Risk Assessment / Security & Hacktivism

Hacking commercial aircraft with an Android App (some conditions apply)

Comms system used in the aviation industry contains no security, researcher says.

As if inexpensive attacks on mission-critical global positioning systems weren't enough, a researcher said he's developed an Android app that could redirect airplanes in mid-flight.

The frightening scenario was presented on Wednesday at the Hack in the Box security conference in Amsterdam. It's made possible by security weaknesses in the protocol used to send data to commercial planes and in flight-management software built by companies including Honeywell, Thales, and Rockwell Collins, Forbes reports. Vulnerable systems include the Aircraft Communications Addressing and Report System used for exchanging text messages between planes and ground stations using VHF radio or satellite signals. It has "virtually no authentication features to prevent spoofed commands."

Using a custom-developed Android app dubbed PlaneSploit, researcher Hugo Tesa of N.Runs showed how a virtual plane in a laboratory could be redirected. Because there's no means to cryptographically authenticate communications sent over ACARS, pilots have no way to confirm if messages they receive in the cockpit are valid. Malformed messages can then be used to trigger vulnerabilities, Tesa told Forbes.

A Honeywell spokesman told reporter Andy Greenberg that the company is taking the research seriously. But the spokesman went on to say there's a difference between exploiting something in a lab and doing it in a real-world environment. Because the researcher used a publicly available PC simulation program, the flight-management system he exploited "doesn't have the same protections against overwriting or corrupting as our certified flight software," he said. An N.Runs researcher countered that vulnerabilities in the flight-management software weren't related to the simulation program and would also be found in equipment used in real planes.

In any event, Tesa admits pilots could still override malicious commands by taking manual control of a plane. That still wouldn't prevent hackers from performing disruptive stunts such as causing a cockpit's lights to blink or passengers' pressurized air masks to drop.

Tesa has some helpful descriptions of some of the vulnerable equipment here.

Expand full story

You must to comment.