Slashdot Mirror
Planes Can Be Hacked Via Inflight Wi-fi, Says Researcher
wired_parrot writes In a presentation to be shown Thursday at the Black Hat conference, cybersecurity consultant Ruben Santamarta is expected to outline how planes can be hacked via inflight wi-fi. Representatives of in-flight communication systems confirmed his findings but downplayed the risks, noting that physical access to the hardware would still be needed and only the communication system would be affected.
... but only by using Python.
THL phish sticks
Is it as Ruben Santamarta says, that the plane's satellite communications system can be hacked into via the plane's wifi? Or is it as the manufacturers say, and the hacker would have to have physical access to the hardware and couldn't do much of anything anyway? There's two very different points of view here and I'm not sure how they're supposed to meet up.
Are cellphones better than guns at hijacking planes now? At least they can replace the communication stream and take advantage of whatever that might follow.
They did not get into the aircraft avionics.
They got into the satellite communications for the Infotainment system.
NONE of the systems like that have any interconnection to avionics or telemetry.
Do not look at laser with remaining good eye.
Quick, get Samuel L. Jackson on the phone.
I smell a blockbuster movie in the works!
If telephones are outlawed, then only outlaws will have telephones.
...then I don't care. Very simple question; can you get to the avionics of the plane through the WiFi? If you can that's poor system design and someone should be beaten with a wet noodle; if you can't then I don't care as the network is physically disconnected from the actual movement and functioning of the aircraft. If the best you can do is spy on the passengers of the aircraft through the WiFi or use the WiFi without paying then I don't care. Anytime I log into a flight I go encrypted through VPN as you never know what's traversing a suspect network.
The actual article and any of the other information seems to be very lacking in this sense. If all you can do is break into the WiFi, congrats you got into a Internet Cafe at 33,000 feet.
... what about the passengers? Do you honestly expect them to be able to survive a multi-minute flight with no wifi or infotainment? Oh the humanity!
This alone makes the whole story implausible.
Uhm yesss....
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
Hughes spokeswoman Judy Blake said hardcoded credentials were "a necessary" feature for customer service. The worst a hacker could do is to disable the communication link, she said.
1. Are hardcoded credentials ever "necessary?" How about credentials that are generated on first boot and then requested by support?
2. Disabling the communications link for a piece of hardware whose sole purpose is communications... kind of a big deal.
[Fuck Beta]
o0t!
Given the age of most aircraft in the fleet, and the age of most FAA-approved avionics, I have a hard time believing any of the avionics used in today's fleet are capable of TCP/IP communications, much less being able to hook into the in-aircraft wifi system. Most in-aircraft wifi systems I've seen are add-ons; separate systems which only tap into the airplane's power. And the only thing in the cockpit that may tie into the wifi system is the pilot's iPad.
The article is short on details, but, in all fairness, the paper is to be presented on Thursday and presumably the details will be forthcoming.
My guess is that there are are two possibilities here:
1. The avionics and entertainment systems are connected on the same local network, and thus if one can gain control of the entertainment system(s) on might then hack into the avionics.
Q. Why might the avionics and entertainment systems be connected? One reason I can think of is so that the entertainment system can be told to shut down or partly shut down during takeoff/landing etc. Just a guess. Plus, it's just very convenient. ;) There is probably some overall "aircraft management" system that would want to be connected to everything.
2. The entertainment systems have one or more satellite communication systems themselves. The entertainment system might use SDR (Software Defined Radio) techniques, and might be re-programmed to interfere with critical onboard communication equipment.
I used to work for one of the In-Flight Entertainment (IFE) vendors. Although their "architect" was clueless about security, some of us doing the work managed to build some into the system. With WiFi, it was harder, but, before I left, we had, at least, set up some VPNs to isolate the system control links from the cabin crew- and customer-access features (don't know if that persisted). The entire IFE did rely on hard-coded passwords, though.
There IS a connection between the IFE and aircraft systems. It is used to feed aircraft position and speed data, plus some useful state, such as wheels up/down (there are features that only enabled while in "cruise", but not during takeoff and landing, for example). The aircraft systems designers, however, seemed to have a clue about security, however, as we were only allowed a network connection to a slave server with no apparent upstream links.
No I will have to hear endlessly about this completely misleading article from people who know nothing about avionics.
That you article writer and slashdot submitter for adding to technology hysteria.
This article is basically saying someone can hack your washing machine from your cable modem without any supporting evidence that is true.
It seems epically stupid that wifi access for passengers is not on a physically separate system. Something as sensitive as this should NOT be even a virtual LAN.
Story reminded me of a good Dilbert comic from back in the day.
http://www.fieldbrook.net/TechTips/Humor/Bluetooth.asp
Per a NUMBER of various regs, the avionics network is physically separated from anything that the passengers can touch.
IOW, not going to happen.
As to the passenger's network, oh yeaj, easy enough to crack that with time. Heck, Airbus uses Windows.
I prefer the "u" in honour as it seems to be missing these days.
I would guess 'not at all' based on the loss of MH370: Part of the reason it's not been found is that the plane didn't maintain any form of continuous communications.
Just gimme a smoke.... oh wait
have you seen my sig? there are many others like it but none that are the same
I don't see how you get from "no continuous communication" to "not at all" - there's an awful big gap between always and never. Admittedly though I can't think of many operations-oriented uses for such a link, other than perhaps an alternate communications channel if there are issues with the normal radio.
Also, didn't both normal communications and the transponder go dark long before the plane was lost to radar? I thought that was one of the major indicators that strongly suggested foul play. After all, communications/tracker blackout followed by repeated course changes taking it way off its scheduled flight path and into the dead spots between radar towers while apparently headed for the open ocean is practically adhering to a Hollywood hijacking script.
--- Most topics have many sides worth arguing, allow me to take one opposite you.
It did, yes - and the transponder was shut off manually. What wasn't shut off was the sat link handshake, which could only by done by physically cutting the power - something that even most pilots wouldn't be aware of.
There's no doubt that someone in the cockpit wanted the plane to disappear for a while. Without finding the wreckage (And the cockpit voice recorder) it's not possible to say who. It might have been a hijacking, or it might have been a pilot 'Taking you all with me' suicide, or might be part of some more elaborate scheme.
I'm not certain on the newest designed planes like the 787, but on all older planes the 2 data systems (aircraft data and IFE data) use seperate transponders and seperate antennas and even broadcast to seperate satellites, or in the case of air data by shortwave. Air data goes by ARINC, IFE by Row44, Gogo, etc.
This is ancient news that was debated endlessly during the MH-17 breathless cable news-a-thon, the lost airline network had this on every night.
No clickbait global warming stories today? No polarizing left wing loon right wing nutcase stories? Gee slashdot, are you on vacation too this week?
Murphy was an optimist