DHS Warns Small Airplanes Vulnerable to Flight Data Manipulation Attacks
What could be more horrifying than knowing that a hacker can trick the plane's electronic systems into displaying false flight data to the pilot, which could eventually result in loss of control?
Of course, the attacker would never wish to be on the same flight, so in this article, we are going to talk about a potential loophole that could allow an attacker to exploit a vulnerability with some level of "unsupervised" physical access to a small aircraft before the plane takes off.
The United States Department of Homeland Security's (DHS) has issued an alert for the same, warning owners of small aircraft to be on guard against a vulnerability that could enable attackers to easily hack the plane's CAN bus and take control of key navigation systems.
The vulnerability, discovered by a cybersecurity researcher at Rapid 7, resides in the modern aircraft's implementation of CAN (Controller Area Network) bus—a popular vehicular networking standard used in automobiles and small aircraft that allows microcontrollers and devices to communicate with each other in applications without a host computer.
Rapid7 researcher Patrick Kiley demonstrated that a hacker with physical access to a small aircraft's wiring could attach a device—or co-opt an existing attached device—to the plane's avionics CAN bus to insert false data and communicate them to the pilot.
"Modern aircraft use a network of electronics to translate signals from the various sensors and place this data onto a network to be interpreted by the appropriate instruments and displayed to the pilot," Kiley said in a report published Tuesday.
The attacker can manipulate the following data:
Engine telemetry readings
Compass and attitude data
Altitude, airspeed, and angle of attack (AoA) data
"The researchers have further outlined that a pilot relying on instrument readings would be unable to distinguish between false and legitimate readings, which could result in loss of control of the affected aircraft," the DHS' cyber division warned Tuesday.
Kiley demonstrated the attack after investigating avionics systems—an electronic control and navigation system fitted in an aircraft—from two unnamed commercial aircraft manufacturers specialized in light aircraft.
Kiley found that the key problem with the avionics CAN bus is that it is integrated into the aircraft's other components without any firewalls or authentication, which means untrusted connections over a USB adapter attached to the plane can send unauthorized commands to its electronic systems.
"In avionics, these systems provide the foundation of control systems and sensor systems and collect data such as altitude, airspeed, and engine parameters such as fuel level and oil pressure, then display them to the pilot," the researcher said.
"CAN packets also do not have recipient addresses or any kind of built-in authentication mechanism. This is what makes the bus easy to implement, but it also removes any assurance that the sending device was the actual originator of the message."
Though the attack sounds scary, it is not easy to gain "unsupervised" physical access to a plane, given "current industry practices and regulations," nevertheless, the Rapid7 report is worth paying attention to.
The researcher also pointed out that the avionics sector is lagging behind the automotive industry when it comes to the CAN bus system.
The automotive industry has made advancements in implementing safeguards, such as CAN bus-specific filtering, whitelisting, and segregation, that prevent similar physical attacks to CAN bus systems. Aircraft makers should also implement these safeguards.
The DHS' CISA is urging aircraft manufacturers to consider network protections around the CAN bus system and make sure they restrict access to their planes to the best of their abilities.
https://thehackernews.com/2019/07/airplane-can-bus-hacking.html
view the rest of the comments →
[–] 19971458? ago
Because some smaller acft are commercial. They carry passangers,etc. And....if you look at this:
http://www.sierracharlieaviation.com/sites/default/files/IMG_0561.JPG
You can see. A great many pilots are buying newer models and they ALL have glass cockpits. But its not like the "Heavy's" which use a MCAS computer. A lot of pilots are however installing garmin equipment in their older birds also trying to take advantage of sat. Gps. The garmin ties into the autopilot which governs flight controls ONLY, not power aka throttle. People are getting lazy and letting the tech do the flying. To override, Note, pull the breaker and fly manually and you can control the acft. Remember on gen. Aviation there is no MCAS.
Use to be we used radio signals to navagate....aka VOR.
VHF omnidirectional range
Very High Frequency Omni-Directional Range is a type of short-range radio navigation system for aircraft, enabling aircraft with a receiving unit to determine their position and stay on course by receiving radio signals transmitted by a network of fixed ground radio beacons. It uses frequencies in the very high frequency band from 108.00 to 117.95 MHz. Developed in the United States beginning in 1937 and deployed by 1946, VOR is the standard air navigational system in the world, used by both commercial and general aviation. By 2000 there were about 3,000 VOR stations around the world including 1,033 in the US, reduced to 967 by 2013 with more stations being decommissioned with the widespread adoption of GPS.Wikipedia
If you are interested
https://m.wikihow.com/Navigate-Using-a-VOR
[–] 19971572? [S] 0 points 1 point 1 point (+1|-0) ago
Thank you.