Hacking planes - UK researchers developing plans to stop 'flight cyberjacking'
It’s easy to get paranoid if you spend too much time on the internet. Reading the reams of scare stories on Ebola, an imminent third world war or cybergeddon, an internet apocalypse caused by hackers, would send even the calmest of people into paralysing paroxysms.
When MH370 went missing this year, some suspected the mysterious disappearance was the result of a digital attack on the plane. That theory has little factual basis, however.
The City University professor Dr David Stupples researches cyber terrorism for the UK government, and has previously secured communications satellites for Hughes Aircraft Corporation. He says the systems on the doomed flight were set up in such a way that such a hijacking attempt would have proven extremely difficult.
Though modern airplanes have integrated systems, connecting difference pieces of the network architecture using a bus, which might allow hackers to move around a plane’s network to cause trouble, MH370’s on-flight communications were more segregated.
“If we talk about MH370 that certainly didn’t have this level of integration at all,” he explains. “But with the A320 and A350 and 787 [different models of airplane] we have got this level of integration.”
Digital compromise of an aircraft via a ‘cyber bomb’
According to Stupples, the potential for digital compromise of an aircraft is certainly possible, especially if perpetrated by those threatening to use a “cyber bomb”, where hackers place malware on aircraft systems to disrupt them sufficiently and cause the jet to crash.
That’s why Stupples and researchers at Cranfield University, known for its aviation expertise, are developing a network architecture that would prevent such attacks. The system would recognise dangerous malware as soon as it made its way onto the aircraft, as its attempts to access and tamper with flight control software should be recognisable.
The network would then “reconfigure” itself around the malware, Stupples explains. “We can do that in a variety of ways which will hopefully not defeat but out-manoeuvre the bad guys.” The most likely way of preventing the hackers moving to more critical parts of the network would be to shut non-essential systems down, he adds, noting the same kind of techniques could be used in power plants or other critical infrastructure. The overall aim is to take the network to a safe, known state.
Stupples alludes to discussions with GCHQ about the issue. “We have to address the problem completely differently. We need to look at architectures that can survive a malware attack. This is really important for infrastructure such as power stations, water plants, all of those things, [as well as] aircraft,” says Stupples.
Has this ever actually happened?
When there are so few examples of hackers targeting planes, such statements could easily be written off as histrionic.
There was much breathless reporting in 2010 when details were released on Spanair Flight 5022, which crashed shortly after take off. Some believed an El Pais report had claimed malware was the cause of the tragedy. But it transpired a computer system used for monitoring technical issues with the airline’s planes was infected, not the aircraft. And the main cause was the incorrect positioning of the flaps and slats on the wing, which were fully retracted. Though the system designed to warn of an inadequate takeoff configuration did not work correctly, there was little evidence this was the fault of the malware.
Yet the Spanair crash does point to one obvious avenue for attacks on jetplanes: compromising the airline’s network with malware that could then be transmitted to the flight systems. This could either be done by an external hacker with vast expertise and knowledge of their target, or by an insider with high level access, says Stupples.
A disgruntled employee could load malware onto the aircraft via a USB pen, he suggests, or it could spread from the company network when the jet connects to a data port at the gate. These data ports often update the inflight entertainment systems, from where attackers could start probing other parts of the network as they attempt to compromise the controls, Stupples adds.
“The disaffected employee would have to be someone associated with the systems. If that’s the case, there’s a better than 80% chance they can either get to the data being transmitted on to the aircraft or get onto the aircraft itself [to load the malware],” he says.
“I’m beginning to get the view we’re fighting a losing battle in the malware game because there are a lot more people doing malware - the dark side has a lot more people than the light side. The dark side people are also very clever and we mustn’t underestimate them.”
Few disagree that as planes adopt more wireless communications the potential for remote attacks - those carried out by a hacker sitting at a desk rather than on a plane - increases. A number of the protocols (the rules that determine how systems interact with each other) used by aircraft have previously been shown up as vulnerable in recent years.
Attackers could install malware under certain circumstances
Ruben Santamarta, a researcher from security consultancy IOActive, has explored a number of the protocols and machines used for satellite communications, which provide broadband internet access or for data and voice communications used for safety on flights.
He looked at various satellite communications devices and software made by big-name manufacturers - including Cobham, Inmarsat, Harris Corporation, Hughes and Iridium - that cover those two areas on a variety of airplane.
At the 2014 BlackHat security conference, Santamarta said these vulnerabilities may have allowed an attacker to install a malicious firmware with or without physical access to the device, under certain circumstances. “If we control the firmware running in the satellite communications gear, an attacker can potentially to intercept, spoof or disrupt it,” he tells the Guardian.
Yet the cyber threat has been exaggerated. For the digital terrorist, they need more than just a handful of vulnerabilities to take control of a plane while it’s in the sky. They need to figure out a way of moving around the aircraft’s network to compromise its control systems. This is where Stupples believes today’s hackers will come unstuck.
“You have to get into the autopilot and to get into the autopilot and run it from somewhere you don’t know - it’s very difficult,” he adds. “[To do that] you’ll have to have the whole network architecture of the flight system. And all of the interface points to that. Yes, it’s possible, but you have to have a great deal of knowledge.”
Dr Phil Polstra, professor of digital forensics at Bloomberg University and a qualified commercial pilot, thinks the most obvious way to “do something bad to an airliner” would not be via cyber means but to co-opt someone in maintenance who could subtly tinker with the mechanics. “That would be a lot simpler and a lot more likely to be successful than a really high-tech attack.”
‘Airlines rely too heavily on redundancy and determinism’
Despite some predictably hyperbolic reporting, Santamarta says anyone who exploited the weaknesses he uncovered would only cause disruption rather than gain access to the controls. “In my research, if you compromise a satellite communications device that doesn’t mean you can crash an airplane. However, aircraft safety heavily rely on redundancy and determinism to provide security, so any unexpected behaviour is a risk,” says Santamarta.
Polstra believes hackers would have a very hard time causing any disruption to a flight whatsoever. Looking at Santamarta’s research, he says that while everything the study found was correct, being able to send fake communications would have little chance of tricking pilots. “[In aircraft today] we have two pilots in the loop. If you were to send a bogus communication to tell them to do anything unusual, they would instantly check with the airline,” Polstra notes.
For instance, if a malicious message is sent over the Aircraft Communications Addressing and Reporting
System (ACARS) to reroute an aircraft - a method suggested by Santamarta - it first appears on a screen and then on a print out, says Polstra. The pilots then have to manually enter the message into the flight computer and execute it. Put simply, any pilot worth their salt would notice anything strange. “It’s not the case you could send a bogus message and then it would make the plane go in another direction,” Polstra adds.
From a cyber perspective, we can be thankful that the research shows attacks are limited in their scope. Paper concepts alone can’t hurt us. And human intervention can prevent a disaster.
Source: The Guardian (GRANDE-BRETAGNE)
Relayé par: Laura Roche