Aeroplanes with in-flight Wi-Fi are vulnerable to hacks by passengers and could be targeted by a "malicious attacker" on the ground, a US report has warned.
The US Government Accountability Office (GAO) described the potential dangers in a new report for the Federal Aviation Administration (FAA) titled "FAA Needs a More Comprehensive Approach to Address Cybersecurity As Agency Transitions to NextGen".
The study explained that IP networks of all kinds left flights open to cyberattacks -- whether that's in-flight wireless entertainment systems, internet-based cockpit communications or the new Next Generation Air Transportation System due to be implemented by 2025. "IP networking may allow an attacker to gain remote access to avionics systems and compromise them," the report said.
The threat appears to come in two forms, the GAO said. The first is from intrusion into avionics systems by passengers using in-flight Wi-Fi. "Four cybersecurity experts with whom we spoke discussed firewall vulnerabilities, and all four said that because firewalls are software components, they could be hacked like any other software and circumvented," the report said. It described theoretical methods by which committed hackers could access any aspect of an aeroplane's control system.
"The experts said that if the cabin systems connect to the cockpit avionics systems (e.g., share the same physical wiring harness or router) and use the same networking platform, in this case IP, a user could subvert the firewall and access the cockpit avionics system from the cabin," the report added. An FAA official cited in the report said additional security controls implemented onboard could strengthen the system.
This threat is worsened by the ubiquitous presence of smartphones and tablets. "The presence of personal smartphones and tablets in the cockpit increases the risk of a system’s being compromised by trusted insiders, both malicious and non-malicious, if these devices have the capability to transmit information to aircraft avionics systems," the report explained.
A second, related threat would come from the wider internet. The report said FAA officials and experts were concerned that since aircraft use IP networks like any other communications hub, that potentially provides a route into its systems for an attacker who is -- for instance -- able to install malware on passenger's devices without their knowledge.
Internet connectivity in the cabin should be thought of as a "direct link between the aircraft and the outside world" the report said. "One cybersecurity expert noted that a virus or malware planted in websites visited by passengers could provide an opportunity for a malicious attacker to access the IP-connected onboard information system through their infected machines."
The report said that the FAA was "taking steps" to align its cybersecurity policies, adding that "a working group expects to complete a draft by September 2015 that reflects the restructuring of IT infrastructure". The FAA, along with other aviation agencies, runs simulated cybersecurity attacks to try to prevent problems and work out its response.
WIRED.co.uk contacted the UK Civil Aviation Authority and European Aviation Safety Agency for comment, and will update this story when we receive an official response.
The US subsequently demanded action from the FAA, with Peter DeFazio, chief democrat on the House Transportation and Infrastructure Committee, warning it had exposed a "real and serious threat". "FAA must focus on aircraft certification standards that would prevent a terrorist with a laptop in the cabin or on the ground from taking control of an airplane through the passenger Wi-Fi system," he said, according to the Daily Telegraph.
This article was originally published by WIRED UK
