The lack of security in communication technologies used in the aviation industry makes it possible to remotely exploit vulnerabilities in critical on-board systems and attack aircraft in flight, according to research presented Wednesday at the Hack in the Box security conference in Amsterdam.
The presentation, by Hugo Teso, a security consultant at consultancy firm N.runs in Germany, who has also had a commercial pilot license for the past 12 years, was the result of the researcher's three-yearlong research into the security of avionics.
Teso showed how the absence of security features in ADS-B (automatic dependent surveillance-broadcast), a technology used for aircraft tracking, and ACARS (Aircraft Communications Addressing and Reporting System), a datalink system used to transmit messages between aircraft and ground stations via radio or satellite, can be abused to exploit vulnerabilities in flight management systems.
He did not experiment on real airplanes, which would be both dangerous and illegal, according to his own account. Instead Teso acquired aircraft hardware and software from different places, including from vendors offering simulation tools that use actual aircraft code and from eBay, where he found a flight management system (FMS) manufactured by Honeywell and a Teledyne ACARS aircraft management unit.
Using these tools, he set up a lab where he simulated virtual airplanes and a station for sending specifically crafted ACARS messages to them in order to exploit vulnerabilities identified in their flight management systems -- specialized computers that automate in-flight tasks related to navigation, flight planning, trajectory prediction, guidance and more.
The FMS is directly connected to other critical systems like navigation receivers, flight controls, engine and fuel systems, aircraft displays, surveillance systems and others, so by compromising it, an attacker could theoretically start attacking additional systems. However, this aspect was beyond the scope of this particular research, Teso said.
Identifying potential targets and gathering basic information about them via ADS-B is fairly easy because there are many places online that collect and share ADS-B data, such as flightradar24.com, which also has mobile apps for flight tracking, Teso said.
ACARS can be used to gather even more information about each potential target, and by combining this information with other open-source data, it is possible to determine with a fairly high degree of certainty what model of FMS a specific aircraft is using, Teso said.
After this is done, an attacker could send specifically crafted ACARS messages to the targeted aircraft to exploit vulnerabilities identified in the code of its FMS. In order to do this, the attacker could build his own software-defined radio system, which would have a range limit depending on the antenna being used, or he could hack into the systems of one of the two main ground service providers and use them to send ACARS messages, a task that would probably be more difficult, Teso said.
