By Jennifer LeClaire / CIO Today. Updated August 05, 2014.
Are planes really at risk of cyberattack through the Wi-Fi connections we love to use while sky high? If you believe Ruben Santamarta, a consultant with cybersecurity firm IOActive, the answer is yes. But other security researchers are skeptical.
Santamarta, who has over 10 years in the security industry and has found dozens of vulnerabilities in major products, is sharing his insights at the Black Hat hacking conference in Las Vegas on Tuesday. If he’s right, it could usher in a new wave of scrutiny over airplane security in an age of cyber terrorism.
"These devices are wide open,” Santamarta told Reuters. “The goal of this talk is to help change that situation.”
A Wake Up Call?
Santamarta also told Reuters how attackers could strike. Essentially, he uncovered the vulnerabilities through reverse engineering the firmware communications equipment installed in airplanes. Through his work, he discovered that hackers could use an aircraft’s onboard Wi-Fi signal or inflight entertainment system to crack open its avionics equipment.
He explained to Reuters that such an attack could wreak havoc on satellite communications including interfering with the plane’s navigation and safety systems. Although he told Reuters that the attack may be difficult to replicate in real life, he’s nevertheless reaching out to equipment makers, including Harris Corp., EchoStar Corp.'s Hughes Network Systems, Cobham, Iridium Communications and Japan Radio to share his findings.
Santamarta first voiced these concerns in an April report. The finding also has implications for the maritime industry, military and governments, emergency services, and industrial and media sectors, he said.
“Insecure and undocumented protocols, backdoors, hard-coded credentials . . . mainly design flaws that allow remote attackers to fully compromise the affected devices using multiple attack vectors,” he wrote at that time. “Ships, aircraft, military personnel, emergency services, media services, and industrial facilities (oil rigs, gas pipelines, water treatment plants, wind turbines, substations, etc.) could all be affected by these vulnerabilities. I hope this research is seen as a wake-up call for both the vendors and users of the current generation of SATCOM (satellite communications) technology.”
Some Analysts Skeptical
We caught up with Zeus Kerravala, a principal analyst at ZK Research, to get his reaction to the study. He told us the claim is hard to believe.
“I’m skeptical,” he said. “It’s not a secure wireless signal so it could happen; there is certainly technology out there that could separate the navigation system from the communications system.”
We also turned to Ken Westin, a security analyst for security firm Tripwire, for thoughts on the news. He told us an important part is when Santamarta indicates: “In theory, a hacker could use a plane's onboard Wi-Fi signal or inflight entertainment system.” The key, he said, is the “in theory” part.
“Many of the exploits mentioned require physical access to the devices, which is not practical for it to be a serious exploit,” Westin said. “If I have physical access to a device I can turn it off, that doesn’t mean it is a security vulnerability. That being said, I wouldn’t downplay the vulnerabilities and it will be interesting to see how the manufacturers respond to the discoveries.”