13 ms·

Air-Bus Hijacking: Silently Taking over Avionics Systems

63 points by pjf 2y ago

jstanley 2y ago
[flagged]
- pictureofabear 2y ago
  But why? To what end? And where would all the passengers be? That theory is outlandish, not because of the technical considerations, but the seeming lack of motivation for doing that. A cursory Google search shows that Jeff Wise doesn't have a plausible theory of motivation either.
  - jstanley 2y ago
    [flagged]
    - pictureofabear 2y ago
      Right, but you can test this real-world with much lower stakes. Airliner aircraft are relatively cheap and easy to acquire. SCUBA gear is for diving underwater where pressure increases, not for breathing high in the atmosphere where air pressure is lower. There are plenty of suitable breathing apparatuses made for breathing at altitude. SCUBA gear and knowledge is irrelevant to this situation. There are a multitude of ways to target an individual or a particular piece of cargo without killing so many people in such public fashion. The attempt to use abductive reasoning here falls short because you're choosing the least likely explanations when far simpler and more plausible explanations exist. Conspiracy theories like this often, at their heart, rely on an assumption that governments are either irrational or have hidden motivations, but both of these assumptions require a heavy amount of evidence to outweigh all of the evidence to the contrary.
    - ejj28 2y ago
      I don't buy that hijacking a plane and disappearing it and covering it all up, in the process generating extreme publicity, is anywhere near a practical method of kidnapping a person or acquiring a "ghost airliner", and it would be an incredibly risky and brazen 'real-world test of the capability'.
    - bufferoverflow 2y ago
      You can just buy an airplane if you're a state actor. Why kill hundreds of passengers?
- MaKey 2y ago
  > I don't know enough to judge whether it is likely or not, but it's a pretty fascinating idea. The fact that some debris of MH370 has been washed ashore means it crashed into the ocean. The plane just hasn't been found (yet). Mentour pilot has a good video on the subject: https://youtube.com/watch?v=MvmfyO8GvTE https://youtube.com/watch?v=MvmfyO8GvTE Summary: Captain likely hijacked the plane, depressurized the cabin, used his knowledge to avoid detection and crashed the plane into the ocean.
byyoung3 2y ago
[flagged]
- floatingcloud12 2y ago
  [dead]
- joe_the_user 2y ago
  "They did it to distract the media!" must the worst conspiracy theory form ever
  - byyoung3 2y ago
    [flagged]
wucke13 2y ago
The observation that ARINC 429 can be tapped, and that an active wiretap can alter data on the bus is of little surprise. The technological challenge is not high, the bus is comparable to a serialport at ~115200 baud. Considering that the technology surfaced in the 1970s, it is of no surprise that physical access restriction is the only means of security. More interesting IMHO would be what can be done to accelerate the adoption of new technologies (especially w/r/t cryptography) in avionics. This is more than anything a cultural problem; How to convince regulative bodies, how to satisfy processes, how to re-balance the proven-in-use argument (where stuff gets more favorable safety assessments when it has been used long enough) vs crypto-agility (where the same thing from today just tomorrow becomes insecure without changing itself, because of some external discovery). The technology is there, but the aviation community is not yet. Another nice read in this domain is "Economy Class Crypto: Exploring Weak Cipher: Usage in Avionic Communications via ACARS"[1, 2]. I only say mono-alphabetic substitution cipher. An interesting connection of Blockchain-tech, safety and security can be found in "Verifiable Computing in Avionics for Assuring Computer-Integrity without Replication" [3]. Here the authors leverages zero-knowledge proofs to prove to a downstream actuator that its commands are indeed correct results yielded by the application of the appropriate control law on the provided sensor inputs. However, this work is probably at least a decade away from being applicable in actual certified aircraft. [1] https://link.springer.com/chapter/10.1007/978-3-319-70972-7_15 https://link.springer.com/chapter/10.1007/978-3-319-70972-7_... [2] https://www.cs.ox.ac.uk/files/9693/fc-paper.pdf https://www.cs.ox.ac.uk/files/9693/fc-paper.pdf [3] https://publ.sec.uni-stuttgart.de/reinhartluettighuberliedtkeannighoefer-dasc-2023.pdf https://publ.sec.uni-stuttgart.de/reinhartluettighuberliedtk...
- masfuerte 2y ago
  I don't want the cockpit to lose contact with the engines during a flight because a certificate just expired. And even if this particular example isn't realistic, adding security to a system will necessarily add lots of new failure modes. It seems likely that it will be really hard to do this without making the system as a whole less reliable.
  - GTP 2y ago
rectang 2y ago
From the abstract: > This paper investigates cyber-physical attacks on avionics data buses, specifically focusing on the ARINC 429 protocol. The objective is to demonstrate how message injection, modification, and deletion attacks can be executed, enabling an attacker to gain full control over the transmitted data. I wish that vehicular systems all had air-gap level separation of messages, rendering it physically impossible to disrupt messages to critical systems like flight controls. I suppose that's a naive perspective, but in the long run it's hard to believe that we won't have to resort to provably correct systems to thwart attacks. > To accomplish this, we propose a method that involves modifying messages on the data bus without segmenting it. Can we really live with avionics platforms as a setting for the same kind of perpetual arms race against attackers that we have for general operating systems?
- joe_the_user 2y ago
  Another question would be: "Can we create systems intended to be permanently disconnected from the Internet?". Unfortunately, the answer seems to be no. You can see indications in the way that small water purification systems connect to the net just to save engineers from going in a weekends.
  - constantcrying 2y ago
    >"Can we create systems intended to be permanently disconnected from the Internet?" Any modern jet will function without internet.
    - buildsjets 2y ago
      Not permanently, which is the conjecture laid out by OP. At some point, there will need to be nav data updates, updates to the aircraft's required systems, updates to IFE systems, etc. Modern jets do all of that wirelessly. Additionally, every single modern jet uploads all recorded engine parameters from the flight to the engine manufacturer after it arrives at the gate. Do I know what I am talking about? Ref. username.
constantcrying 2y ago
To be honest this is both unsurprising and IMO very irrelevant. Spoofing a CAN or ARINC429 bus requires physical access. At that point an attacker has access to the physical systems of the plane, at which point the plane is compromised anyway. What he uses to take over the plane is essentially arbitrary and there is absolutely nothing that would give any protection.
- bilbo0s 2y ago
  I was wondering why anyone would go through all that trouble if s/he already had that level of control of the plane? Good to have someone more knowledgeable explain that I'm not necessarily crazy.
  - Two4 2y ago
    Imagine a scenario where a plane is carrying a person who is enemy to a certain nation state. A nation state who is not above, say, using umbrella air dart guns to poison their enemies with radioactive compounds - just to make it clear that we're solidly in the realm of using James Bond style bullshit to secure national interests in our particular scenario. If this nation state were to plant a device on the avionics bus that would spoof the airspeed readout and cause the pilot to nose up on takeoff before the plane has reached critical velocity, it would be very difficult to find this device in the aftermath of the fiery crash, and also very difficult to not blame this on a faulty sensor or pilot error. I say fiery, because there would likely be a full tank of fuel, further reducing survivability in this scenario. A scary thought.
    - constantcrying 2y ago
      This can be accomplished just as easily by targeting the analog input for the actuators or the analog input of the stick. Or attack one of the other myriads safety critical systems outside of the bus.
      - giantg2 2y ago
        And... attacking manually gives more plausibility to it being an accident rather than having a dongle attached to the plane, or code potentially surviving on the system.

63 points by pjf 2y ago

jstanley 2y ago

[flagged]

pictureofabear 2y ago
But why? To what end? And where would all the passengers be? That theory is outlandish, not because of the technical considerations, but the seeming lack of motivation for doing that. A cursory Google search shows that Jeff Wise doesn't have a plausible theory of motivation either.
- jstanley 2y ago
  [flagged]
  - pictureofabear 2y ago
    Right, but you can test this real-world with much lower stakes. Airliner aircraft are relatively cheap and easy to acquire. SCUBA gear is for diving underwater where pressure increases, not for breathing high in the atmosphere where air pressure is lower. There are plenty of suitable breathing apparatuses made for breathing at altitude. SCUBA gear and knowledge is irrelevant to this situation. There are a multitude of ways to target an individual or a particular piece of cargo without killing so many people in such public fashion. The attempt to use abductive reasoning here falls short because you're choosing the least likely explanations when far simpler and more plausible explanations exist. Conspiracy theories like this often, at their heart, rely on an assumption that governments are either irrational or have hidden motivations, but both of these assumptions require a heavy amount of evidence to outweigh all of the evidence to the contrary.
  - ejj28 2y ago
    I don't buy that hijacking a plane and disappearing it and covering it all up, in the process generating extreme publicity, is anywhere near a practical method of kidnapping a person or acquiring a "ghost airliner", and it would be an incredibly risky and brazen 'real-world test of the capability'.
  - bufferoverflow 2y ago
    You can just buy an airplane if you're a state actor. Why kill hundreds of passengers?
MaKey 2y ago
> I don't know enough to judge whether it is likely or not, but it's a pretty fascinating idea. The fact that some debris of MH370 has been washed ashore means it crashed into the ocean. The plane just hasn't been found (yet). Mentour pilot has a good video on the subject: https://youtube.com/watch?v=MvmfyO8GvTE https://youtube.com/watch?v=MvmfyO8GvTE Summary: Captain likely hijacked the plane, depressurized the cabin, used his knowledge to avoid detection and crashed the plane into the ocean.

byyoung3 2y ago

[flagged]

floatingcloud12 2y ago
[dead]
joe_the_user 2y ago
"They did it to distract the media!" must the worst conspiracy theory form ever
- byyoung3 2y ago
  [flagged]

wucke13 2y ago

The observation that ARINC 429 can be tapped, and that an active wiretap can alter data on the bus is of little surprise. The technological challenge is not high, the bus is comparable to a serialport at ~115200 baud. Considering that the technology surfaced in the 1970s, it is of no surprise that physical access restriction is the only means of security. More interesting IMHO would be what can be done to accelerate the adoption of new technologies (especially w/r/t cryptography) in avionics. This is more than anything a cultural problem; How to convince regulative bodies, how to satisfy processes, how to re-balance the proven-in-use argument (where stuff gets more favorable safety assessments when it has been used long enough) vs crypto-agility (where the same thing from today just tomorrow becomes insecure without changing itself, because of some external discovery). The technology is there, but the aviation community is not yet. Another nice read in this domain is "Economy Class Crypto: Exploring Weak Cipher: Usage in Avionic Communications via ACARS"[1, 2]. I only say mono-alphabetic substitution cipher. An interesting connection of Blockchain-tech, safety and security can be found in "Verifiable Computing in Avionics for Assuring Computer-Integrity without Replication" [3]. Here the authors leverages zero-knowledge proofs to prove to a downstream actuator that its commands are indeed correct results yielded by the application of the appropriate control law on the provided sensor inputs. However, this work is probably at least a decade away from being applicable in actual certified aircraft. [1] https://link.springer.com/chapter/10.1007/978-3-319-70972-7_15 https://link.springer.com/chapter/10.1007/978-3-319-70972-7_... [2] https://www.cs.ox.ac.uk/files/9693/fc-paper.pdf https://www.cs.ox.ac.uk/files/9693/fc-paper.pdf [3] https://publ.sec.uni-stuttgart.de/reinhartluettighuberliedtkeannighoefer-dasc-2023.pdf https://publ.sec.uni-stuttgart.de/reinhartluettighuberliedtk...

masfuerte 2y ago
I don't want the cockpit to lose contact with the engines during a flight because a certificate just expired. And even if this particular example isn't realistic, adding security to a system will necessarily add lots of new failure modes. It seems likely that it will be really hard to do this without making the system as a whole less reliable.
- GTP 2y ago

rectang 2y ago

From the abstract: > This paper investigates cyber-physical attacks on avionics data buses, specifically focusing on the ARINC 429 protocol. The objective is to demonstrate how message injection, modification, and deletion attacks can be executed, enabling an attacker to gain full control over the transmitted data. I wish that vehicular systems all had air-gap level separation of messages, rendering it physically impossible to disrupt messages to critical systems like flight controls. I suppose that's a naive perspective, but in the long run it's hard to believe that we won't have to resort to provably correct systems to thwart attacks. > To accomplish this, we propose a method that involves modifying messages on the data bus without segmenting it. Can we really live with avionics platforms as a setting for the same kind of perpetual arms race against attackers that we have for general operating systems?

joe_the_user 2y ago
Another question would be: "Can we create systems intended to be permanently disconnected from the Internet?". Unfortunately, the answer seems to be no. You can see indications in the way that small water purification systems connect to the net just to save engineers from going in a weekends.
- constantcrying 2y ago
  >"Can we create systems intended to be permanently disconnected from the Internet?" Any modern jet will function without internet.
  - buildsjets 2y ago
    Not permanently, which is the conjecture laid out by OP. At some point, there will need to be nav data updates, updates to the aircraft's required systems, updates to IFE systems, etc. Modern jets do all of that wirelessly. Additionally, every single modern jet uploads all recorded engine parameters from the flight to the engine manufacturer after it arrives at the gate. Do I know what I am talking about? Ref. username.

constantcrying 2y ago

To be honest this is both unsurprising and IMO very irrelevant. Spoofing a CAN or ARINC429 bus requires physical access. At that point an attacker has access to the physical systems of the plane, at which point the plane is compromised anyway. What he uses to take over the plane is essentially arbitrary and there is absolutely nothing that would give any protection.

bilbo0s 2y ago
I was wondering why anyone would go through all that trouble if s/he already had that level of control of the plane? Good to have someone more knowledgeable explain that I'm not necessarily crazy.
- Two4 2y ago
  Imagine a scenario where a plane is carrying a person who is enemy to a certain nation state. A nation state who is not above, say, using umbrella air dart guns to poison their enemies with radioactive compounds - just to make it clear that we're solidly in the realm of using James Bond style bullshit to secure national interests in our particular scenario. If this nation state were to plant a device on the avionics bus that would spoof the airspeed readout and cause the pilot to nose up on takeoff before the plane has reached critical velocity, it would be very difficult to find this device in the aftermath of the fiery crash, and also very difficult to not blame this on a faulty sensor or pilot error. I say fiery, because there would likely be a full tank of fuel, further reducing survivability in this scenario. A scary thought.
  - constantcrying 2y ago
    This can be accomplished just as easily by targeting the analog input for the actuators or the analog input of the stick. Or attack one of the other myriads safety critical systems outside of the bus.
    - giantg2 2y ago
      And... attacking manually gives more plausibility to it being an accident rather than having a dongle attached to the plane, or code potentially surviving on the system.