4 ms·

I used to make avionics for a living and I don't even understand what this man is talking about. (I don't think he does too) That seems to be just an ACARS snif

I used to make avionics for a living and I don't even understand what this man is talking about. (I don't think he does too) That seems to be just an ACARS sniffer. ACARS and ADS-b has nothing do to with aircraft control systems. You don't need an android app to intercept satellite communication and even if you 'root' the ACARS computer, it is not connected to the systems that could control the airplane. Also: to pass DO-254 at level A you must have physical switches for flight/computer functionality, that said, no software can engage autopilot or change AP behavior, you need physical switches to do that. They are NOT similar to keyboard buttons, those switches actually interfere at the hardware level.

wyck 14y ago
Did you read the part of the article that says, > gather information about the onboard computer as well as to exploit its vulnerabilities by delivering spoofed malicious messages that affect the "behavior" of the plane. Being able to control the flight management system, which as you probably know controls much of the automation in a plane including the flight path and position sounds pretty dire. Also sending false data to a plane/pilots poses a security threat in of itself without taking over the FMS.
- steven777400 14y ago
  But that's the question: How? The spoofed messages is easy to believe, but these message systems (ADS-B and ACARS) do not interface with the FMS and thus an attacker should not be able to take over the FMS in this way. So some critical piece of information is missing.
  - jccooper 14y ago
    ...perhaps intentionally. Which would be a responsible thing to do.
maddddddddddddd 14y ago
what if you sent a rogue signal that made your plane think that another plane was about to hit it? would your plane react automatically to try and avoid it?
bdg 14y ago
Most crashes happen due to pilot error, especially connected to the instruments. Something as simple as a bad from the six-pack of a small plane could be bad news (note: these are usually 100% mechanical systems). As a pilot of small aircraft, goofing up my instruments might help me tie the world record for "lowest flight ever". Something as simple as coordinating my turns with a bad indicator might make me go into a spin (I'm fairly inexperienced). I can only imagine what would happen to a big jet.
- ajross 14y ago
  There's a logical fallacy in there. Having access to the mechanism that causes "most accidents" only allows you to cause accidents with a frequency of the order with which those system failures cause accidents already. "Instrument-related pilot error" may (citation needed) cause "most accidents". There are still vanishingly few instrument-related pilot error accidents. (And in any case, ACARS isn't really an instrument, it's a datalink standard for communication with the outside world -- instruments internal to the aircraft don't use it.)
- repiret 14y ago
  You need your instructor to start covering up some instruments when you're flying. A typical single engine aircraft is pretty easy to fly without any instruments at all. That said, bad instrumentation can certainly take down a plane; Air France 447 was a combination of iced up pitot tubes (no air speed indicator) and bad piloting (incompetent stall recovery). HOWEVER, as a few other people have pointed out, this guy is only interfering with ADS-B and ACARS. Both of those are situational awareness tools, not flight instruments. I am aware of no commercial flight that has gone down due to a failure of situational awareness instruments. Taking out ADS-B and ACARS is no worse than taking out ground-based radar and VHF radios. People have known how to mess with radar and radios since their inception, but that hasn't posed a security risk for aviation. I expect ADS_B, ACARS and GPS vulnerabilities to be the same.
- mikeash 14y ago
  > Something as simple as coordinating my turns with a bad indicator might make me go into a spin (I'm fairly inexperienced). Please don't take any (more?) solo flights until you've remedied this. It should be possible for a pilot to safely fly a small aircraft with no instruments whatsoever in VMC. Instruments do fail, and you must be ready. If you'll spin just because your turn coordinator is wonky, you're not safe. I've lost airspeed, altitude, and turn coordination. (Not at the same time.) The airspeed one got very interesting due to several confounding factors all hitting at once, and the other two were non-events. I would not sit in a cockpit without an instructor if I wasn't confident that I could safely return to the ground even if the entire instrument panel went away. Large aircraft are different, but please, get better training on no-instrument flying in your small craft.
HyprMusic 14y ago
" Attacks of this kind work only when the auto-pilot is on, so the trick is to switch it off, then fly the plane by using analog instruments. " Seems like auto-pilot is required to be on already. A wild guess, but maybe his exploit feeds the auto-pilot incorrect information, causing it to make counteracting decisions that effectively give him control.
joshwa 14y ago
I'm guessing the exploits he's talking about are buffer overflows in the on-board ACARS receivers. Correct me if I'm wrong, but I think that ACARS can directly update/access the FMS? If so, then you could exploit the vulnerability to change data in the FMS. If the autopilot is in nav mode, i.e. set to follow the flight plan in the FMS, then you could alter the course the plane follows. Perhaps also there is stuff you could do with the weight/balance info stored in the FMS? ACARS -> FMS -> A/P
- adrinavarro 14y ago
  The FMC would make you confirm accepting a new ACARS FPL.
- eduardordm 14y ago
  (I lost my reply on a copy-paste / expired link, let's try again) Sensors 'broadcast' the information across the systems in a very simple way (electronic but not hackable). Everyone get its data directly from sensors. The FMC is like a pilot without hands. It is a client of the flight control system (another computer) like the pilot itself. When the pilot connects it (this is physically controlled) it can change the parameters of the AP, but it stills not controlling the airplane. Hypothesis (this is wild): you physically get to the FMC and hack it. The only thing you will be able to do is to change the route (only if) it is engaged. But under a class A/B airspace, this will be immediately be noticed by air controllers that will notify the pilots. Anyway, the pilot should notice it right away. The FMC functionality is very restricted, really.
lifeisstillgood 14y ago
There seems to be two threads here bashing heads against each other 1. The specific details of this (admittedly movie-plot-threat) are wonky and not believed by reasonable people in the industry 2. The digital security of most systems when looked at by Internet-hardened veterans is somewhere between vulnerable and laughable, so why should planes be different (ie gas and water control pumps with ethernet ports and factory set default passwords like admin) 2. seems to be most peoples default response - "hey look, another thing thats been connected to the internet, its probably wide open" That is a good response to have as a) anecdotally it seems to be right 9 times out of 10, and b) its the right side of caution anyway. The fact that 1. is much harder to do than perhaps shown is indicative that things in the FAA arent as bad as say, sewage treatment industry. But, even so, all our systems are now connected and so much more vulnerable. And even if this guy cannot down planes with his android phone, he has gotten a hell of a lot closer than anyone not totally paranoid would assume. I think the correct response would be This specific setup does not apparently live up to the media hype. However, all digital security is undergoing a period of massively increased attack, and we should never be complacent. He has gotten further than we expected feasible and will be looking at a program of fixing attack vectors run under the same rules as air-crash investigation. Any known bug is investigated, understood and a comprehensive solution made transparently available to the industry. The airline industry is rightly proud of its safety record, and it should see this as an opportunity to become rightly proud of its digital security record too.
- gcr 14y ago
  There's a third angle: Exploits. UCSD and UW researchers have demonstrated the ability for an attacker to take full control of many modern cars just by dialing the car's 3G modem. By "full control", I mean everything from "unlock the doors and start the engine" to "engage/disable the brakes and stop the engine" Over a range of experiments, both in the lab and in road tests, we demonstrate the ability to adversarially control a wide range of automotive functions and completely ignore driver input — including disabling the brakes, selectively braking individual wheels on demand, stopping the engine, and so on. We find that it is possible to bypass rudimentary network security protections within the car, such as maliciously bridging between our car’s two internal subnets. http://www.autosec.org/pubs/cars-oakland2010.pdf http://www.autosec.org/pubs/cars-oakland2010.pdf Edit: No, they really did demonstrate these vulnerabilities on real cars, it's not a theoretical analysis. Here's a link to their full research talk: http://www.youtube.com/watch?v=bHfOziIwXic http://www.youtube.com/watch?v=bHfOziIwXic
jamesseattle 14y ago
I concur. I used to work on interfaces to all the computers on the latest 747 and the 787 and there is no wireless way to talk to any of the computers or sensors that have any input to controlling the airplane. I am not making this up. On the 747-400 I was on a group whose computer got input from all the 70+ computers on the airplane. It was all wired. On the 787 I worked on a database during the development of the airplane that tracked all the information that flowed between computers. Nothing came to any computer that controlled the airplane that was not by wire or fiber optics. I also dealt with ACARS. It is a read-only system on the airplane. It gets information from other computers and transmits it via satellite to the ground.
- gcb0 14y ago
  i believe you only dealt with the intended usage of the APIs and interfaces? this may be the same as someone that sets up a SCADA to the local city water&power and believe the intranet is isolated, until a month later another contract requires for a public server in the office and they just connect the entire thing to the internet.
  - AnIrishDuck 14y ago
    The main difference being that the FAA would never let such an "upgrade" happen on any consumer airplane.
    - gcb0 14y ago
      you would be surprised. i can't vouche for FAA, but hospital equipment manufacturer have even stricter regulation and there i can vouche for way worse 'upgrades'.
      - dchichkov 14y ago
        Let me add to the surprise. I once wrote a nice piece of software that controlled hospital equipment (automated blood coagulation analyzer, to be precise). It is a quite serious piece of equipment used for post-operation patient recovery. As far as I know, a well regulated area. Equipment went through stringent certification, passed all tests, deployed in hospitals, etc. All well and good, right? Did I mention, that I was 13, when I wrote that piece of software ;) And I guess you can imagine the quality of that code :)
michael_miller 14y ago
Wow, you used to work on avionics software? What was it like? Were the software development practices different? Did you use any static analysis / verification software to prove correctness? What were the software people at your company like? Were they all old guys with really conservative software development practices based on their battle hardened experiences? Were a lot of the people you worked with pilots? (Apologies for taking the thread OT, I'm just getting my pilot's license now and have always been fascinated by avionics.)
- eduardordm 14y ago
  http://eduardo.intermeta.com.br/posts/2013/2/10/making-aviation-sofware http://eduardo.intermeta.com.br/posts/2013/2/10/making-aviat...

wyck 14y ago

Did you read the part of the article that says, > gather information about the onboard computer as well as to exploit its vulnerabilities by delivering spoofed malicious messages that affect the "behavior" of the plane. Being able to control the flight management system, which as you probably know controls much of the automation in a plane including the flight path and position sounds pretty dire. Also sending false data to a plane/pilots poses a security threat in of itself without taking over the FMS.

steven777400 14y ago
But that's the question: How? The spoofed messages is easy to believe, but these message systems (ADS-B and ACARS) do not interface with the FMS and thus an attacker should not be able to take over the FMS in this way. So some critical piece of information is missing.
- jccooper 14y ago
  ...perhaps intentionally. Which would be a responsible thing to do.

maddddddddddddd 14y ago

what if you sent a rogue signal that made your plane think that another plane was about to hit it? would your plane react automatically to try and avoid it?

bdg 14y ago

Most crashes happen due to pilot error, especially connected to the instruments. Something as simple as a bad from the six-pack of a small plane could be bad news (note: these are usually 100% mechanical systems). As a pilot of small aircraft, goofing up my instruments might help me tie the world record for "lowest flight ever". Something as simple as coordinating my turns with a bad indicator might make me go into a spin (I'm fairly inexperienced). I can only imagine what would happen to a big jet.

ajross 14y ago
There's a logical fallacy in there. Having access to the mechanism that causes "most accidents" only allows you to cause accidents with a frequency of the order with which those system failures cause accidents already. "Instrument-related pilot error" may (citation needed) cause "most accidents". There are still vanishingly few instrument-related pilot error accidents. (And in any case, ACARS isn't really an instrument, it's a datalink standard for communication with the outside world -- instruments internal to the aircraft don't use it.)
repiret 14y ago
You need your instructor to start covering up some instruments when you're flying. A typical single engine aircraft is pretty easy to fly without any instruments at all. That said, bad instrumentation can certainly take down a plane; Air France 447 was a combination of iced up pitot tubes (no air speed indicator) and bad piloting (incompetent stall recovery). HOWEVER, as a few other people have pointed out, this guy is only interfering with ADS-B and ACARS. Both of those are situational awareness tools, not flight instruments. I am aware of no commercial flight that has gone down due to a failure of situational awareness instruments. Taking out ADS-B and ACARS is no worse than taking out ground-based radar and VHF radios. People have known how to mess with radar and radios since their inception, but that hasn't posed a security risk for aviation. I expect ADS_B, ACARS and GPS vulnerabilities to be the same.
mikeash 14y ago
> Something as simple as coordinating my turns with a bad indicator might make me go into a spin (I'm fairly inexperienced). Please don't take any (more?) solo flights until you've remedied this. It should be possible for a pilot to safely fly a small aircraft with no instruments whatsoever in VMC. Instruments do fail, and you must be ready. If you'll spin just because your turn coordinator is wonky, you're not safe. I've lost airspeed, altitude, and turn coordination. (Not at the same time.) The airspeed one got very interesting due to several confounding factors all hitting at once, and the other two were non-events. I would not sit in a cockpit without an instructor if I wasn't confident that I could safely return to the ground even if the entire instrument panel went away. Large aircraft are different, but please, get better training on no-instrument flying in your small craft.

HyprMusic 14y ago

" Attacks of this kind work only when the auto-pilot is on, so the trick is to switch it off, then fly the plane by using analog instruments. " Seems like auto-pilot is required to be on already. A wild guess, but maybe his exploit feeds the auto-pilot incorrect information, causing it to make counteracting decisions that effectively give him control.

joshwa 14y ago

I'm guessing the exploits he's talking about are buffer overflows in the on-board ACARS receivers. Correct me if I'm wrong, but I think that ACARS can directly update/access the FMS? If so, then you could exploit the vulnerability to change data in the FMS. If the autopilot is in nav mode, i.e. set to follow the flight plan in the FMS, then you could alter the course the plane follows. Perhaps also there is stuff you could do with the weight/balance info stored in the FMS? ACARS -> FMS -> A/P

adrinavarro 14y ago
The FMC would make you confirm accepting a new ACARS FPL.
eduardordm 14y ago
(I lost my reply on a copy-paste / expired link, let's try again) Sensors 'broadcast' the information across the systems in a very simple way (electronic but not hackable). Everyone get its data directly from sensors. The FMC is like a pilot without hands. It is a client of the flight control system (another computer) like the pilot itself. When the pilot connects it (this is physically controlled) it can change the parameters of the AP, but it stills not controlling the airplane. Hypothesis (this is wild): you physically get to the FMC and hack it. The only thing you will be able to do is to change the route (only if) it is engaged. But under a class A/B airspace, this will be immediately be noticed by air controllers that will notify the pilots. Anyway, the pilot should notice it right away. The FMC functionality is very restricted, really.

lifeisstillgood 14y ago

There seems to be two threads here bashing heads against each other 1. The specific details of this (admittedly movie-plot-threat) are wonky and not believed by reasonable people in the industry 2. The digital security of most systems when looked at by Internet-hardened veterans is somewhere between vulnerable and laughable, so why should planes be different (ie gas and water control pumps with ethernet ports and factory set default passwords like admin) 2. seems to be most peoples default response - "hey look, another thing thats been connected to the internet, its probably wide open" That is a good response to have as a) anecdotally it seems to be right 9 times out of 10, and b) its the right side of caution anyway. The fact that 1. is much harder to do than perhaps shown is indicative that things in the FAA arent as bad as say, sewage treatment industry. But, even so, all our systems are now connected and so much more vulnerable. And even if this guy cannot down planes with his android phone, he has gotten a hell of a lot closer than anyone not totally paranoid would assume. I think the correct response would be This specific setup does not apparently live up to the media hype. However, all digital security is undergoing a period of massively increased attack, and we should never be complacent. He has gotten further than we expected feasible and will be looking at a program of fixing attack vectors run under the same rules as air-crash investigation. Any known bug is investigated, understood and a comprehensive solution made transparently available to the industry. The airline industry is rightly proud of its safety record, and it should see this as an opportunity to become rightly proud of its digital security record too.

gcr 14y ago
There's a third angle: Exploits. UCSD and UW researchers have demonstrated the ability for an attacker to take full control of many modern cars just by dialing the car's 3G modem. By "full control", I mean everything from "unlock the doors and start the engine" to "engage/disable the brakes and stop the engine" Over a range of experiments, both in the lab and in road tests, we demonstrate the ability to adversarially control a wide range of automotive functions and completely ignore driver input — including disabling the brakes, selectively braking individual wheels on demand, stopping the engine, and so on. We find that it is possible to bypass rudimentary network security protections within the car, such as maliciously bridging between our car’s two internal subnets. http://www.autosec.org/pubs/cars-oakland2010.pdf http://www.autosec.org/pubs/cars-oakland2010.pdf Edit: No, they really did demonstrate these vulnerabilities on real cars, it's not a theoretical analysis. Here's a link to their full research talk: http://www.youtube.com/watch?v=bHfOziIwXic http://www.youtube.com/watch?v=bHfOziIwXic

jamesseattle 14y ago

I concur. I used to work on interfaces to all the computers on the latest 747 and the 787 and there is no wireless way to talk to any of the computers or sensors that have any input to controlling the airplane. I am not making this up. On the 747-400 I was on a group whose computer got input from all the 70+ computers on the airplane. It was all wired. On the 787 I worked on a database during the development of the airplane that tracked all the information that flowed between computers. Nothing came to any computer that controlled the airplane that was not by wire or fiber optics. I also dealt with ACARS. It is a read-only system on the airplane. It gets information from other computers and transmits it via satellite to the ground.

gcb0 14y ago
i believe you only dealt with the intended usage of the APIs and interfaces? this may be the same as someone that sets up a SCADA to the local city water&power and believe the intranet is isolated, until a month later another contract requires for a public server in the office and they just connect the entire thing to the internet.
- AnIrishDuck 14y ago
  The main difference being that the FAA would never let such an "upgrade" happen on any consumer airplane.
  - gcb0 14y ago
    you would be surprised. i can't vouche for FAA, but hospital equipment manufacturer have even stricter regulation and there i can vouche for way worse 'upgrades'.
    - dchichkov 14y ago
      Let me add to the surprise. I once wrote a nice piece of software that controlled hospital equipment (automated blood coagulation analyzer, to be precise). It is a quite serious piece of equipment used for post-operation patient recovery. As far as I know, a well regulated area. Equipment went through stringent certification, passed all tests, deployed in hospitals, etc. All well and good, right? Did I mention, that I was 13, when I wrote that piece of software ;) And I guess you can imagine the quality of that code :)

michael_miller 14y ago

Wow, you used to work on avionics software? What was it like? Were the software development practices different? Did you use any static analysis / verification software to prove correctness? What were the software people at your company like? Were they all old guys with really conservative software development practices based on their battle hardened experiences? Were a lot of the people you worked with pilots? (Apologies for taking the thread OT, I'm just getting my pilot's license now and have always been fascinated by avionics.)

eduardordm 14y ago
http://eduardo.intermeta.com.br/posts/2013/2/10/making-aviation-sofware http://eduardo.intermeta.com.br/posts/2013/2/10/making-aviat...