A security researcher who made headlines last month for bragging he’d hacked into a passenger jet’s internal computer systems while in flight appears to have performed the act more than a dozen times over a three-year period, based on a search warrant application published last week. The FBI filed the application in April.
Chris Roberts, founder and CTO of One World Labs, told FBI investigators in interviews during February and March that he’d hacked into the flight systems of commercial passenger aircraft from 15-20 times from 2011-2014, and on one occasion “caused one of the airplane engines to climb resulting in a lateral or sideways movement of the plane.”
Roberts claimed to have accessed various aircrafts’ flight systems by first breaking into the entertainment systems on the planes, according to an affidavit accompanying the FBI’s request for a search warrant to examine his electronic devices.
Roberts gained access to the in-flight entertainment system through the seat electronic box installed under the passenger seat of the airplanes, which he was able to access by removing its cover and wiggling or squeezing the box. When FBI agents checked the plane Roberts most recently flew in, they found that the SEB where he had been seated showed signs of tampering.
The FBI declined to comment for this story.
Dubious Claims
There’s considerable skepticism over Roberts’ claims. For example, the claim that he made a plane fly sideways doesn’t make sense, maintained Patrick Smith, an active airline pilot and author of Ask the Pilot.
“I mean, even a 7-year-old knows things like that don’t make sense. They’ve totally butchered it,” he told TechNewsWorld.
“What it sounds like they’re trying to say is that he somehow caused one engine to increase power, resulting in an asymmetrical thrust condition that could have caused the plane to ‘yaw’ a bit from side to side,” Smith said.
“Did this actually happen?” he asked. “Did the guy in fact gain access to the thrust settings, and to what extent? I don’t know. I’m skeptical, though maybe it’s possible.”
United Airlines also doubted Roberts’s claims.
“We will continue to cooperate with the FBI on its investigation, but our internal review with our aircraft manufacturer partners makes us confident that these claims are unfounded,” spokesperson Christen David told TechNewsWorld.
Lateral Attacks
The U.S. Federal Aviation Administration threw cold water on Roberts’s assertions as well.
“The FAA and industry have worked on cybersecurity threats to commercial airplanes over the past 20 years,” said FAA spokesperson Les Dorr.
“The agency addresses cybersecurity on different types of aircraft through special conditions,” he told TechNewsWorld. “There have been no U.S. commercial accidents or incidents that resulted from intrusion into on-board aircraft systems from a wireless network or an airplane’s in-flight entertainment system.”
Roberts isn’t the first researcher to maintain he could break into a plane’s computer systems. Hugo Tesso in 2013 demonstrated at the Hack in a Box conference in Germany a proof-of-concept attack in which an airliner could be controlled from the ground through an Android app.
Whether or not those researchers can do what they say they can do, they’re exposing what should be a genuine area of concern for aircraft designers.
“The whole incident brings focus on the issue of what is called ‘lateral movement.’ Can someone with access to, for example, the in-flight entertainment system of an aircraft use that toe-hold to reach further into the network to do actual harm?” mused RedSeal Networks CTO Mike Lloyd.
No Worries
Lateral movement wasn’t a problem when planes were totally insulated for outside systems, but that’s not the case any more.
“They’re connected to the outside world in several different ways now, ranging from satellite-based networks for flight telemetry to others used to provide Internet access from passenger seats,” Lloyd told TechNewsWorld.
“As these networks proliferate, they inevitably touch, and any touchpoint is something an attacker can use,” he added. “The number of possible weak points multiplies over time.”
Should air travelers be fearful about their flights being hacked?
“For now, they shouldn’t be worried at all,” said Richard Stiennon, chief research analyst with IT Harvest.
“It hasn’t been proven that you can interfere with flight controls,” he told TechNewsWorld. “Add to that the small likelihood of someone wanting to do that — because they’d have to be suicidal if they wanted to do any damage — I don’t think we should be worried at all.”
Loading ...
