Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Parting from the reasonable supposition that "everything can be hacked", I am sure the answer is 'yes.' But is it something possible, or even feasible?

I know that airplane computer systems are proprietary, but that would be a pretty weak security by obscurity policy.

What else have they thought of, to harden the computer systems?

I ask due to a recent claim of the developer of PlaneSploit, Hugo Teso, who claims that he performed such a feast.

share|improve this question
Well for one thing, I'm willing to bet that their computer systems can only be accessed if you have physical access (the computer controlling the aircraft itself probably can't recieve anything without wires). And if someone does have unrestricted physical access... I guess that makes it their plane. –  KnightOfNi Mar 22 at 16:56
Airplane's computers doesn't really communicate with ground, there's ACARS but it's only one-way (plane -> ground) so there's no possibility to send the airplane some malicious packet that could exploit something, and systems that provide Wi-Fi on airplanes are separated from the actual airplane's computer so there's no way a hacker can connect to that Wi-Fi and do bad stuff. But yes, there are some other vulnerabilities, for example if a compromised firmware was installed on the computer. –  André Mar 22 at 16:56
add comment

1 Answer

The only totally secured system is one which is powered off and the cut up into pieces with an axe.

Some of they key goals of an airplane would be to keep it in the air and to know where you are located. Digital systems must obtain this information from sensors or from transmissions from some other system. Can you jam the airspace or interfere with beacons, radio, GPS, etc. EMP? so that the systems are fed inaccurate information? Can you take advantage of some trick of physics to trick the sensors into reading inaccurate input.

Maybe you compromise the system by installing unauthorized hardware or software before the plane takes off if the attacker gains physical access. Perhaps there is coding error of which an onboard spy can take advantage. Perhaps you just have a spy who is using his authorized commands to do something prohibited by protocol.

You can secure systems by ensuring there is proper encryption, authentication of source data, checks against replays - general stuff that is probably not there in commercial systems because of legacy systems and the need to upgrade the entire global infrastructure. There are probably additional physical protections to reduce EMI, etc. There are probably many things which could be improved security-wise, but it would be difficult to introduce these systemwide.

This high level explanation of PlaneSploit shows that there was a lack of encryption (authentication and integrity) controls in the systems attacked.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.