he decided to go public to encourage manufacturers to fix what he saw as risky security flaws.

Representatives for Cobham, Harris, Hughes and Iridium said they had reviewed Santamarta's research and confirmed some of his findings, but downplayed the risks.

it's possible to take control of aircraft flight systems and communications using an Android smartphone and some specialized attack code.

Hugo Teso, a security researcher at N.Runs and a commercial airline pilot, spent three years developing the code, buying second-hand commercial flight system software and hardware online and finding vulnerabilities within it. His presentation will cause a few sleepless nights among those with an interest in aircraft security.

Teso's attack code, dubbed SIMON, along with an Android app called PlaneSploit, can take full control of flight systems and the pilot's displays. The hacked aircraft could even be controlled using a smartphone's accelerometer to vary its course and speed by moving the handset about.

"You can use this system to modify approximately everything related to the navigation of the plane," Teso told Forbes. "That includes a lot of nasty things."

However, the FAA issued a response in a statement to journalists:

The FAA is aware that a German information technology consultant has alleged he has detected a security issue with the Honeywell NZ-2000 Flight Management System (FMS) using only a desktop computer.

The FAA has determined that the hacking technique described during a recent computer security conference does not pose a flight safety concern because it does not work on certified flight hardware.

The described technique cannot engage or control the aircraft’s autopilot system using the FMS or prevent a pilot from overriding the autopilot. Therefore, a hacker cannot obtain “full control of an aircraft” as the technology consultant has claimed.

as did the EASA:

For more than 30 years now, the development of certifiable embedded software has been following strict guidance and best practices that include in particular robustness that is not present on ground-based simulation software.

and equipment manufacturer Rockwell Collins:

Today’s certified avionics systems are designed and built with high levels of redundancy and security.

The research by Hugo Teso involves testing with virtual aircraft in a lab environment, which is not analogous to certified aircraft and systems operating in regulated airspace.

FAA and security researchers at odds over airplane hack security, Sophos Naked Security, 16 April 2013

Information Security (?) - drone

Iran claims to have caused a US drone to land through a cyber-attack, in Dec 2011.

ISTANBUL, TURKEY — Iran guided the CIA's "lost" stealth drone to an intact landing inside hostile territory by exploiting a navigational weakness long-known to the US military, according to an Iranian engineer now working on the captured drone's systems inside Iran.

Iranian electronic warfare specialists were able to cut off communications links of the American bat-wing RQ-170 Sentinel, says the engineer, who works for one of many Iranian military and civilian teams currently trying to unravel the drone’s stealth and intelligence secrets, and who could not be named for his safety.

Using knowledge gleaned from previous downed American drones and a technique proudly claimed by Iranian commanders in September, the Iranian specialists then reconfigured the drone's GPS coordinates to make it land in Iran at what the drone thought was its actual home base in Afghanistan.

http://www.csmonitor.com/World/Middle-East/2011/1215/Exclusive-Iran-hijacked-US-drone-says-Iranian-engineer-Video

US confirms the drone was downed but does not confirm a successful cyberwarfare attack.

http://en.wikipedia.org/wiki/Iran%E2%80%93U.S._RQ-170_incident

• I'm pretty sure that in-flight WiFi systems and IFE systems are not connected to flight control or other avionics systems in any way that could possibly allow the avionics to receive commands from them. I don't think such a design would ever be certificated. Dec 2 '14 at 8:36
• @eirab, you're certainly right that they shouldn't be. But by their nature infosec exploits are unintended and unforeseen. In this presentation, security researcher Hugo Teso lays out what he claims is a working exploit. If you're a pilot then I'm sure details of the various aircraft systems involved will be clearer to you than to me. I believe example code has been passed to the EASA (etc) but not publicly released (for obvious reasons).
– A E
Dec 2 '14 at 11:28
• See the Update section of this article for the full quote from the FAA: businessweek.com/articles/2013-04-12/… Dec 2 '14 at 14:50
• – A E
Dec 2 '14 at 14:58
• Based on nakedsecurity.sophos.com/2013/04/16/airplane-hack-security-faa the agencies seem to be saying that although the hack works on simulators it wouldn't work on actual real-world planes.
– A E
Dec 2 '14 at 15:01