Aflaw in an in-flight entertainment system used by major airlines including Emirates, Virgin and Qatar could let hackers access a planes’ controls.
The security hole in the Panasonic Avionics in-flight system is used in planes run by 13 major airlines and could put passengers’ information and safety at risk, as well as disrupting their flight experience, according to researchers at IOActive. Panasonic denied that is is possible to inflict such damage through its systems.
Exploiting the problem, researcher Ruben Santamarta said hackers could “hijack” in-flight displays to change information such as altitude and location, control the cabin lighting and hack into the announcements system.
Santamarta said it was also possible, in some instances, to use the flaw to access credit card details of frequent fliers stored in the automatic payment system. And he said it hackers could “theoretically” exploit the vulnerability to access the aircraft’s controls, depending on the security of its systems.
“I don’t believe these systems can resist solid attacks from skilled malicious actors,” he said. “This only depends on the attacker’s determination and intentions, from a technical perspective it’s totally feasible.”
The extent of the damage the hack could inflict on a plane depends on how successfully the airline has isolated its systems. For example, the passenger entertainment shouldn’t be connected to the passenger owned devices or aircraft control. But sometimes it is.
As a result, Santamarta warned that airlines should be “incredibly vigilant” with in-flight systems and make sure they are properly segregated from the aircraft’s controls.
IOActive alerted Panasonic to the vulnerabilities back in March 2015, giving it sufficient time to fix the problems before going public with the information. It is not clear what action Panasonic has taken, but it denies the plausibility of the research.
“The allegations made by IOActive regarding in-flight entertainment systems manufactured by Panasonic Avionics contain a number of inaccurate and misleading statements,” said Panasonic Avionics. “IOActive has chosen to make highly misleading and inflammatory statements suggesting that hackers could ‘theoretically’ gain access to flight controls by hacking into Panasonic’s IFE systems.”
IOActive’s ethical hackers gained notoriety last year when they took control of a Jeep Cherokee from 10 miles away and cut its engine while driving on the motorway, making it veer off the road.
They did this by hacking into the Jeep’s on-board systems, which gave them access to the car’s steering, brakes and transmission. The flaw also affected more than 470,000 cars made by Fiat Chrysler.
In 2014, when he began hacking planes out of a fear of flying, Santamarta discovered hundreds of software updates for multiple major airlines publically available online that he has exploited in his research.
Using this he discovered another way to hack planes through their satellite communications systems. At the time, he demonstrated how a plane’s Wi-Fi or entertainment system could be used to tamper with satellite communications, or interfere with navigation and safety controls.
“I’ve been afraid of flying for as long as I can remember,” he said. “It might sound like a sick cure but, as a hacker, learning everything I could about how planes work, from the aerodynamics to electronics, has reduced the fear significantly.”
Emirates said it works with Panasonic to regularly update its systems and resolve any problems. “The safety of our passengers and crew on board is a priority and will not be compromised,” the company said.
Air France said safety is a “top priority” and it has a completely isolated flight control system that doesn’t connect to the on-board entertainment.
“Our aircraft manufacturers have robust systems and procedures in place for their aircraft and their operations to ensure security against potential plane cyber-attacks,” a spokesman said. “In all circumstances pilots always have path under control, autopilot could be disconnected at any time.”
Full list of affected airlines
· Aerolineas Argentinas
· American Airlines
In 2015, a prominent hacker managed to make an airliner “climb” and move “sideways” after infiltrating its in-flight entertainment system.
Chris Roberts, founder of the cybersecurity firm One World Labs, was escorted from a United Airlines flight after sending in-air tweets bragging that he could deploy the oxygen mask