Should we worry about hackers targeting plane Wi-Fi?

The recent disasters affecting two Malaysian Airlines flights (the disappearance of MH370 in March and the shooting down of MH17 over Ukraine in July) have brought into sharp focus the safety and security of  passenger aeroplanes.

It was in this context of heightened uncertainty about passenger flights that one information security researcher, Ruben Santamarta, declared recently that he has figured out how to hack into the satellite communications equipment of commercial airlines.

Santamarta, a consultant working for the IT security firm IOActive, detailed his findings at the Black Hat Convention in Las Vegas, in early August, as well as in previous briefing papers.

The security weakness

The vulnerability lies reportedly in the firmware of electronic equipment on aeroplanes, known as their avionics. One example is that, in order to make life more straightforward for engineering crews, security credentials are often hard coded into this equipment. Shared usernames and passwords are commonplace, enabling the maintenance teams to ‘get in’ quick, with a view perhaps to providing the most efficient customer service. Such equipment can be ‘reverse engineered’ so that credentials can be unearthed.

While this is not good news, in itself, for the avionics equipment manufacturers such as EchoStar Corp and Japan Radio Co Ltd, there is worse to come. Santamarta has somehow managed to tunnel his way into this very equipment via the satellite-furnished Wi-Fi on planes (provided for web browsing at 40,000 feet), as well as making use of in-flight entertainment services.

Mitigating points

However, there are a number of points which do rather take the sting out of Santamarta’s findings.

First and foremost, Santamarta has thus far only been able to demonstrate the hack in a lab, not in any kind of real-world scenario. According to Reuters:

“He acknowledged that his hacks have only been tested in controlled environments, such as IOActive’s Madrid laboratory, and they might be difficult to replicate in the real world.”

Those undertaking information security jobs for the airline industries state just how hard it would be to simulate such attacks in an ‘in-flight’ situation.

Next, Santamarta concedes that he has only thus been able to demonstrate an impact on communications systems between ground and air. While this could cause significant disruption, it is not the same as being able to take over a plane via its auto pilot and wreak havoc accordingly. As Santamarta himself says:

“It doesn’t mean we can crash an aircraft […] but we can access the system through Wi-Fi networks.”

Moreover, the responses from the avionics manufacturers have been cool. One may argue that it’s in their interests to downplay such findings, but, on the other hand, they are grounded in years of experience and a strong overall safety record. For instance, Cobham PLC:

“[…] said it would not be possible for hackers to interfere with the navigation and safety systems of a plane through Wi-Fi because the systems require physical access.”

All in all, while Santamarta’s findings do initially send a shiver down the spine, the good news is that the research is now out in the open, and the airline industry at least has all the information it needs to respond accordingly.