Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Parting from the reasonable supposition that "everything can be hacked", I am sure the answer is 'yes.' But is it something possible, or even feasible?

I know that aeroplane computer systems are proprietary, but that would be a pretty weak security by obscurity policy.

What else have they thought of, to harden the computer systems?

I ask due to a recent claim of the developer of PlaneSploit, Hugo Teso, who claims that he performed such a feast.

share|improve this question
Well for one thing, I'm willing to bet that their computer systems can only be accessed if you have physical access (the computer controlling the aircraft itself probably can't recieve anything without wires). And if someone does have unrestricted physical access... I guess that makes it their plane. – KnightOfNi Mar 22 '14 at 16:56
Airplane's computers doesn't really communicate with ground, there's ACARS but it's only one-way (plane -> ground) so there's no possibility to send the airplane some malicious packet that could exploit something, and systems that provide Wi-Fi on airplanes are separated from the actual airplane's computer so there's no way a hacker can connect to that Wi-Fi and do bad stuff. But yes, there are some other vulnerabilities, for example if a compromised firmware was installed on the computer. – user42178 Mar 22 '14 at 16:56
You should define what you mean by 'hacking' and of course the aircraft (commercial, private, what). I assume you mean the sensational kid in the back row on a laptop sending commands to the plane making it go off course (saw it in a movie once). This really isnt feasible (currently) because so many of the aircraft's systems are either not digital (analog) or have no means to access apart from it's physical firmware. – Matthew Peters May 22 '14 at 18:00
@MatthewPeters: Hacking, in the sense of non-authorized intrusion, and taking control of the aircraft, which was a Boeing or Airbus. Plus points for scarier when doing it from the ground (not as a passenger in the plane). – Quora Feans May 22 '14 at 19:26
@Quora Feans, you're still rather vague. In any case, the challenge is creating the method that allows 'hacking'. Physically, an aircraft doesnt have critical components linked to a wireless access point. The only way I could thing of doing this would be to physically install a receiver and modifying the system controller(s) to use it. – Matthew Peters May 23 '14 at 12:45

The only totally secured system is one which is powered off and the cut up into pieces with an axe.

Some of they key goals of an airplane would be to keep it in the air and to know where you are located. Digital systems must obtain this information from sensors or from transmissions from some other system. Can you jam the airspace or interfere with beacons, radio, GPS, etc. EMP? so that the systems are fed inaccurate information? Can you take advantage of some trick of physics to trick the sensors into reading inaccurate input.

Maybe you compromise the system by installing unauthorized hardware or software before the plane takes off if the attacker gains physical access. Perhaps there is coding error of which an onboard spy can take advantage. Perhaps you just have a spy who is using his authorized commands to do something prohibited by protocol.

You can secure systems by ensuring there is proper encryption, authentication of source data, checks against replays - general stuff that is probably not there in commercial systems because of legacy systems and the need to upgrade the entire global infrastructure. There are probably additional physical protections to reduce EMI, etc. There are probably many things which could be improved security-wise, but it would be difficult to introduce these systemwide.

This high level explanation of PlaneSploit shows that there was a lack of encryption (authentication and integrity) controls in the systems attacked.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.