Of course, the attacker would never wish to be on the same flight, so in this article, we are going to talk about a potential loophole that could allow an attacker to exploit a vulnerability with some level of "unsupervised" physical access to a small aircraft before the plane takes off.
The United States Department of Homeland Security's (DHS) has issued an alert for the same, warning owners of small aircraft to be on guard against a vulnerability that could enable attackers to easily hack the plane's CAN bus and take control of key navigation systems.
The vulnerability, discovered by a cybersecurity researcher at Rapid 7, resides in the modern aircraft's implementation of CAN (Controller Area Network) bus—a popular vehicular networking standard used in automobiles and small aircraft that allows microcontrollers and devices to communicate with each other in applications without a host computer.
Rapid7 researcher Patrick Kiley demonstrated that a hacker with physical access to a small aircraft's wiring could attach a device—or co-opt an existing attached device—to the plane's avionics CAN bus to insert false data and communicate them to the pilot.
"Modern aircraft use a network of electronics to translate signals from the various sensors and place this data onto a network to be interpreted by the appropriate instruments and displayed to the pilot," Kiley said in a report published Tuesday.
The attacker can manipulate the following data:
- Engine telemetry readings
- Compass and attitude data
- Altitude, airspeed, and angle of attack (AoA) data
"The researchers have further outlined that a pilot relying on instrument readings would be unable to distinguish between false and legitimate readings, which could result in loss of control of the affected aircraft," the DHS' cyber division warned Tuesday.
Kiley demonstrated the attack after investigating avionics systems—an electronic control and navigation system fitted in an aircraft—from two unnamed commercial aircraft manufacturers specialized in light aircraft.
Kiley found that the key problem with the avionics CAN bus is that it is integrated into the aircraft's other components without any firewalls or authentication, which means untrusted connections over a USB adapter attached to the plane can send unauthorized commands to its electronic systems.
"In avionics, these systems provide the foundation of control systems and sensor systems and collect data such as altitude, airspeed, and engine parameters such as fuel level and oil pressure, then display them to the pilot," the researcher said.
"CAN packets also do not have recipient addresses or any kind of built-in authentication mechanism. This is what makes the bus easy to implement, but it also removes any assurance that the sending device was the actual originator of the message."
Though the attack sounds scary, it is not easy to gain "unsupervised" physical access to a plane, given "current industry practices and regulations," nevertheless, the Rapid7 report is worth paying attention to.
The researcher also pointed out that the avionics sector is lagging behind the automotive industry when it comes to the CAN bus system.
The automotive industry has made advancements in implementing safeguards, such as CAN bus-specific filtering, whitelisting, and segregation, that prevent similar physical attacks to CAN bus systems. Aircraft makers should also implement these safeguards.
The DHS' CISA is urging aircraft manufacturers to consider network protections around the CAN bus system and make sure they restrict access to their planes to the best of their abilities.
