Researcher hacks aircraft controls with Android smartphone

Forum adverts like this one are shown to any user who is not logged in. Join us by filling out a tiny 3 field form and you will get your own, free, dakka user account which gives a good range of benefits to you:

No adverts like this in the forums anymore.
Times and dates in your local timezone.
Full tracking of what you have read so you can skip to your first unread post, easily see what has changed since you last logged in, and easily see what is new at a glance.
Email notifications for threads you want to watch closely.
Being a part of the oldest wargaming community on the net.

If you are already a member then feel free to login now.

**reds8n**

.. and you were scared of flying before !

http://www.theregister.co.uk/2013/04/11/hacking_aircraft_with_android_handset/?fb_action_ids=511359565566198&fb_action_types=og.likes&fb_source=timeline_og&action_object_map=%7B%22511359565566198%22%3A437427923014608%7D&action_type_map=%7B%22511359565566198%22%3A%22og.likes%22%7D&action_ref_map=%5B%5D

A presentation at the Hack In The Box security summit in Amsterdam has demonstrated that it's possible to take control of aircraft flight systems and communications using an Android smartphone and some specialized attack code.

Hugo Teso, a security researcher at N.Runs and a commercial airline pilot, spent three years developing the code, buying second-hand commercial flight system software and hardware online and finding vulnerabilities within it. His presentation will cause a few sleepless nights among those with an interest in aircraft security.

Teso's attack code, dubbed SIMON, along with an Android app called PlaneSploit, can take full control of flight systems and the pilot's displays. The hacked aircraft could even be controlled using a smartphone's accelerometer to vary its course and speed by moving the handset about.

"You can use this system to modify approximately everything related to the navigation of the plane," Teso told Forbes. "That includes a lot of nasty things."

First, Teso looked at the Automatic Dependent Surveillance-Broadcast (ADS-B) system that updates ground controllers on an aircraft's position over a 1Mb/s data link. This has no security at all, he found, and could be used to passively eavesdrop on an aircraft's communications and also actively interrupt broadcasts or feed in misinformation.

Also vulnerable is the Aircraft Communications Addressing and Reporting System (ACARS), the communication relay used between pilots and ground controllers. Using a Samsung Galaxy handset, he demonstrated how to use ACARS to redirect an aircraft's navigation systems to different map coordinates.

"ACARS has no security at all. The airplane has no means to know if the messages it receives are valid or not," he said. "So they accept them and you can use them to upload data to the airplane that triggers these vulnerabilities. And then it's game over."

Teso was also able to use flaws in ACARS to insert code into a virtual aircraft's Flight Management System. By running the code between the aircraft's computer unit and the pilot's display he was able to take control of what the aircrew would be seeing in the cockpit and change the direction, altitude, and speed of the compromised craft.

He admitted that some of this was moot, given that the human pilot could always override the automatic systems, but the software could be used to make cockpit displays go haywire or control other functions, like deploying oxygen masks or lights.

The precise nature of the code flaws wasn't released – for understandable reasons – but Teso says the Federal Aviation Administration and the European Aviation Safety Administration have both been informed and are working on fixing the issue. ®

**filbert**

So that's why you have to put it in flight safe mode...

**Medium of Death**

SIMON says "crash the plane into the side of a mountain".

I like how he made it an app. Make it as user friendly as possible, that's what this technology needs.

**reds8n**

Did strike me as perhaps being a bit too helpful.

Been an odd week for terrorists really.

http://www.dailymail.co.uk/news/article-2307317/Terrorist-widows-angry-Twitter-rant-al-Qaeda-prat-Wife-7-7-bomber-breaks-cover-accuse-rival-extremist-irritating.html

Terrorist widow's angry Twitter rant at al-Qaeda 'prat': Wife of 7/7 bomber breaks cover to accuse rival extremist of being 'irritating'

One would suggest if terrorists have been reduced to having twitter spats and online arguments we're well on our way to victory.

**p_gray99**

I'm surprised that they released that much info about it. It's incredibly unlikely that anyone would manage to do a similar hack before the problem's sorted and then go on to give the software to terrorists, but it's still giving away a major weakness in the aircraft control systems, even if not giving the details.

**Grey Templar**

Maybe its hacker bait?

Trying to see if anyone tries to pull this stunt before they "fix" the problem so they can catch somebody.

**OrlandotheTechnicoloured**

It could be that he felt there was a serious problem that he'd informed the authorities of but they were not doing anything/enough

release the info to the media and they HAVE to fix the issue both to cover their behinds, and because they now KNOW the terrorists know about it

**kronk**

Welp.

Grey Hound bus for me from now on.

**KalashnikovMarine**

...note to self, if someone's fiddling with their smart phone, attack them immediately.

**Peregrine**

And this is the important part:

He admitted that some of this was moot, given that the human pilot could always override the automatic systems, but the software could be used to make cockpit displays go haywire or control other functions, like deploying oxygen masks or lights.

Congratulations, you figured out a way to annoy people on a plane. I hope turning the lights off and dropping the oxygen masks is funny enough to make it worth the long prison sentence you're going to get.

(And yes, they would override it since it would be immediately obvious that something is wrong.)

**dogma**

No, the important part is that a person using Teso's method could take away a pilot's instruments, which are critical to flying something as large as a commercial airliner.

**Grey Templar**

dogma wrote:
No, the important part is that a person using Teso's method could take away a pilot's instruments, which are critical to flying something as large as a commercial airliner.

Which wouldn't put people in immediate danger unless flying purely by the instruments, it might be hard to navigate if there was bad weather. And hopefully the pilot can land the plane without using instruments.

Still, not a good thing for someone to be able to do. And if you can hack a plane with a smartphone, what else can you hack?

**Peregrine**

dogma wrote:
No, the important part is that a person using Teso's method could take away a pilot's instruments, which are critical to flying something as large as a commercial airliner.

Airplanes have backup instruments. It's slightly annoying to have to fall back on your mechanical instruments instead of your nice shiny computer screens, but there's no loss in safety.

**dogma**

Peregrine wrote:

Airplanes have backup instruments. It's slightly annoying to have to fall back on your mechanical instruments instead of your nice shiny computer screens, but there's no loss in safety.

Many commercial aircraft do not have mechanical standby systems.

**Grey Templar**

dogma wrote:
Peregrine wrote:

Airplanes have backup instruments. It's slightly annoying to have to fall back on your mechanical instruments instead of your nice shiny computer screens, but there's no loss in safety.

Many commercial aircraft do not have mechanical standby systems.

WHAT?

Dang, all the times i've been on a plane and they don't have mechanical backups? Thats not safe at all.

**Lordhat**

dogma wrote:
Peregrine wrote:

Airplanes have backup instruments. It's slightly annoying to have to fall back on your mechanical instruments instead of your nice shiny computer screens, but there's no loss in safety.

Many commercial aircraft do not have mechanical standby systems.

And if your horizon indicator is off by even a couple degrees in the wrong area of the world, it's entirely possible to redecorate the side of a mountain in '747 Fire'.

Or, just crash it into the ocean.

**Peregrine**

dogma wrote:
Many commercial aircraft do not have mechanical standby systems.

Really? Because even a tiny two-seat Cessna has to have backup instruments if you install a primary computer system. I find it really hard to believe that the FAA (an organization that loves regulations) approved airline flights on planes that lack even the basic airspeed/altitude/artificial horizon/compass backups (the only instruments you need to fly a plane).

(Technically you can install a second electronic backup from a short list of specifically approved options, but it has to be completely independent from the primary computer so hacking the primary one would do nothing to the backup.)

Lordhat wrote:
And if your horizon indicator is off by even a couple degrees in the wrong area of the world, it's entirely possible to redecorate the side of a mountain in '747 Fire'.

Or, just crash it into the ocean.

Except that's just a case of pilot error. A single instrument malfunctioned and somehow, despite realizing that there was a problem, the pilot just flew the plane into the ground instead of looking at the two perfectly functioning copies of it. If you have a pilot that doesn't screw up they just hand over control to the co-pilot and return to the airport for repairs.

**dogma**

Peregrine wrote:

Really? Because even a tiny two-seat Cessna has to have backup instruments if you install a primary computer system. I find it really hard to believe that the FAA (an organization that loves regulations) approved airline flights on planes that lack even the basic airspeed/altitude/artificial horizon/compass backups (the only instruments you need to fly a plane).

You're being disingenuous. I never claimed that many aircraft lack standby instruments. In fact I claimed:

dogma wrote:

Many commercial aircraft do not have mechanical standby systems.

You should note the word in bold.

Peregrine wrote:

(Technically you can install a second electronic backup from a short list of specifically approved options, but it has to be completely independent from the primary computer so hacking the primary one would do nothing to the backup.)

That's true, but ACARS also interfaces with ISIS's, so there is no reason to assume Teso's method would be confined to the primary instrument system.

**Peregrine**

dogma wrote:
I never claimed that many aircraft lack standby instruments.

Well, the context of the response (to a quote where the 'mechanical' vs. electronic' technicality is irrelevant) made it sound like you were disputing my claim of easily-used and equally safe backup instruments rather than just mentioning the small number of aircraft with backup electronic instruments instead of mechanical ones.

That's true, but ACARS also interfaces with ISIS, so there is no reason to assume Teso's method would be confined to the primary instrument system.

There's a good reason because the backups (at least on the planes I'm familiar with) have to be entirely isolated from the main instruments. The only legal options are a set of a mechanical backups (which obviously can't be hacked), or a small self-contained "glass cockpit" style one that includes the basic airspeed/altimeter/artificial horizon on a single screen with its own connection to the pitot/static system. Having your backups interface with the primary system would completely defeat the purpose of having backups, especially since a minimalist backup system would have absolutely no reason to even be capable of receiving data from the outside world.

**Lordhat**

Peregrine wrote:

Except that's just a case of pilot error. A single instrument malfunctioned and somehow, despite realizing that there was a problem, the pilot just flew the plane into the ground instead of looking at the two perfectly functioning copies of it. If you have a pilot that doesn't screw up they just hand over control to the co-pilot and return to the airport for repairs.

Apparently it happens easily enough when there's a lack of visual reference; the human sensory system is very fallible in the air.

**Peregrine**

Lordhat wrote:
Apparently it happens easily enough when there's a lack of visual reference; the human sensory system is very fallible in the air.

Which is why lesson #1 about instrument flying is to ignore the view outside and only use your instruments. You get that lesson before they even let you fly a plane solo, and there's no excuse for forgetting it. The pilot recognized that something was wrong with his artificial horizon, he just failed to do what he was trained to do and move to the backups. Had he not made an incredibly basic mistake he would have been able to use the other instruments (including two fully functioning artificial horizons) to fly the plane without incident.

(Most cases of crashes due to spatial disorientation involve pilots who aren't trained/licensed for instrument-only flying and panic when they hit the clouds instead of remembering the basic lessons in instrument flying that every pilot gets. An airline pilot would have many hours of flight in instrument-only conditions and would be well beyond the point where that kind of panic would be excusable.)

**Lordhat**

Peregrine wrote:
Lordhat wrote:
Apparently it happens easily enough when there's a lack of visual reference; the human sensory system is very fallible in the air.

Which is why lesson #1 about instrument flying is to ignore the view outside and only use your instruments. You get that lesson before they even let you fly a plane solo, and there's no excuse for forgetting it. The pilot recognized that something was wrong with his artificial horizon, he just failed to do what he was trained to do and move to the backups. Had he not made an incredibly basic mistake he would have been able to use the other instruments (including two fully functioning artificial horizons) to fly the plane without incident.

(Most cases of crashes due to spatial disorientation involve pilots who aren't trained/licensed for instrument-only flying and panic when they hit the clouds instead of remembering the basic lessons in instrument flying that every pilot gets. An airline pilot would have many hours of flight in instrument-only conditions and would be well beyond the point where that kind of panic would be excusable.)

The point is that the main instruments can be fed data which is perceptibly indistinguishable from the correct orientation / position. How often do pilots check the backups when absolutely nothing feels wrong in relation to their panels? I'm no expert, but from what I gathered the false data can be sent both ways at once, exacerbating the difference in data and reality.

**dogma**

Peregrine wrote:

Having your backups interface with the primary system would completely defeat the purpose of having backups, especially since a minimalist backup system would have absolutely no reason to even be capable of receiving data from the outside world.

They don't interface with the primary on board system, they interface with ACARS. Or so I'm lead to believe by claims that Air France 447's ACARS transmissions included automated messages from the plane's ISIS.

**Peregrine**

dogma wrote:
They don't interface with the primary on board system, they interface with ACARS. Or so I'm lead to believe by claims that Air France 447's ACARS transmissions included automated messages from the plane's ISIS.

But you don't want your backups interfacing with anything. The backup is supposed to be a simple and reliable way of getting the minimum information necessary to keep flying safely in the event of a failure in the primary instruments. You need to be absolutely 100% sure that no matter what happens to the primary computers the backups will work properly. Adding more features than necessary just makes it more complex and more vulnerable to bugs of its own, while adding the ability to reprogram or alter your last-resort "if this breaks the plane crashes" emergency instruments in flight would be so utterly stupid that I can't imagine any sensible engineer thinking it would be a good idea. Ideally you want a sealed box with no inputs from anything but the pitot/static system so that there's no possible way that a stupid pilot or malfunctioning computer system can do anything at all to stop it from working properly.

The most I could possibly imagine would be the backup instruments having output-only status messages (for example, reporting its own failure so that the pilots know they can't use it), but it defeats the purpose of a backup if you have it accepting inputs from the main computer.

Lordhat wrote:
The point is that the main instruments can be fed data which is perceptibly indistinguishable from the correct orientation / position. How often do pilots check the backups when absolutely nothing feels wrong in relation to their panels? I'm no expert, but from what I gathered the false data can be sent both ways at once, exacerbating the difference in data and reality.

You don't check the backups, but you're constantly checking the main instruments (at least when in instrument-only conditions and you can't just look out the window to avoid crashing) and you're going to spot any errors because you know what the plane is supposed to be doing. If the artificial horizon shows a left bank when you're supposed to be flying straight you immediately try to correct it. If you fail to correct it and you don't get the expected result you know immediately that something is wrong, and your first response is going to be to check the backup instruments.

And if you have something that's so subtle that it won't be noticed then it's not going to have any meaningful effect.

**dogma**

Peregrine wrote:

Adding more features than necessary just makes it more complex and more vulnerable to bugs of its own, while adding the ability to reprogram or alter your last-resort "if this breaks the plane crashes" emergency instruments in flight would be so utterly stupid that I can't imagine any sensible engineer thinking it would be a good idea.

Its a hack, not a feature. Apple didn't add the ability to run Android on an iPhone, but its been done.

Peregrine wrote:

The most I could possibly imagine would be the backup instruments having output-only status messages (for example, reporting its own failure so that the pilots know they can't use it), but it defeats the purpose of a backup if you have it accepting inputs from the main computer.

All I know is that the ISIS on AF447 apparently reported a system failure via ACARS, which means it was either connected to ACARS (which is the source of Teso's intrusion) directly, or via the primary computer.

**Peregrine**

Here's an article given at the bottom of the one in the OP: http://www.theregister.co.uk/2013/04/13/faa_debunks_android_hijack_claim/ . Looks like he just hacked a simulator, not the real hardware, and the hack would be impossible on the real thing. Probably what happened is that the simulator version of the software contains additional debugging or training features that allow you to input stuff from outside that the real hardware wouldn't accept, and the real thing is (sensibly) designed so that overriding it from outside the plane just isn't even possible.

dogma wrote:
Its a hack, not a feature. Apple didn't add the ability to run Android on an iPhone, but its been done.

And my point is that a hack doesn't work if the backup instrument doesn't contain a pointless* feature to allow it to receive commands or data from outside. Unless the person designing it (and everyone approving and testing it) is unbelievably incompetent hacking the backup instruments to receive and use invalid data would be about as plausible as hacking a cardboard box to run android.

*Pointless since you're talking about something that exists for the sole purpose of saving your life if the main computer breaks. Since you're using the backup under the assumption that the main computer is not working properly there's no reason that you'd ever want to trust or even listen to anything that it says.

All I know is that the ISIS on AF447 apparently reported a system failure via ACARS, which means it was either connected to ACARS (which is the source of Teso's intrusion) directly, or via the primary computer.

Connection isn't the same thing as interfacing. If the ISIS has an output-only connection for reporting status messages that's not the same thing as being able to receive anything.

**dogma**

I'm impressed, you actually managed to have a sensible conversation with me, and prove me wrong.

**p_gray99**

Surely if shining lasers into the sky can be enough to distract a pilot, they wouldn't want this distraction to be known of by any terrorists?

**KingCracker**

Peregrine wrote:
And this is the important part:

He admitted that some of this was moot, given that the human pilot could always override the automatic systems, but the software could be used to make cockpit displays go haywire or control other functions, like deploying oxygen masks or lights.

Congratulations, you figured out a way to annoy people on a plane. I hope turning the lights off and dropping the oxygen masks is funny enough to make it worth the long prison sentence you're going to get.

(And yes, they would override it since it would be immediately obvious that something is wrong.)

So youre saying "who cares if they can hack into a jet with a phone! All they can do is flush the toilets!" Really? Youre not at all concerned with the fact that people can hack a jet....full of people.... just like that? Interesting logic there

**Seaward**

KingCracker wrote:

So youre saying "who cares if they can hack into a jet with a phone! All they can do is flush the toilets!" Really? Youre not at all concerned with the fact that people can hack a jet....full of people.... just like that? Interesting logic there

Well, they can't, first of all.

And I'm far more concerned with the two pilots up in the cockpit playing Angry Birds as they overshoot Cleveland and the TSA guys on the ground who let 80% of dangerous, banned items through security than I am with the Android nerd.