Slashdot Mirror
US Government Probes Airplane Vulnerabilities, Says Airline Hack Is 'Only a Matter of Time' (vice.com)
Joseph Cox, writing for Motherboard: U.S. government researchers believe it is only a matter of time before a cybersecurity breach on an airline occurs, according to government documents obtained by Motherboard. The comment was included in a recent presentation talking about efforts to uncover vulnerabilities in widely used commercial aircraft, building on research in which a Department of Homeland Security (DHS) team successfully remotely hacked a Boeing 737.
The documents, which include internal presentations and risk assessments, indicate researchers working on behalf of the DHS may have already conducted another test against an aircraft. They also show what the US government anticipates would happen after an aircraft hack, and how planes still in use have little or no cybersecurity protections in place.
"Potential of catastrophic disaster is inherently greater in an airborne vehicle," a section of a presentation dated this year from the Pacific Northwest National Laboratory (PNNL), a Department of Energy government research laboratory, reads. Those particular slides are focused on PNNL's findings around aviation cybersecurity. "A matter of time before a cyber security breach on an airline occurs," the document adds.
The documents, which include internal presentations and risk assessments, indicate researchers working on behalf of the DHS may have already conducted another test against an aircraft. They also show what the US government anticipates would happen after an aircraft hack, and how planes still in use have little or no cybersecurity protections in place.
"Potential of catastrophic disaster is inherently greater in an airborne vehicle," a section of a presentation dated this year from the Pacific Northwest National Laboratory (PNNL), a Department of Energy government research laboratory, reads. Those particular slides are focused on PNNL's findings around aviation cybersecurity. "A matter of time before a cyber security breach on an airline occurs," the document adds.
So passengers can use WiFi while on board. Duh.
The real question is "why is the cockpit navigational equipment connected to the Internet," and the answer is "it isn't." Nor is the autopilot on most designs.
who said the attack was via internet? planes act on received radio signals, have internal signal buses, etc.
First, all pilots are trained to fly the airplane manually, with all air surfaces controlled by hydraulics on most aircraft. Electric motors are also connected to these hydraulics to allow the autopilot to fly the airplane, but as a convenience. Pilots are supposed to know how to fly the airplane without the use of the autopilot and by using radio signals received by VORs (radio-directional beacons) in order to navigate using a paper chart (or an iPad with a chart on it).
That Air France Flight 447 went down was not due to "poor training" or because of a lack of ability to detect a cyber-attack, but because the copilot in that airplane panicked and pulled when he should have pushed. (Frankly his mistake was a rookie mistake that student pilots are supposed to unlearn within the first 20 hours of training.)
Now are there attack vectors which can be used to sabotage an airplane? Absolutely--but they're not the "I plugged the laptop into the network and hacked the airplane's firewall" variety, since most aircraft (certainly the 737) run parallel networks--with the avionics physically disconnected from the entertainment and WiFi systems used by the passengers.
Attack vectors would be for a passenger or someone on the ground to jam and spoof GPS signals, and to jam and spoof directional VOR and ILS transmissions, to fool the navigation equipment on the aircraft to think it's somewhere it's not. Another attack vector is jamming and overriding the air traffic voice and text communications by someone spoofing air traffic control.
The problem is exacerbated by NextGen, where aircraft broadcast their GPS location (rather than their location being detected by ground-based radar), so it makes it harder for Air Traffic Control (who watches all commercial aircraft like a hawk, alerting pilots if they deviate from their flight plan) to determine if someone has gone off course. And of course the problem is made worse by inattentive pilots who often sit around the cockpit bored when they are supposed to be monitoring the navigational equipment to make sure it looks correct. (Remember when two pilots flew off course because both of them fell asleep at the wheel?)
But onboard cyber-attacks? Puh-lease...
The solution to all of this is the solution first taught to student pilots flying their first Cessna 172: fly the damned plane. Left hand on the yoke, right hand on the throttles, both feet on the rudders, and do that stick-and-yoke thing so many of them have forgotten because they think the computer is the best pilot in the cockpit.
If I had my way, the first thing I'd mandate is that all commercial pilots--including those flying the largest A-380 airplanes--spend at least a few hours a month flying the same Cessna 172 they learned in. That way they remain viscerally connected to flying by stick and yoke--and when the computer acts up, as it always seems to do at the worst moment in the cockpit, you can still look out the window, see that piece of cement in the distance, and put the airplane down where it's supposed to go.
Autopilot systems are generally designed to allow the pilot--with sufficient force--to override the autopilot motors in the event the autopilot acts up.
(I once flew a DA-40 whose autopilot decided a hard left turn was the right answer--it took a little upper-body strength, but not a lot, to force the plane from flipping over while I reached for the breaker to turn off the autopilot. Same principle applies in large aircraft like 737s, and that's by design.)
Obligatory DEFCON Talk
https://www.defcon.org/images/defcon-22/dc-22-presentations/Polstra/DEFCON-22-Phil-Polstra-Cyber-hijacking-Airplanes-Truth-or-Fiction-Updated.pdf
I thought this was 23 but it was actually 22. Getting old.
Future is promising https://imgur.com/gallery/AN8X... :D
I did not say the pilots were rookies. I said the copilot made a rookie mistake:
I notice you didn't quote the relevant part of the Wikipedia article:
Rookie mistake. (1) You always clearly announce who is in control of the aircraft. Generally this is announced by one pilot saying "my controls", and the other responding "your controls." Two pilots trying to do the opposite action is rookie mistake number 1.
(1) When the aircraft is in a stall, it's because insufficient air is flowing over the wing, and the wing cannot provide lift. This is solved by pushing the nose down, allowing the aircraft to regain airspeed. Bonin, the co-pilot, was pulling the stick back, which can only be read as that he panicked, and forgot training he should have learned while learning how to recover from stalls waaaaaay back when he first started learning to fly and got his basic pilots certificate. The pilot pulling when he should push is rookie mistake number 2.
On top of all of this, your assertion:
Are you asserting flying is too hard for humans? Because that would worry the fuck out of me. Or are you asserting flying commercial jets is hard? Because there I'd completely agree with you; the most complex thing I've flown is a single-prop high-performance retractible out of a Class C airport in IFR, and the idea of flying a jet is intimidating as hell. But then, that's why the guys who fly commercial jets get additional training: to learn how to keep ahead of these highly sophisticated beasties.
The point of my recommendation is to connect the pilot back to all of the stick and rudder skills, including proficiency in handling stalls as well as smooth stick and rudder operations. The corporate landing mandate can be handled by taking over on the final approach, but I want the guy to be able to hand fly the airplane and demonstrate proficiency in stick and rudder skill (including shit you don't want to do with passengers, such as side slips and power-on and power-off stalls).
Remember, the guy who managed to put down the Gimli Glider (Air Canada Flight 143) happened to also be an experienced glider pilot, so by accident he happened to be in the right place at the right time.
I don't like luck.
I'm going to hack into the plane's system, and have the PA system play "Never gonna give you up" on repeat for the entire remainder of the flight.
Are you talking about UAL-262, a DC-10 where the failure of the rear engine took out all three hydraulic systems? It still landed (sort of, in two pieces, in a farmers' field) because the pilots could use the throttles to control the aircraft.
That Air France Flight 447 went down was not due to "poor training" or because of a lack of ability to detect a cyber-attack, but because the copilot in that airplane panicked and pulled when he should have pushed. (Frankly his mistake was a rookie mistake that student pilots are supposed to unlearn within the first 20 hours of training.)
This is a gross oversimplification of what happened. A US pilot and airline safety expert wrote a book on the crash and his conclusion was that the junior co-pilot in charge of the plane reacted exactly as he was trained but there were issues with the training. It's a really complex situation regarding the crash. The pilot would almost certainly not have made the mistake that crashed the plane but he got 1 hour of sleep the night before and took his break early due to being tired. Inexplicably he put the most junior of the 2 co-pilots in charge. There''s been some thought that the senior of the 2 co-pilots would have safely flown through the storm had he been placed in charge. Also, the faulty air speed indicators weren't replaced in Brazil, where I have no doubts that a competent replacement could have been done, because Air France wanted the plane flown to France to do the work there because the French are control freaks to the n-th degree and they don't trust anybody else to do technical work.
The crash was due to an amazing set of circumstances where EVERY decision made in a long chain of events was wrong starting with some instrument setting failures before the plane even took off. This all enabled the plane to get into alternate law mode, which neither of the 2 co-pilots realized in time had happened. The plane crashed because in alternate law mode the plane allows the pilot to do anything, including things that could crash the plane, and junior co-pilot put the plane into a stall due to failure of his training to account for the situation he actually found himself in. His thinking got screwed up and he pulled up on the stick to try to climb, which actually put the plane into a stall that nobody noticed. There were also some design issues with how Airbus designed the plane's control sticks and audio warnings and the 2 co-pilots failed to fully understand that the Airbus design decisions were odd and had to be accounted for.
Well, of course it was a gross oversimplification; I summed up a chain of events and circumstances and training and inputs and actions that can trace their roots back minutes, and even hours, back before the actual crash took place, into two pithy sentences.
But at the bottom of the stack, the airplane hit the water in a nose-up stall, having held the nose-up stall for several minutes as the plane descended from 30,000 feet to sea level. The plane hit the water in a nose-up stall because the co-pilot was pulling up on the yoke--countermanding the inputs from the pilot, without indicating who was in charge of the airplane. And the airplane maintained a nose-up stall through several minutes because the co-pilot was putting the wrong inputs on the controls, in almost complete contradiction to all the training he received--since there are no slow-speed aircraft attitudes where recovery is achieved by pulling the nose up. Zero. None. The only time you pull the yoke back to recover the aircraft is either (a) if you have an indication that you are going too fast, or (b) you're panicked and are trying to gain altitude. If you have the yoke up and the altimeter is unwinding, the hardest god damned thing in the world to do is the thing that will save your life, the thing the pilot of that aircraft was trying to do but the thing the co-pilot refused to try, is to push the nose down.
Now how we got to here--that's important. And probably more important than the co-pilot making a rookie mistake--because if we stop with "the co-pilot is an idiot", rather than trying to determine if there is something more we can do to assure greater safety in commercial flight, we've basically thrown up our hands and said "sometimes people die."
And that is unacceptable.
(Frankly, by the way, I wish more organizations or corporations thought like the FAA--which, when faced with pilot error, tries to understand why there was pilot error. They try to figure out if it was information overload or improper inputs or inattentiveness or improper training. They try to figure out how we can make flying safe, even with imperfect pilots and imperfect equipment.)
Now, I had a CFI who once told me that the people he hated the most to give checkrides to were commercial pilots. Because none of these guys have really had to do any real stick-and-rudder work since they first started working for the large commercial airlines. One of the scariest thing he's ever done is to give a particular older pilot--retiring from the airlines and who bought his own little 4 seater prop airplane to continue to tool around in the air--a quick refresher in stalls. Because this guy seemed hell bent on doing exactly the wrong thing when the airplane started to buffet in that prelude to a stall, once nearly putting the aircraft into a fatal spin because he simply didn't know how to use the rudder.
It's why my wish is for all commercial pilots to spend some time each month in a Cessna 172, practicing things like power-on and power-off stalls.
Because I honestly and sincerely think if that co-pilot had recent experience with stalls, rather than (as is typical for a lot of those bus drivers) not having done stall work or rudder work for perhaps a decade or more, the 216 people who died aboard Air France 447 would be alive today.
On an airbus plane in normal law they are trained that the airplane will not allow them to stall and they can pull back all they like. So when the pilot sees indications that the plane is descending he pulls back, expecting the airplane to do whatever it needs to maintain controlled flight and eventually climb.
The problem is that when you lose normal law and go into direct law the airplane doesn't have the stall protections so you have to remember to push forward until you get the airspeed.
The fundamental problem is that because of all the protections built in Airbus airplanes pilots fly the plane differently when in normal law vs when things go bad and they go into direct law.
Flying in direct law is a 1X10^-9 probability event so when it does happen noone is ready for it.
Nope, you misunderstood the explanation for the crews reactions.
Firstly, the aircraft was in a data mismatch situation - it couldn't trust the information it was being given by external sensors, so it hands control back to the crew who have a standard check list for such a situation.
What the crew should have done was ride throttle and stick, increasing throttle with a slightly nose up attitude until the sensors became trustworthy again.
What they did was pull back on the stick and slow the aircraft down, giving it very little forward velocity but significant downward velocity - this just confuses matters even more with regard to data.
During all this, the sensors became trustworthy again, but the aircraft was now in a situation where the crew simply didn't believe the data they were being give, even though it was correct.
Below a certain forward velocity and high angle of attack, stall warnings on all aircraft cease to sound because it's an insane situation which should never happen - by pushing down on the stick, the crew were actually activating the stall warnings by increasing the airspeed back past the minimum threshold for it sounding, but they were convinced that they were actually achieving the opposite, slowing the aircraft down so the airspeed dropped to the upper threshold for the warning. So they kept the nose up, and induced an aerodynamic stall - exactly what they thought they were avoiding.
The angle of the airflow over the wings was at more than 35 degrees, which is far beyond that needed for an aerodynamic stall.
The same year that AF447 crashed due to an airspeed data mismatch, there were over 100 other incidents on Airbus aircraft of the same thing - but only AF447 crashed. All the other crews had no issues with the Airbus approach.
And Airbuses rate of airspeed errors in this area are almost identical to Boeings year on year - if the crew properly follow their training, it's a non-issue. In whatever aircraft you are flying.
The data mismatch situation only lasted a minute, but the crew ignored the instruments from the point of autopilot disconnect until impact.
It's worth noting that the Captain, Marc Dubois, *did* realise what was wrong when Bonin told him "I've been at maximum nose up for a while", but at that point the aircraft was seconds away from impact, and Dubois had only been back in the cockpit for a minute or so - Dubois is heard on the voice recorder saying "no, don't climb!"
The two co-pilots lost situational awareness and failed to follow guidelines.
No fly by wire system is updateable
Not true. Having worked at Boeing, I've seen numerous systems updated by plugging a laptop into the controller and uploading a new s/w version. With some, you do have to pull the box, open a cover and access a port (JTAG). But at the other end of the spectrum, 787 systems can be accessed over the on-board network.
Boeing applied for and received approval from the FAA to allow connection between passenger entertainment and avionics networks on the 787. Now all that one needs to do is to upload a malicious app into the video and game processor. One third party vendor has already sued to gain permission to sell their entertainment apps directly to airlines to be run on onboard systems. So, we are practically there.
Have gnu, will travel.
Not really. The 'firewall' is an enhancement to Ethernet that checks packet sources against a list of 'approved' hardware MAC addresses. But if you cat trick the passenger entertainment equipment into running Evil applications, you are in the system talking to the avionics.
Have gnu, will travel.