Modern airliners are rather complicated feats of engineering. Innumerable safety-critical components are connected with tens of miles of wiring, complex digital buses, and dozens (perhaps hundreds) of computers. But, as hackers, we know that any computer can be hacked and, of course, aircraft avionics are no different.
Modern aircraft typically use the ARINC 429 protocol. This differs from many protocols we see where multiple transmitters are allowed. ARINC 429 has a single transmission source. This makes a transmission-override attack hypothetically difficult, as an attacker was thought to need to physically replace a legitimate transmitter (like a flight management computer), a rather daunting task. However, the ARINC 429 transmitters sit behind a pair of 37.5 ohm resistors, so by transmitting on the same line, an attack device can simply override the legitimate transmitter’s power.
With this methodology, the researchers created a proof of concept demonstration using a GE 2907A4 flight management computer (FMC), a GE 577F1 multipurpose control and display unit (MCDU), and an Integrated Flight Systems Accessory Unit (IFSAU). These are all components commonly used on the ever-popular Boeing 737, wired together as would be standard on that aircraft. The FMC communicates over ARINC 429 with the pilot’s MCDU, which is used to program the autopilot and perform takeoff calculations (among other things). After analyzing the protocol between the FMC and MCDU, they were able to freeze the pilot’s display, overwrite it, or even change values received and displayed.
With this methodology, three attacks were proposed. Most dramatically, the autopilot could be reprogrammed, bringing the aircraft to a new waypoint. However, it was also possible to modify the weight and balance information in the FMC. These values are critical for flight safety, and even subtle miscalculations could spell disaster. However, it’s worth noting the pilots do retain full control of the aircraft, especially on the fly-by-cable 737. Still, any number of these attacks could lead to unsafe conditions aboard an aircraft.
However, this is all theoretical. Can it actually be pulled off in the real world? Unfortunately, yes. Though the obvious attack vector would be tapping into wires, this proves challenging by nature of individual wires being difficult to find in such large bundles, and ARINC 492’s operation probes to look for misbehaving devices. Rather, the researcher found an open maintenance port in the 737’s electronics bay with access to ARINC 429. They designed a tiny device capable of tapping into the port, which they believe can be inserted in 30 to 60 seconds by someone on the ground without even needing a ladder. Access to an aircraft is unfortunately poorly restricted, and determining exactly where the device came from would be extremely difficult. The device itself is a tiny ESP32 board that plugs into the data port. Operation is over WiFi.
Though the paper assumes the ever-troubled 737 is the target, nothing stops this from working on other aircraft. Moreover, by retaining physical controls, the 737 may have ended up being safer than some other aircraft.
Thanks [anfractuosity] for the tip!
In theory I could build a 20 kT plutonium nuke in my bathroom. I just need a lot of uranium, some centrifuges, a graphite-moderated reactor, some kind of crucible (maybe TIG welder and a flower pot will do?), lathe to manufacture two perfect half-spheres and an Arduino Mega to drive all the detonators.
I believe “theoretical” is just a “CYA Statement,” because messing with avionics would land them on lots of blacklists. Travelling around the world by train and boat isn’t fun.
By saying “theoretically” they are not incriminating themselves. “We identified a theoretical vulnerability” is better for their future than “we successfully overrode a 737 avionics computer.”
I’ve had exactly once flown a plane (holiday) in my 40 years. Living in a developed country and working in IT.
And to back up DanielFs comment: Boats are a lot of fun.
To cross the Atlantic is deep relaxation.
It’s the “having no other option” part that ruins it. Choosing the slow path because you want to relax and aren’t in a hurry is great, when it’s a choice. Having no way to attend a wedding or conference that doesn’t eat two weeks or more out of your life? Less enticing.
In theory sure, in practice not a chance, but that’sa ridiculous analoy to make:
To replicate what was done in the article all you’d need is an ESP32, some cable and a couple of the aerospace style connectors assembled into an “extension cable” , along with a minute of access to the outer belly of the plane. If you could get a job a a baggage handler you could probably pull it off.
A scary possibility!
… and access to a sample of the corresponding flight computer so that you can spend a few weeks analyzing the data and attempt to identify the traffic that you hope to hijack. You also need to know which pins attach to what.
I’m pretty sure it’s not as trivial as it sounds.
It’s not trivial, but more trivial than you think.
Organized crime can pay (or coerce) someone to create the device, and pay someone else to plug said device on the airplane. It’s easier than hijacking the plane with armed thugs (and that happened more than once).
And if you could get a job as a baggage handler and smuggle a device past security, then you could also just stick a bomb in the baggage. This seems less a threat, and much more obvious – “what’s that baggage handler doing over by the maintenance panel” is going to raise questions about slacking off, if not safety and security.
Yeah. You might screw up one A429 channel. For flight critical data you’ll trigger a sensor mismatch, and/or only corrupt one of the displays leaving the pilot or copilot with backup instruments and/or the other person’s display.
Not sure if pilot/copilot walkarounds include looking for FOD in the equipment areas.
Also good luck doing this with A664, you’d have to MITM two Ethernet links simultaneously
Ah yes that does sound a bit ridiculous, therefore imagining and hypothesizing must be useless
i always forget to end my
It looks to me that someone or some company is really pushing hard to sell cybersecurity consulting.
Oh, so having unrestricted physical access to airplane’s eletronics bay is considered hacking nowadays. Noted.
No, but building and installing a device that can override a flight computer sure is. It’s all about what you would do with that access.
That was meant to be sarcastic. The article focuses on the fact that plugging a device into a maintenance port can override pilot input, even though the original paper explains it’s specifically designed for that. That’s hardly a hack. The actual hack, i.e. making sure that the pilot doesn’t notice, got a mere side note.
God you people are annoying
Actually, you can usually achieve similar results (on many aircraft) from the runway. There are often maintenance ports in the gear bays, designed for easy and convenient ground-level access. The security of the system depends on the security of the perimeter, not the technical security of the design.
It’s not that different from all of the CANbus exploits on cars. “having unrestricted access to the engine compartment is considered hacking nowadays?” Nope, just bust out a headlight. The weakness is in the presumption (at two different levels of abstraction). “nobody would figure it out, or would bother to exploit it”, and “you’d need into the hood anyway; if you could do that, you could do lots of other stuff”. Both false…
The paper describes exactly that — accessing electronics bay from the runway and plugging a device into a maintenance port. Using your car analogy that would be like connecting a device to an OBD port and changing cruise control parameters. Would a serious person consider it hacking a [insert random car brand name]? Even if it costs less than $100 and it takes only 60 seconds to install?
I’m not saying that what the researchers did is not a hack. It definitely is. But contrary to the overwhelming media coverage, it’s not using a maintenance port designed to inject data to the flight computer, kept behind several layers of physical security. It’s rather keeping its use stealth and that part is pretty scary.
Let me guess, CVE is critical but required physical access
‘Since I can’t think of any way in which I might gain physical access to a commercial airliner, it’s only logical to assume that no one would be able to gain physical access to a commercial airliner. Q.E.D.’
“Though the paper assumes the ever-troubled 737 is the target”
The 737 Max is a very different aircraft to the 737. The 737 is not a troubled aircraft by any measure.
Shh! labeling is valid semantics! Otherwise it would be a lot harder to jump to conclusions, and lazy people would be excluded!
This is a good reason to give heavy preference to physical controls.