Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

6/5/2018
10:00 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Researcher Successfully Hacked In-Flight Airplanes - From the Ground

IOActive researcher will demonstrate at Black Hat USA how satellite equipment can be 'weaponized.'

It's been four years since researcher Ruben Santamarta rocked the security world with his chilling discovery of major vulnerabilities in satellite equipment that could be abused to hijack and disrupt communications links to airplanes, ships, military operations, and industrial facilities.

Santamarta has now proven out those findings and taken his research to the level of terrifying, by successfully hacking into in-flight airplane WiFi networks and satcom equipment from the ground. "As far as I know I will be the first researcher that will demonstrate that it's possible to hack into communications devices on an in-flight aircraft … from the ground," he says.

He accessed on-board WiFi networks including passengers' Internet activity, and also was able to reach the planes' satcom equipment, he says, all of which in his previous research he had concluded – but not proven - was possible. And there's more: "In this new research, we also managed to get access to important communications devices in the aircraft," Santamarta, principal security consultant with IO/Active, says.

That's as much detail about the hack that Santamarta will share publicly before his Black Hat talk, where he plans to demonstrate just how he gained access to the aircraft and on-board satellite communications devices. He'll show how satcom gear could be weaponized as a radio frequency (RF) tool, he says, that ultimately could "pose security risks" to the aircraft.

Santamarta's previous work on hacking an airplane network had been met with some skepticism. "Everybody told us it was impossible. But basically, it's possible, and we [now] have proof and [will] present the proof of that."

He says he used similar satcom hacking techniques to locate multiple NATO military installations in conflict zones, which were exposed on the Internet, and employed similar methods to access maritime vessels' networks at sea, the details of which he'll also cover in his talk.

Not surprisingly, the vulnerability disclosure process associated with the research was, he says, "extremely sensitive." Santamarta contacted all of the affected parties, he says, and ensured that no hacks he performed would put anyone in physical danger, for instance. "We improved … security and safety" with this research, he says.

Security Holes

In his 2014 research, Santamarta provided a report on several possible attack scenarios using the vulnerabilities he had discovered in the firmware of popular satellite ground terminal equipment.

In his latest research he studied other satcom systems and infrastructure and found the usual suspects of industrial Internet of Things flaws: backdoors, insecure protocols, and hard-coded credentials as well as buffer overflows, code injections, and exposed services.

These vulnerabilities "allowed us to take control of these devices and allow anyone to access the satellite services," he says. "We can leverage satcom devices to perform cyber-physical attacks."

But like with Santamarta's previous research, the affected vendors and providers unfortunately aren't all on board with fixes for the newly discovered security holes. "The critical things have been fixed mostly. But there are other significant vulnerabilities that are still there, and that’s a still a problem," he says.

"The satcom environment right now is really a mess. That's one of the reasons we called this talk 'The Last Call for Satcom Security,'" he says. "It's really worrying me what I am seeing in this area."

He declined to discuss in detail just how much damage an attacker could do with the aircraft hack they pulled off, saying: "This has to be explained carefully, and we've got all the technical details backing our claim. It's not an apocalypse, but basically there are some scenarios that are possible" that will be covered at Black Hat, he says.

In his 2014 research, Santamarta found that an in-flight airline WiFi network was vulnerable to malicious behavior via vulnerable Cobham AVIATOR 700 satellite terminals on the WiFi. The danger there was an attacker gaining control over the Satellite Data Unit or the SwiftBroadband Unit interface by taking advantage of the weak password reset feature, hardcoded credentials, or the insecure protocols in the terminal.

"More specifically, a successful attack could compromise control of the satellite link channel used by the Future Air Navigation System (FANS), Controller Pilot Data Link Communications (CPDLC) or Aircraft Communications Addressing and Reporting System (ACARS)," he wrote in his 2014 research paper. "A malfunction of these subsystems could pose a safety threat for the entire aircraft."

Santamarta's new research illustrates just how an attacker could abuse satcom and other equipment vulnerabilities. He says he spotted hundreds of "exposed" aircraft from multiple airlines, but only focused on a few in his hacking research.

"These are real cases. They are no longer theoretical scenarios," he says of his new research. "We are using vulns in satcom devices to turn those devices into weapons" to trigger cyber-physical effects, he says.

There are two other known airplane-hacking research projects, but neither were accomplished from the ground to a flying plane like Santamarta's. The first was a controversial and disputed one in May of 2015, when security researcher Chris Roberts was accused by the FBI of hacking into an aircraft's controls via the WiFi network from his airplane seat, causing the airplane to briefly climb and move sideways, or laterally. Roberts at the time said the FBI's assessment of his experiment was overblown, and he later reportedly said the charges had been dropped.

A US Department of Homeland Security official in 2017 revealed at a satellite conference that his team had remotely hacked into a parked Boeing 757 at the Atlantic City, NJ, airport, using RF communications.  

Related Content:

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3154
PUBLISHED: 2020-01-27
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
CVE-2019-17190
PUBLISHED: 2020-01-27
A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe (which is running as NT AUTHORITY\SYSTEM) when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, the...
CVE-2014-8161
PUBLISHED: 2020-01-27
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
CVE-2014-9481
PUBLISHED: 2020-01-27
The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML.
CVE-2015-0241
PUBLISHED: 2020-01-27
The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric ...