Is an airplane "hackable?"
 

If I was an evil-doer, say someone like a North-Korean hacker or ISIL/AQ terror guy bent on destruction of the West, I might want to gain control over an aircraft's control system. Is this something that can be done through hacking? Are such systems at all connected to the internet?

Definitely.

(OP reported to appropriate authorities because of what he's planning)

LOL. When you say "Definitely," is this based upon knowledge of the systems, a guess, or are you just jesting? More information would make your comment more appreciable.

Please continue to follow this thread in the Travel Technology Forum
Thanks....
Obscure2k
TravelBuzz Moderator

Any computer system is hackable.

To this day, I think the Malaysian Airlines flight, that went missing, was stolen. Hacked? Perhaps not, but I think stolen is possible. Now feel free to tell me to stick my tinfoil hat where the sun don't shine :D.

If you can get to it. Aircraft are not "online".

Indeed, basic security. I would also expect to find the IFE system is totally divorced from the avionics package, or the interface is so basic that it's not hackable, so no, you can't plug your iPad into the IFE system and upload a virus. Real life is not a Roland Emmerich movie :)

Correct. The most basic (and perhaps most effective) security there is.

Also correct. IFE isn't a part of, say, the FMS or EICAS. The closest they get is that they (occasionally) share a power supply (GenX, APU, GPU, etc). However I be willing to bet the IFE does NOT work on battery or ADG power (i.e. emergency sources).

True, but it doesn't have to be online for it to happen. Someone (like maintenance) could plug in a rogue USB thumb drive or something that is otherwise infected - see the famous Stuxnet virus, which infiltrated an airgapped (not network connected) Iranian nuclear facility.

Most of the avionics packages in those airplanes are somewhat old and cannot be directly attached to a thumb drive. Even in the newer glass-panel aircraft, the entire system has to be physically removed. The primary driver for this is security and stability - you really don't want to have something that hasn't been tested and re-tested guiding an airplane on a long (or even short) flight in questionable weather.

Experience: Software Engineer, LSRM, Experimental Aircraft Builder (helped with my own avionics packages)

Allow me to play devil's advocate. :) Aircraft are in communication with the airlines' maintenance facilities, right? Is it two way communication or is the aircraft only capable of sending information, not receiving it?

I too thought aircraft weren't online in the usual sense, but then thought of this...

is youR "theskunk" moniker related to Skunk Works? ^

It's next to impossible, arguably impossible (but I guess nothing really is). There's someone on the AC FT board who works directly in this line of work. PM Jaysona if you have questions, he might answer as long as you guys don't pile all your questions on him!

I feel like I just heard three snaps in a Z-like fashion...

That's all I need but good Q by OP bc I had wondered the same

To follow up on an earlier comment, I have always thought that the first MH 777 was stolen, a la Ian Fleming's Thunderball.

Take the plane way up, asphixiate everyone but the pilot, take the plane down low heading west over the Indian Ocean to avoid radar, then turn somewhere and land the plane.

Now people have all the time in the world to examine a fully functioning aircraft. Forget just tacking the avionics; they can try to hack an entire plane, looking for ANY way to bring it down.

Recalling a (quite mediocre) novel I've read some time ago, a man-in-the-middle attack against the field bus *could* be imaginable.

While I don't know anything about field bus protocols used in aviation (and whether commands sent over the bus are signed or otherwise authenticated), I would probably not attack the avionics software (or the hardware it's running on).

The avionics systems themselves don't "fly" the aircraft, they only calculate commands that are used as inputs to servos, hydraulic valves and the like. What if someone (for example, a mole in engineering) plugs in some obscure device between the bus controller and the actuator (or replacing the bus controller for one or several actuators), manipulating the commands executed by the actuator?

This should be enough to render an aircraft uncontrollable by the pilots. Of course this is nothing that could be done by plugging an iDevice somewhere into the plane..

Presumably with the move to more sophisticated bi-directional aircraft reporting systems like ADS-B IN it's only a matter of time.

Googling 'Remote Control Boeing' brings up some interesting articles about legitimate attempts to do this.

What about with the Wifi systems?

Those cost a lot to install. Maybe something thought why not hook it up to some of the avionics?

The other thing is that airliners can supposedly be flown remotely. Of course in fiction, such systems can be hacked, like the last season of 24 where terrorists get control of US drones and send them to London.

Pure fiction.

Everything to do with commercial aviation is expensive.. US$5000+ for a sticker for a rolls-royce engine is one example I've heard of.

Big difference between remotely controlling a drone that is designed to be remotely controlled, and remotely controlling an aircraft that's designed to have a meat puppet at the controls.

Yikes!

Reminds me of an old Dave Barry bit where he says the Pentagon is unable to purchase anything that costs less than a condo in Vail. If the Pentagon needs fruit, for example, it will argue that it must have fruit which can withstand the rigors of combat and will procure the FX-7000 Seedless Tactical Field Grape, which will cost $183,000 per bunch and have a failure rate of 60%.

:)

The IFE often has map data on it, showing position, altitude, speed, distance to destination, etc. I wonder whether it comes from an independent GPS, or from avionics? I seem to recall that on past flights, the heading at the gate was correct (also while being towed in reverse), which tends to indicate this does not come from GPS. So maybe there is a connection between avionics and IFE? Hopefully, it is a very unidirectional connection!

Even on the personal use terrestrial versions of a RR engine, I can assure you it is pretty expensive to have work done on the engine or the passenger carrying bodywork too ;)

As they say ... "If you need to ask, you can't afford it" :D:D

While aircraft are not directly connected to the internet, newer model A/C like the 787 have software update capability either through in internet or via a USB type thing. Compromise that and you're good to go.

Given the vast numbers of different programming languages in avionics data busses (ARINC 429,615,629,664.7,708 etc etc etc) I highly doubt it possible. The IFE is not directly linked to FMCS or GPSs but receives data reform an intermediary within the avionics architecture....that operates on a different ARINC comms bus. If it could be done it no doubt would already have been done. Such is the world.

FWIW:

http://www.independent.co.uk/life-st...e-8569117.html

Happy Holidays!

Remote avionics disablement even of military fighter jet equipment has been possible under some circumstances even in the days when Al Gore was still in the US Senate as just one of the two U.S. Senators from Tennessee. Just saying.

Interesting.

One of the advantages of the US Air Force is the modern avionics in the aircraft.

Wonder Russians and Chinese don't try to hack them in addition to US businesses and govt networks.

Who says they don't?

True.

I guess we won't ever know until we get into a war with one of these countries.

But there are a lot of countries which have been defeated in large part due to US air supremacy in various theaters. Surprising that nobody looked for a way to hack or hire Eastern European hackers to try.

Here's my scoop as an engineer, it's not possible. We still guide jets around with missiles if they go rogue into another part of the country. If such an aircraft was hijacked by a man, they can't call the nearest OnStar and say to safely guide it. They just do not have the systems in place to do so.

Most aircraft still run on cables, pulleys, and highly reliable computers that are way behind on technology. I say highly reliable considering cars cannot have that newest and the greatest GPU, CPU, and motherboard from Tiger Direct. It has to be reliable since it is carrying human lives, now apply that to an airplane. No, aircraft are not up to date with today's technology of wifi and satellite downlink of high amounts of data to the on-board controls. It is more than likely MH370 was 20+ years old running on the usual fly by cable and pulley system.

Boeing -- and parts that have become or were part of Boeing -- have been the target of hacking efforts, some of which worked ... at least for more mundane kind of hacking. Same goes for other aeronautical and parts engineering companies in this space.

Rather than requiring an Internet or other network connection for a disabling hack, there are other ways to design disabling features in the hardware and/or software systems that can work without an online computer to computer network connection

I guess if the Terminator movies were made now, they wouldn't try to go back in time to prevent Skynet from being made.

They'd try to hack it, though that's not as sexy as all the action scenes.

The best attack vector would probably be engineers or maintenance laptops which are connected to the aircraft control systems for diagnostic, repair and upgrades - similar to how Stuxnet worked.

(P.S - Hi! Long Time Lurker, first time poster)

The greatest danger is not hacking the plane, but hacking the navigational systems that the plane relies on. It is trivially easy to hack signals from GPS, FAA NextGen (ADS-B), and ACARS.

The good thing is the redundancy of pilots in the cockpit. They know what the plane should be doing and where it is going, and will notice things like bank angle changes and altitude changes.

The In Flight Entertainment systems are not permitted to be connected to the flight control and management systems, or else the IFE must be certified to the level of the flight management/control systems. So there's an economic disincentive to connect the two.
Plus in IFE WiFi systems are completely airgapped from the rest of the airplane.

All that said, I have seen hacking systems that can even defeat an airgap to gain information (I have not seen one yet to push information), so I will never say that it cannot be done. It's just going to be very, very hard. Especially as there are so many versions of the various FMSs and FCSs in the wild, so you would have to attack one specific block of one specific model, with one specific carrier's specs.

Thank you for your insights. It is reassuring to know that it would be very difficult. I would assume, however, that if a state-sponsored terrorist or well-organized AQ-type group devoted the resources to it, they would identify a specific type of plane and carrier, and then go "all-in."

GAO issues report citing cybersecurity experts on the vulnerabilities of airliners:

http://arstechnica.com/security/2015...nk-to-hackers/