Hackers Can Attack Passenger Jets Via Wi-Fi Signal
2014-08-11 08:51:54
Ruben Santamarta, cybersecurity researcher of IOActive says he has found a way to hack satellite communications equipment on passenger jets. To do this, he said, hackers could use on-board Wi-Fi network and entertainment systems for passengers.
Santamarta is going to present the technical details of his research in Las Vegas at the annual Black Hat conference – an event visited by thousands of security experts.
In theory, a hacker could use a plane's onboard Wi-Fi signal or entertainment system to hack into its system of satellite communications, which is connected directly to aircraft's navigation and safety systems, said Santamarta. Such conclusion is supported by tests conducted in IOActive's laboratory in Madrid. According to Santamarta, it will be difficult to re-enact the procedure in a real world situation, but he had decided to publish his discovery so that manufacturers could fix security flaws.
Representatives of Cobham, Harris, Hughes and Iridium confirmed some of Santamarta’s findings, but denied the risks.
Cobham specialists whose Aviation 700 aircraft satellite communications equipment was the focus of Santamarta’s research, say it is not possible for hackers to use Wi-Fi signal to interfere with key systems of a plane. In particular, Cobham spokesman Greg Caires says that hackers must have physical access to Cobham's equipment. "There are strict requirements in the aviation and maritime markets restricting such access to authorized personnel only," explained Caires.
In April, Santamarta published a 25-page research report, which describes multiple bugs in firmware used in satellite communications equipment made by Cobham, Harris, Hughes, Iridium and Japan Radio Co, which is used in different industries, including aerospace, military, maritime transportation, energy and communications.
Harris spokesman Jim Burke assures that the company had reviewed Santamarta's research and concluded that the risk of compromise is very small.
One shared vulnerability can be found in equipment from all five manufacturers - the use of encoded access credentials that let service technicians access any piece of equipment with the same login and password. The problem is that hackers can retrieve those credentials by hacking into the firmware.
Hughes spokeswoman Judy Blake says that encoded credentials is a necessary feature of customer service and that the worst a hacker could do is to damage the communication link.
Santamarta is going to respond to the comments from manufacturers during the presentation.
"I am not sure we can actually launch an attack from the passenger inflight entertainment system into the cockpit," says Vincenzo Iozzo, representative of Black Hat administration. "But the vulnerabilities he discovered are pretty scary just because they involve very basic security things that vendors should already be aware of."
Black Hat conference was held for the first time in 1997, and has since been a venue for analytics to present breakthrough research. In 2009, Charlie Miller and Collin Mulliner demonstrated a method for hacking iPhones with text messages, prompting Apple to release a patch.
Источник: cbc.ca
Комментарии ()