{"id":55326,"date":"2020-01-18T00:00:00","date_gmt":"2020-01-17T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/mozhno-li-vzlomat-samolyot"},"modified":"2020-02-18T14:03:26","modified_gmt":"2020-02-18T11:03:26","slug":"mozhno-li-vzlomat-samolyot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/mozhno-li-vzlomat-samolyot","title":{"rendered":"Is it possible to hack an airplane?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

When flying for business or leisure, have you considered how safe it is in today's world of digital threats? Some modern airplanes are referred to as flying computers, given the high level of integration of computer technologies. How are they protected against hacks? What can pilots do in such cases? What other systems might be at risk? An active pilot, captain of a Boeing 737 with over 10,000 flight hours, discussed this on his channel MenTour Pilot.<\/p>\n

\"Is<\/a><\/noindex><\/p>\n

So, hacking an airplane's systems. In recent years, this issue has become increasingly relevant. As aircraft become more computerized and data exchange between them and ground services increases, so does the likelihood of attempts at various attacks from malicious actors. Aircraft manufacturers have been aware of this for many years, but previously this information was not prominently communicated to us, the pilots. However, it seems that these issues have been addressed at the corporate level.<\/p>\n

What\u2019s the latest news?..<\/h3>\n

\nBack in 2015, the U.S. Department of Homeland Security published a report stating that they managed to hack their own Boeing 757 systems while it was on the ground. The hack used widely accessible tools that could potentially be brought through security checks. They gained access through the radio communication system. Naturally, they did not disclose which specific systems they managed to hack. Essentially, they revealed nothing except that they were able to access the aircraft. <\/p>\n

Additionally, in 2017, there was a report from independent hacker Ruben Santamarta. He claimed that by building a small transmitter and setting up an antenna in his yard, he could penetrate the entertainment systems of planes flying over him.<\/p>\n

All of this brings us to the conclusion that there is indeed some danger. So, what can hackers access, and what can they not? To understand this, let's first examine how the computer systems of an aircraft operate. The first thing to note is that the most modern airplanes are also the most computerized. Onboard computers perform virtually all operations, from positioning control surfaces (ailerons, flaps, slats\u2026) to transmitting flight information. <\/p>\n

However, it should be understood that aircraft manufacturers are well aware of this structural characteristic of modern machines, which is why they have integrated cybersecurity into their design. Therefore, the systems that you access on the back of the seat in front of you and the systems that control the flight are completely separated. They are physically separated in space, divided infrastructure-wise, and use different systems and programming languages \u2014 essentially fully separated. This is done to leave no possibility of accessing flight control systems through the in-flight entertainment system. Thus, on modern aircraft, this cannot become a problem. Boeing, Airbus, and Embraer are well aware of this threat and continuously work to stay one step ahead of hackers.<\/p>\n

Translator's note: There have been reports that Boeing 787 developers intended to physically combine these systems and create a virtual separation of networks. This would save weight (onboard servers) and reduce the number of cables. However, regulatory bodies refused to accept such a concept and insisted on maintaining the 'tradition' of physical separation.<\/i><\/p>\n

The overall picture looks a bit worse when we consider the entire range of aircraft. The operational lifespan of an airplane can reach 20-30 years. If we look back at computer technology from 20-30 years ago, it was completely different. It's almost like seeing dinosaurs walking around. So on planes like the 737 I fly or the Airbus 320, there are certainly computer systems that were not designed with sufficient safeguards against hackers and cyberattacks. However, there is a silver lining \u2014 they are not as computerized and integrated as modern machines. The systems installed on our 737 (I can't speak about Airbus, as I'm not familiar with them) are mainly intended for transmitting navigation data to us. We do not have fly-by-wire control system<\/a><\/noindex>. On our 737, the control yoke is still connected to the control surfaces. So yes, malicious actors might have the opportunity to influence the updates of our navigation systems, for example, but we would notice that very quickly. <\/p>\n

We operate the aircraft not only based on onboard GPS, but we also use traditional navigation systems, constantly cross-checking data from various sources. In addition to GPS, this includes ground radio beacons and the distances to them. Onboard, we have a system called IRS. Essentially, it's laser gyroscopes that receive real-time data and cross-check it with GPS. So if something goes wrong with one of the systems vulnerable to attacks, we would notice it very quickly and switch to another.<\/p>\n

Onboard systems<\/h3>\n

\nWhat other potential attack targets come to mind? The first and most obvious one is the in-flight entertainment system. On certain airlines, this is how you purchase access to Wi-Fi, order food, and so on. Additionally, the in-flight Wi-Fi itself can be a target for attackers; in this respect, it can be compared to any public hotspot. You probably know that using public networks without a VPN poses a risk of revealing your data\u2014personal information, photos, saved Wi-Fi passwords, as well as any other passwords, credit card details, and so on. An experienced hacker would have no trouble accessing this information. <\/p>\n

\"Is
\n
\nThe embedded entertainment system is distinct in that it constitutes an independent set of hardware components. And these computers, I want to emphasize again, are in no way connected to or interact with the aircraft's control systems. However, this does not mean that hacking the entertainment system cannot create serious problems. For example, an attacker could potentially send notifications to all passengers in the cabin, stating, for instance, that control of the aircraft has been seized. This would create panic. Or notifications about problems with the aircraft, or any other disinformation. This would undoubtedly be shocking and frightening, but it would not be dangerous in any way. Since such a possibility exists, manufacturers take all possible precautions, installing firewalls and necessary protocols to prevent such issues. <\/p>\n

So, perhaps the most vulnerable targets are the in-flight entertainment system and Wi-Fi. Moreover, Wi-Fi is usually provided by an external operator, not the airline itself. And it is this operator that takes care of the cybersecurity of the service they provide.<\/p>\n

The next thing that comes to mind is pilots' flight tablets. When I first started flying, all our manuals were in paper form. For instance, the operating manual with all the rules, necessary procedures, navigation manuals with air routes in case we forgot them, navigation and approach charts in the airport zone, airport maps \u2014 it was all in paper format. And if something changed, we had to find the right page, tear it out, replace it with the updated one, and make a note that it was replaced. In short, a lot of work. So when we started getting flight tablets, it was simply amazing. With one click, we could quickly download everything, with all the latest updates, anytime. Additionally, we could get weather forecasts, new flight plans \u2014 everything could be sent to the tablet.<\/p>\n

\"Is
\n
\nHowever, every time you connect somewhere, there is potential for third-party intrusion. Airlines are aware of the situation, as are aviation authorities. That\u2019s why we are not allowed to do everything electronically. We must have paper flight plans (although this requirement varies among different airlines), and we must also have a backup of them. Furthermore, under no circumstances are we allowed to install anything other than authorized and approved applications by the airline on the tablet. Some airlines use iPads, while others use specially designed devices for this purpose (both options have pros and cons). In any case, it is all strictly controlled, and pilots cannot in any way interfere with the functioning of the tablets. That\u2019s the first point. The second is that we are prohibited from connecting them to anything while in the air. We (at least in my airline) cannot connect to the onboard Wi-Fi after takeoff. We cannot even use the built-in GPS receiver in the iPad. Once we close the doors, we switch the tablets to flight mode, and from that moment on, there should be no options for interference with their operation. <\/p>\n

If someone somehow disrupts or interferes with the entire airline's network, we will notice it after connecting on the ground. Then we can go to the crew room at the airport, print out paper schematics, and rely on them during the flight. If something happens to one of the tablets, we have a second one. In the worst case, if both tablets fail, we have all the necessary flight data in the onboard computer. As you can see, this issue employs triple redundancy to address the same task.<\/p>\n

The next possible options are onboard control and management systems. For example, the previously mentioned navigation system and the flight management system. Again, I can\u2019t comment on other manufacturers, only on the 737 that I personally fly. In its case, the computerized systems include a navigation database which contains, as the name suggests, navigational information and terrestrial surface databases. These may undergo some changes. For instance, when the onboard computer's software is updated by an engineer, a modified or corrupted file may be uploaded. However, this will quickly surface, as the aircraft constantly self-checks. For example, if an engine falters, we see it. In such a case, we certainly do not take off and ask engineers to check. <\/p>\n

In the event of any failure, we will receive a warning signal indicating that some data or signals do not match. The aircraft continually conducts cross-checks of different sources. So if after takeoff it turns out that the database is incorrect or corrupted, we will immediately know about it and switch to what are called traditional navigation methods. <\/p>\n

Ground systems and services<\/h3>\n

\nNext is air traffic management and airports. Control services are ground-based, making them easier to hack than a moving aircraft. If, for instance, attackers somehow disable or shut down the radar of an air traffic control tower, they could switch to what's known as procedural navigation and procedural separation of aircraft. This is a slower method for directing planes to airports, so in busy ports like London or Los Angeles, it would create significant issues. However, ground services would still be able to create a 'stack' of aircraft with an interval of 1,000 feet. (about 300 meters)<\/i>, and as one aircraft passes a certain point, direct the next one for approach. This way, the airport will be filled using procedural means rather than radar.<\/p>\n

\"Is
\n
\nIf the radio system is struck, there is a backup. There is also a special international frequency that can also be accessed. Or the aircraft can be handed over to another air traffic control unit that will manage the approach. The system has redundancy and alternative nodes and systems that can be utilized if one comes under attack. <\/p>\n

The same goes for airports. If an airport is attacked and the attackers disable, say, the navigation system or runway lighting, or anything else at the airport, we will notice it immediately. For instance, if we cannot contact them or set up auxiliary navigation tools, we will see the existence of a problem, and our main flight display will show special flags indicating that the Instrument Landing System is not operational, or the navigation system is down, and in that case, we would simply abort the approach. So this situation poses no danger. Of course, we will be irritated, just like you, when we are not where we intended to be. The system is designed with enough redundancy, and the aircraft has sufficient fuel reserves. And unless this group of hackers attacks the entire country or region, which is extremely difficult to achieve, there will be no danger to the aircraft.<\/p>\n

Anything else?<\/h3>\n

\nPerhaps that's all that comes to mind regarding possible attacks. There was a report from a cyber expert at the FBI who claimed he was able to gain access to flight control computers using the entertainment system. According to him, he managed to 'influence' the plane a bit (his words, not mine), but this has never been confirmed, and no charges were brought against him. If he really did this (I don't quite understand why someone would do that while being on the same plane), he would have faced charges for endangering lives. This makes me think that it's most likely just rumors and fabrications. And as I mentioned, according to manufacturers, there is no physical way to connect from the in-flight entertainment system to the controls. <\/p>\n

As I mentioned at the beginning, if we, as pilots, noticed that any of the systems, for instance, navigation, were providing incorrect data, we would switch to using other data sources \u2014 ground references, laser gyroscopes, etc. If the control surfaces are unresponsive, there are alternatives in the 737. The autopilot can easily be disengaged, and in that case, the computer should not affect the behavior of the aircraft. And even if the hydraulics fail, the plane can still be controlled like a large Cessna using cables physically connected to the yoke. So we always have options to control the aircraft, as long as it has not sustained structural damage. <\/p>\n

In conclusion, hacking an airplane via GPS, radio channels, etc., is theoretically possible, but it would require an incredible amount of work, extensive planning, coordination of actions, and a lot of equipment. And let's not forget that depending on the altitude, the aircraft is moving at speeds ranging from 300 to 850 km\/h.<\/p>\n

What do you know about possible attack vectors on aviation? Be sure to share in the comments.<\/p>\n

A little advertisement \ud83d\ude42<\/h3>\n

\nThank you for staying with us. Do you enjoy our articles? Want to see more interesting content? Support us by placing an order or recommending us to your friends, cloud VPS for developers starting at $4.99<\/a><\/noindex>, a unique entry-level server alternative that we have created for you:<\/b> The whole truth about VPS (KVM) E5-2697 v3 (6 Cores) 10GB DDR4 480GB SSD 1Gbps from $19 or how to properly share a server?<\/a><\/noindex> (options available with RAID1 and RAID10, up to 24 cores and up to 40GB DDR4).<\/p>\n

Dell R730xd at half the price in the Equinix Tier IV data center in Amsterdam?<\/b> Only with us 2 x Intel TetraDeca-Core Xeon 2x E5-2697v3 2.6GHz 14C 64GB DDR4 4x960GB SSD 1Gbps 100TB starting at $199<\/a><\/noindex> in the Netherlands! Dell R420 \u2014 2x E5-2430 2.2GHz 6C 128GB DDR3 2x960GB SSD 1Gbps 100TB \u2014 from $99!<\/b><\/b> Read about how To build a corporate-class infrastructure using Dell R730xd E5-2650 v4 servers costing 9000 euros for peanuts?<\/a><\/noindex>
\n
Source: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u044b\u043b\u0435\u0442\u0430\u044f \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0438\u0440\u043e\u0432\u043a\u0443 \u0438\u043b\u0438 \u043d\u0430 \u043e\u0442\u0434\u044b\u0445, \u0437\u0430\u0434\u0443\u043c\u044b\u0432\u0430\u043b\u0438\u0441\u044c \u043b\u0438 \u0412\u044b, \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u044d\u0442\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e \u0432 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u043c \u043c\u0438\u0440\u0435 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u0443\u0433\u0440\u043e\u0437? \u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u0441\u0430\u043c\u043e\u043b\u0451\u0442\u044b \u043d\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u043c\u0438 \u0441 \u043a\u0440\u044b\u043b\u044c\u044f\u043c\u0438, \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043a\u043e \u0432\u044b\u0441\u043e\u043a \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u044b\u0445 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439. \u041a\u0430\u043a \u043e\u043d\u0438 \u0437\u0430\u0449\u0438\u0449\u0430\u044e\u0442\u0441\u044f \u043e\u0442 \u0432\u0437\u043b\u043e\u043c\u043e\u0432? \u0427\u0442\u043e \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u044f\u0442\u044c \u043f\u0438\u043b\u043e\u0442\u044b \u0432 \u044d\u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435? \u041a\u0430\u043a\u0438\u0435 \u0435\u0449\u0451 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043c\u043e\u0433\u0443\u0442 \u043e\u043a\u0430\u0437\u0430\u0442\u044c\u0441\u044f \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u043e\u0439? \u041e\u0431 \u044d\u0442\u043e\u043c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u043f\u0438\u043b\u043e\u0442, \u043a\u0430\u043f\u0438\u0442\u0430\u043d […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55326","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Can an airplane be hacked | ProHoster","description":"When flying for business or leisure, have you considered how safe it is in today's world of digital threats?","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/mozhno-li-vzlomat-samolyot","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u043e\u0436\u043d\u043e \u043b\u0438 \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c \u0441\u0430\u043c\u043e\u043b\u0451\u0442 | ProHoster","og:description":"\u0412\u044b\u043b\u0435\u0442\u0430\u044f \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0438\u0440\u043e\u0432\u043a\u0443 \u0438\u043b\u0438 \u043d\u0430 \u043e\u0442\u0434\u044b\u0445, \u0437\u0430\u0434\u0443\u043c\u044b\u0432\u0430\u043b\u0438\u0441\u044c \u043b\u0438 \u0412\u044b, \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u044d\u0442\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e \u0432 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u043c \u043c\u0438\u0440\u0435 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u0443\u0433\u0440\u043e\u0437?","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/mozhno-li-vzlomat-samolyot","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-17T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55326","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:46:27","updated":"2022-09-29 17:56:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/55326","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=55326"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/55326\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=55326"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=55326"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=55326"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}