A SECURITY RESEARCHER has claimed that he can hijack commercial airplanes through their in-flight entertainment systems or onboard WiFi.
Researcher Ruben Santamarta said that most commercial aircraft onboard satellite communications system are "wide open" to exploits and he will prove his findings by demonstrating the attack on stage at the Black Hat security conference in Las Vegas on Thursday.
Following some exhaustive research in a report undertaken in April, Santamarta said that he discovered the vulnerabilities by "reverse engineering", or decoding, highly specialised software known as firmware used to operate communications equipment made by Cobham, Harris Corp, Echostar Corp's Hughes Network Systems, Iridium Communications and Japan Radio.
He found that many of these systems of five of the major airline systems manufacturers had "hardcoded" log-in credentials, meaning engineers used the same authentication across multiple devices, which could allow hackers to steal these credentials if they hacked the device firmware.
"These devices are wide open," Santamarta told Reuters. "The goal of this talk is to help change that situation."
Santamarta explained that, in theory, this means that a hacker could use a plane's onboard WiFi or inflight entertainment system to hack into its avionics equipment, potentially disrupting or modifying satellite communications, which could interfere with the aircraft's navigation and safety systems.
Although Santamarta's exploits have so far been tested only in controlled environments, and he has admitted they might be difficult to replicate in the real world, he said that he has gone public with his findings in order to encourage manufacturers to fix what he sees as potentially dangerous security flaws in the aviation industry.
In April, airline trade organisations played down the threat of an app developed to access the flight deck of a simulated aircraft and control the plane from an Android smartphone.
Hugo Teso, who is a fully trained commercial pilot as well as a security researcher for German IT firm N.Runs, demonstrated the vulnerabilities in an aircraft's flight management system (FMS) at the Hack In The Box conference.
Teso fed false navigation information to a simulated aircraft, which he built using spare parts from real jets that he acquired through Ebay, by sending it his own malicious radio signals, making it change course. µ
Sign up for INQbot – a weekly roundup of the best from the INQ