In most people's minds, airplane safety is a topic most nearly associated with keeping aircrafts free of any explosives, weapons and liquids that could enable an on-board attack. Extensive screening at security lines, which may include x-rays and metal detectors to check for such contraband, is part and parcel of the flying experience for most travelers.
While enormous attention and resources have been directed to making airports and airplanes safer over the past 15 years, not as much has been invested in ensuring cyber security in the skies. Today's aircraft and air traffic control systems depend upon complex communications infrastructure that is vulnerable to attack.
Malaysia Airlines flight MH370 and the rising awareness of the cyber threat to aviation
When Malaysia Airlines flight MH370 went missing last year, some initial speculation centered on the possibility of a cyber attack that compromised the plane's navigation and life support systems. Investigators eventually concluded that a hypoxia or unresponsive crew event was the more likely cause of the disappearance.
Still, MH370, with its unexpected deviation from course, provided a moment to think about addressing the many vulnerabilities on an aircraft, including susceptibility to cyber crime. Possibilities for disruption include:
- Using a phone, tablet or other USB- and/or Ethernet-enabled device to connect to and hijack the airplane's infotainment system (many seats in business class cabins come equipped with USB and Ethernet ports).
- Taking control of critical avionics systems from a laptop, via in-air Wi-Fi service that may run through the same internal wiring and routers.
- Tricking airplane navigation into sensing that it is flying higher than it really is, leading to a crash landing a la the film "Die Hard 2" (the International Air Transport Association has specifically floated this scenario).
In 2013, Trend Micro researchers discovered similar issues with the Automatic Identification System required on commercial non-fishing vessels weighing over 300 metric tons and all passenger ships. One of the problems identified with AIS vulnerabilities was the potential for an attacker to modify existing data and inject new information that could divert marine aircraft during a rescue scenario.
The broader issue affecting boats, airplanes and vehicles of all kinds is the intersection of legacy communications protocols and systems with the emerging Internet of Things, in which billions of endpoints are connected by IP networks. Critical infrastructure that was once isolated is now exposed to the wide reach of the Internet and software.
"AIS is only one example of a critical radio based system that was designed in a world before the Internet or software-defined radio," observed Trend Micro's Kyle Wilhoit and Marco Balduzzi in October 2013. "The problem is bigger than marine traffic alone. Other systems such as ADS-B (used by airplanes), or soon to be released systems around car communication suffer from some of the same limitations and vulnerabilities."
U.S. government pushes for upgraded cyber security to protect aircraft
The weakness of transportation communication protocols, the disappearance of MH370 and the slow upgrade cycle of commercial aircraft have combined to spur the U.S. public sector into action. For example, the Government Accountability Office recently issued a report revealingly titled "Information Security: FAA Needs to Address Weaknesses in Air Traffic Control Systems," based on an investigation of Federal Aviation Administration IT systems that began in August 2013.
The study's authors pointed out that remote hijackings, malware installation and infiltration of navigation systems were all possibilities due to the growing IP connectivity of today's aircraft. They made 17 recommendations for improving cyber security in the skies, including strengthening access controls and implementing real-time data monitoring to detect anomalous traffic.
These pieces of advice are similar to the actions that private enterprises increasingly have to take in order to secure their IT infrastructure from cyber threats. Although airplanes have many safeguards in place to counteract attacks, in the end many of these mechanisms (such as the firewalls that separate the in-flight Wi-Fi network from the avionics systems) are just software and as such are vulnerable to circumvention. Modern tools, such as deep discovery solutions, and sensible processes and reporting can provide the basis for sustainable security throughout airplanes.
Much of the burden for overhauling airplane safety and security naturally falls to the FAA. The agency has a mixed track record in this area. The GAO report found that the FAA had not updated its strategy since 2010. Previously, the FAA's measures did not bring its IT systems into compliance with regulations introduced in 2002.
In the wake of the GAO report, U.S. Senator Charles Schumer remarked on the work ahead for the FAA. He compared the potential fallout from a cyber attack on an airplane to what happened in late 2014 to Sony Pictures after its systems were hacked and many terabytes of sensitive data were exposed to cyber criminals.
"FAA computers have system-wide failings that leave the agency's air traffic control systems vulnerable to hacking, which could expose sensitive aviation data or even shutdown the system while thousands of planes are in the air," stated Schumer. "We all saw what happened at Sony: One can only imagine the immediate risk posed by a hacking of the FAA's air traffic control and computer systems, in addition to the national security risk posed if foreign nationals or terrorists get their hands on the FAA's sensitive and encrypted data."
Airplane security for the future
It is easy to imagine the impact of a major cyber attack against the aviation system. The disappearance of MH370 also provided a look at what could happen if critical transportation infrastructure were compromised.
Fortunately, the FAA has already acknowledged the importance of following the GAO's recommendations. Coordination between agencies will be critical as airplanes and air traffic control systems evolve from isolated infrastructure into components of the broader IoT.
Cyber security measures like networking monitoring, access controls and anti-malware protection will be critical to the planes of tomorrow. With the right mechanisms in place, airplane security can be brought in line with the most relevant threats of today and tomorrow.
