Air-Bus Hijacking: Silently Taking over Avionics Systems
dl.acm.org
dl.acm.org
Spoofing a CAN or ARINC429 bus requires physical access. At that point an attacker has access to the physical systems of the plane, at which point the plane is compromised anyway. What he uses to take over the plane is essentially arbitrary and there is absolutely nothing that would give any protection.
Good to have someone more knowledgeable explain that I'm not necessarily crazy.
Car bombings still happen sometimes but it’s much easier to just shoot someone or push them off a balcony.
That he was killed by manipulating the data bus seems entirely speculative and exceedingly unlikely. If you have that kind of access to the plane you can plant a bomb or if you just want to down the plane Russia has potent anti-air weapons which trivially can take down a sub sonic passenger jet.
The chances of a attack like this being undetectable are exceedingly low. You would likely need to compromise nearly every aspect of the plane to make sure you have suppressed every available cross-checking mechanism. Does not stop it from happening, but it would not, in any way, be some sort of magic assassin weapon.
[1] https://en.wikipedia.org/wiki/Pan_Am_Flight_103_bombing_inve...
It wasn't the super deep check of the debris that pointed them to a bomb,it was a process that started with watching debris on primary radars fall away from a point where a moment before a transponder was squawking, it was finding the pressure spike on VCR and FDR, it was finding explicit explosion-affected parts, which guided which parts to reconstruct in 3D (very rare thing to do), and to finally find remains of the bomb itself.
I think there is concern there with undiagnosable crashes, but also a more pronounced concern with hijacking. If you have access to the plane you can just plant a bomb. With this you could capture the plane for hostage or turn it into a missile.
Either that, or you must make your way into the bay while in flight with said wirecutters.
Now, a dongle quietly manipulating enough variables to make the plane uncontrollable in flight, on the other hand... (No idea if that is even possible given access to this bus, but I will read this paper with some interest tomorrow (As I fly AMS-EWR... :)
Manipulating sensors is probably comparably easy, and, if you can adjust the AOA sensors to make the plane think its in level flight while spoofing altitude data, you can probably manipulate the pilots (auto or not) into a CFIT.
It's happened on other flights where pilots became confused by conflicting information (AF447 and many others) so giving them consistently wrong data is going to cause a consistently bad output.
Anyway though I deeply agree that once you have physical access all bets are off. Sure, you can put a bug in which causes a complicated aircraft failure but you could also just put a time-delayed container of thermite or tannerite in the right place.
I'd be much more worried about a software update causing a major issue, either intentionally or even more likely and more worrying, accidentally ALA 737Max.
Why? The flight sticks have an ADC, just control current/resistance there to get the desired digital values. Of course assuming fly by wire an symmetrical input on both sticks.
Probably far easier than manipulating the digital data downstream, which is subject to lots of checks.
https://www.cnn.com/2015/05/17/us/fbi-hacker-flight-computer...
I gather a perp only has to access the right piece of equipment in any phase of the logistics.
These buses are employed mostly in the avionics industry, but they are also utilized in ground vehicles, weapons systems, and other commercial and military equipment industries.[1]
Just because someone can load up my car on a flat bed tow truck doesn't mean it's pointless for me to have locks on the doors and ignition.
No, wasting time, resources and money while increasing the inherent complexity and risk of a system to gain absolutely no benefit is a very bad idea.
>Just because someone can load up my car on a flat bed tow truck doesn't mean it's pointless for me to have locks on the doors and ignition.
Idiotic comparison, which makes me think you are just totally disingenuous. The point I made was that with the same amount of effort a plane is compromised, with or without a secure bus. This is fake security, it doesn't protect anything.
Just tell me an attack on the bus of an airplane which couldn't have just as easily been performed outside of the bus.
Timed attacks on multiple aircrafts. Don't underestimate people with evil intentions...
I worked for ages in the automotive industry. Here is the thing: They don't have just one CAN bus, but multiple, connected via gateways that function both as message router and also firewall between these busses. At least that is the idea, the reality is ... commercial software development with all the issues that come with it (see various hacks where they broke through these gateways).
Someone posted a story as part of this subthread here, i.e. if a passenger is able to access an airplane bus and issue engine control commands that actually do something, the overall security setup is utterly broken. The infotainment units in the passenger cabin requiring access to some internal bus is actually ok, but issuing flight control commands from these should be (silently?) ignored, and this can only happen if you partition the busses via such gateways, for example.
Funnily enough, in this case it also helps safety, because you can be more relaxed about the overall (software) quality of these infotainment units (decomposition effect in safety systems).
> This paper investigates cyber-physical attacks on avionics data buses, specifically focusing on the ARINC 429 protocol. The objective is to demonstrate how message injection, modification, and deletion attacks can be executed, enabling an attacker to gain full control over the transmitted data.
I wish that vehicular systems all had air-gap level separation of messages, rendering it physically impossible to disrupt messages to critical systems like flight controls. I suppose that's a naive perspective, but in the long run it's hard to believe that we won't have to resort to provably correct systems to thwart attacks.
> To accomplish this, we propose a method that involves modifying messages on the data bus without segmenting it.
Can we really live with avionics platforms as a setting for the same kind of perpetual arms race against attackers that we have for general operating systems?
Any modern jet will function without internet.
Even though, a modern jet is still able to function without internet.
Internet is almost certainly the cheapest and easiest thing, which is why it's used.
>I wish that vehicular systems all had air-gap level separation of messages, rendering it physically impossible to disrupt messages to critical systems like flight controls.
This is just false. There is nothing in the world which makes physically separating two airplane systems impossible.
>Can we really live with avionics platforms as a setting for the same kind of perpetual arms race against attackers that we have for general operating systems?
The comparison is false. OSs are exposed to the entire world. Airplane systems require physical access.
... to potentially only one of the components within the system, at any point in its lifetime, across the entire supply chain and all build, test/verify, operations and maintenance processes.
(Edit in reply to child: Yes, obviously "the components within the system" means those actually connected, not a number 3 sprocket in seat 63E's incline mechanism. You have re-iterated my point.)
And if you had control over the specific component you need the plane is already compromised, whether the bus is open to spoofing or not is an irrelevant question.
TL;DR it's already a standard and has been ever since possiblity of sharing the networks came to be
Not to say that physical compromise of the wire is unbeatable; encryption makes it effectively impossible to spoof or rewrite messages, but the wires and communication protocol are already only intended for communication between trusted components (if you are communicating to untrusted components then you have to use something else like a data diode). The only really interesting part of the highlighted attack vector is that the "trusted wires" are likely not particularly physically separated from "non-trusted wires" or easy access which makes physical compromise at least plausible to achieve for a external malicious actor as compared to physically modifying one of the actual critical flight computers.
From what I read ARINC 429 is a one-way bus making this completely redundant and unnecessary.
From what I'm reading, ARINC 429 is as air-gapped as you can get. It is a one-way serial protocol (separate wires for transmit and receive). Only the wires that need to be connected are. Messages go from->to where they need to be.
Unless by air gapped you literally mean "don't connect anything together" at which point you no longer have a functioning vehicle.
More interesting IMHO would be what can be done to accelerate the adoption of new technologies (especially w/r/t cryptography) in avionics. This is more than anything a cultural problem; How to convince regulative bodies, how to satisfy processes, how to re-balance the proven-in-use argument (where stuff gets more favorable safety assessments when it has been used long enough) vs crypto-agility (where the same thing from today just tomorrow becomes insecure without changing itself, because of some external discovery).
The technology is there, but the aviation community is not yet. Another nice read in this domain is "Economy Class Crypto: Exploring Weak Cipher: Usage in Avionic Communications via ACARS"[1, 2]. I only say mono-alphabetic substitution cipher.
An interesting connection of Blockchain-tech, safety and security can be found in "Verifiable Computing in Avionics for Assuring Computer-Integrity without Replication" [3]. Here the authors leverages zero-knowledge proofs to prove to a downstream actuator that its commands are indeed correct results yielded by the application of the appropriate control law on the provided sensor inputs. However, this work is probably at least a decade away from being applicable in actual certified aircraft.
[1] https://link.springer.com/chapter/10.1007/978-3-319-70972-7_... [2] https://www.cs.ox.ac.uk/files/9693/fc-paper.pdf [3] https://publ.sec.uni-stuttgart.de/reinhartluettighuberliedtk...
This would work in most cases, yes.
I think the point that 'masfuerte' was making is that simplicity and redundancy are _the_ bedrock of reliability.
Even if all the new hardware and software to implement this new security model on avionics busses is 100% open and audited by every laudable computer science / security specialist, it's just _more_ to possibly go wrong. That tends to change how people think about risk (weather rationally or not!)
The paper's method suppresses original message then generates btand-new one, so if the key is easy to find out, then the spoofed message will have a correct MAC. Which means you need a cryptographically secure method to distribute the key, but you also have multiple consumers and you want to be able to replace broken devices too. This sounds like a non-trivial cryptosystem, and assymetric crypto + certificates is one possible solution.
Also in some aircraft types these data buses are unfortunately not so very hard to access (i.e. accessible from the cabin, with undetected access being even plausible in some cases). So some resilience might not hurt in these cases.
It's important that failure of critical systems is far less threatening than systems providing plausible, yet incorrect data. Redundancy and monitoring catches most of the former but not the latter.