Picture this: A terrorist armed not with weaponry but with their laptop. They hack into a commercial airplane's systems while hundreds of people are midair and seize control from the pilots. They steer it toward an unthinkable fate.
This isn't an attack that can only exist in the lofty world of fiction. It's a potential reality in the world of aviation cybersecurity. If we don’t design our systems securely, something of this nature could happen. The critical question is: How close are we to this scenario becoming a reality?
Think of an aircraft as a flying nexus of sophisticated systems–each a potential doorway for intrusions. Despite robust engineering focused on safety, no system is unbreakable. The immense complexity of a plane’s many instruments and its complex network just adds to the risk. Let’s take a look at some of the major issues:
Automatic Dependent Surveillance-Broadcast (ADS-B) system
The Automatic ADS-B system, crucial in modern air traffic management, is implemented in countries like the United States, Australia, and parts of Europe. Its primary vulnerability lies in the lack of encryption and authentication of ADS-B messages. This flaw could, in theory, allow for the injection of false aircraft positions or misleading information. Due to the lack of encryption, anyone can read the messages. The lack of authentication means that any message needs to be double-checked with radar to confirm a plane’s position.
In-flight entertainment systems (IFEs)
Unlike other more secured networks within an aircraft, IFEs are readily accessible to anyone on the plane, making them a more vulnerable target. They are within easy reach of any passenger, raising the question of whether they could be manipulated to compromise an aircraft's critical systems.
Thankfully, the flight control systems are supposed to be isolated from the IFEs, so even if a hacker does manage to hack into the entertainment system, they cannot use this foothold to take over the plane.
Has anyone hacked a plane?
The story of cybersecurity analyst Chris Roberts has become somewhat legendary in the world of aviation cybersecurity. According to a search warrant filed by the FBI, Roberts claimed to have hacked into the in-flight entertainment system on multiple occasions between 2011 and 2014, once causing an airplane to climb and resulting in lateral movement of the plane.
He reportedly did this by accessing in-flight networks through an Ethernet cable connected to a box under the passenger seat. This is a strange story, because we just told you that the flight control systems are supposed to be isolated from the IFEs.
So what happened?
It’s hard to tell. Roberts’ statements to Wired are different from those in the warrant application:
“Roberts had previously told WIRED that he caused a plane to climb during a simulated test on a virtual environment he and a colleague created, but he insisted then that he had not interfered with the operation of a plane while in flight.”
It seems likely that at least some details in the warrant application are incorrect. Numerous experts have come out and claimed that the systems are in fact isolated, and that it would be impossible for Roberts to have jumped from the IFE to the flight control systems.
Another well-known incident involved researcher Ruben Santamarta, who reported vulnerabilities in the Boeing 787 Dreamliner. In a blog on his company’s website, he claimed that:
In-flight entertainment systems may be an attack vector. In some scenarios such an attack would be physically impossible due to the isolation of these systems, while in others an attack remains theoretically feasible due to the physical connectivity. IOActive has successfully compromised other electronic gateway modules in non-airborne vehicles. The ability to cross the “red line” between the passenger entertainment and owned devices domain and the aircraft control domain relies heavily on the specific devices, software and configuration deployed on the target aircraft.
Boeing, however, refuted the practicality of these claims, stating that their testing in both lab and real-world environments found existing defenses sufficient to prevent such scenarios. The FAA also worked with Boeing to assess these claims and was satisfied with the Boeing's assessment.
It’s hard to give an independent assessment of the reality without delving deep into the network configuration. If we take Ruben Santamarta at his word that it is “theoretically feasible”, it seems likely that it’s still not a practical attack. Neither Boeing nor the FAA want planes to be downed in cyberattacks, so it seems unlikely that they would leave gaping vulnerabilities in between the IFE and the flight control systems.
So, is it really possible?
Considering the complexities of modern aircraft systems and the cybersecurity measures in place, the probability of successfully hacking a plane is extremely low. While vulnerabilities do exist and high-profile claims like those of Chris Roberts stir the pot, the reality is that exploiting these systems to gain control of an aircraft is incredibly difficult. The aviation industry is always working on its cybersecurity to reduce these risks.
While the theoretical risks cannot be entirely dismissed, the practicality of such cyberattacks is still in doubt. Thankfully, aviation is one of the industries where we tend to err on the side of caution.
