In a presentation at the 2017 CyberSat Summit in the US, a Department of Homeland Security (DHS) official admitted that his team of experts remotely hacked into a Boeing 757.
The hack was not conducted in a laboratory, but on a 757 parked at the airport in Atlantic City, New Jersey. The attempt occurred over a year ago, with details only emerging thanks to a keynote delivered by Robert Hickey, aviation programme manager within the Cyber Security Division of the DHS Science and Technology (S&T) Directorate.
“We got the airplane on Sept. 19, 2016. Two days later, I was successful in accomplishing a remote, non-cooperative, penetration,” Hickey said. According to Avionics Today, he added, “[Which] means I didn’t have anybody touching the airplane, I didn’t have an insider threat. I stood off using typical stuff that could get through security and we were able to establish a presence on the systems of the aircraft.”
While the details of the hack are classified, Hickey admitted that his team of industry experts and academics pulled it off by accessing the 757’s “radio frequency communications.”
Hacking commercial airliners has seen much discussion in recent years
Those interested may recall when a US governmental watchdog admitted that the interconnectedness of modern commercial airliners could “potentially provide unauthorised remote access to aircraft avionics systems.” The concern was that a hacker could go through the Wi-Fi passenger network to hijack a plane while it was in flight. In a 2015 report, the US Government Accountability Office warned, “Internet connectivity in the cabin should be considered a direct link between the aircraft and the outside world, which includes potential malicious actors.”
At the time, US Representative Peter DeFazio said, the “FAA must focus on aircraft certification standards that would prevent a terrorist with a laptop in the cabin or on the ground from taking control of an airplane through the passenger Wi-Fi system.”
The same year, security researcher Chris Roberts ended up in hot water with the feds after tweeting about hacking the United Airlines plane he was traveling on. The FBI claimed Roberts said he took control of the navigation.
A Hack In The Box presentation by Hugo Teso in 2013 suggested that thanks to the lack of authentication features in the protocol Aircraft Communications Addressing and Report System (ACARS), an airliner could be controlled via an Android app. Flight management software companies as well as the FAA disputed Teso’s claims.
This all means that airline pilots have heard of those vulnerabilities before too. Yet at a technical meeting in March 2017, several shocked airline pilot captains from American Airlines and Delta were briefed on the 2016 Boeing 757 hack. Hickey said, “All seven of them broke their jaw hitting the table when they said, ‘You guys have known about this for years and haven’t bothered to let us know because we depend on this stuff to be absolutely the bible.’”
As CBS pointed out, Boeing stopped producing 757s in 2004, but it is still used by major airlines such as American, Delta and United. President Trump has a 757 and Vice President Pence also uses one. In fact, Avionics Today claimed 90% of commercial planes in the sky are legacy aircraft which were not designed with security in mind.
Boeing told CBS that it firmly believes the test “did not identify any cyber vulnerabilities in the 757, or any other Boeing aircraft.”
Furthermore, an unnamed official briefed on the test told CBS the results of the hack on an older aircraft was good information to have, adding, “but I’m not afraid to fly.”
IDG News Service
Subscribers 0
Fans 0
Followers 0
Followers