The US government released a report yesterday warning of security threats facing modern aircraft, leading to stories from major publications claiming in-flght Wi-Fi could be hacked to take control of a passenger plane. But according to Dr Phil Polstra, a qualified pilot and professor of digital forensics at Bloomsburg University, the report contained much erroneous information.
Polstra believes the US Government Accountability Office (GAO) report was put together by people who didn't understand how modern aircraft actually work. He took umbrage with the claims that as airplanes are increasingly connected to the internet, the control systems on planes are in danger of being remotely compromised. He told FORBES over email that the avionics networks, which deal with flight controls and coordination, were simply not connected to the internet like Wi-Fi services. “To imply this is irresponsible.”
Whilst modern aircraft do use standardised internet connections over ethernet and IP addresses sending data to one another, there is no real threat to passenger safety from sky-high Wi-Fi hacks. “To imply that because IP is used for in-flight WiFi and also on the avionics networks means that you can automatically take over the avionics network makes about as much sense as saying you can take over the jet engines because they breath air like the passengers and there is no air gap between passengers who touch the plane and the engines which are attached to the plane,” Polstra said.
The GAO report, based largely on interviews with security experts , also indicated "if the cabin systems connect to the cockpit avionics systems (e.g., share the same physical wiring harness or router) and use the same networking platform, in this case IP, a user could subvert the firewall and access the cockpit avionics system from the cabin”. Polstra said that’s a big “if” and isn’t how current in-flight networks actually work.
“The information passed on to the inflight entertainment system is via something called a NED (Network Extension Device). This device is not a router. This is a device that must be programmed to pass certain information to the entertainment system (aircraft position, etc.).
"This is a one-way communication. Even if someone were able to send information back toward the avionics, they aren't listening for information from the in-flight entertainment systems... Since the computer doesn't try and read information on those wires it is not likely to be useful to an attacker.”
The 'deceptive' GAO image of a plane network
The GAO was “deceptive” in its depictions of airliner networks, such as in the image above, he added. “Just because the cabin has wireless and ground communication is also wireless doesn't mean the systems are ‘connected’.”
The media reports warning of Wi-Fi attacks were also odd - there was no clear mention of anything related to Wi-Fi in the whole GAO document.
There have been some cases, however, where networks have not been properly segmented, potentially leaving open vulnerabilities. Seven years ago, it emerged the flight control and infotainment networks on Boeing 787 aircraft were connected, with only a firewall blocking malicious traffic between the two. If that's still the case, then there's at least something to worry about.
