Hacker Says Phone App Could Hijack Plane

[Kip Powick]

CNN) -- Could this be the deadliest smartphone app ever?

A German security consultant, who's also a commercial pilot, has demonstrated tools he says could be used to hijack an airplane remotely, using just an Android phone.

Speaking at the Hack in the Box security summit in Amsterdam, the Netherlands, Hugo Teso said Wednesday that he spent three years developing SIMON, a framework of malicious code that could be used to attack and exploit airline security software, and an Android app to run it that he calls PlaneSploit.

Using a flight simulator, Teso showed off the ability to change the speed, altitude and direction of a virtual airplane by sending radio signals to its flight-management system. Current security systems don't have strong enough authentication methods to make sure the commands are coming from a legitimate source, he said.

"You can use this system to modify approximately everything related to the navigation of the plane," Teso told Forbes after his presentation. "That includes a lot of nasty things."

Hugo Teso told a crowd at an Amsterdam conference that he spent three years coding the tools he used.

He told the crowd that the tools also could be used to do things like change what's on a pilot's display screen or turn off the lights in the cockpit. With the Android app he created, he said he could remotely control a plane by simply tapping pre-loaded commands like "Please Go Here" and the ominous "Visit Ground."

Teso says he developed SIMON in a way that makes it work only in virtual environments, not on actual aircraft.

"His testing laboratory consists of a series of software and hardware products, but the connection and communication methods, as well as ways of exploitation, are absolutely the same as they would be in an actual real-world scenario," analysts at Help Net Security wrote in a blog post.

Teso told the crowd that he used flight-management hardware that he bought on eBay and publicly available flight-simulator software that contains at least some of the same computer coding as real flight software.

Analyst Graham Cluley of Sophos Security said it's unclear how devastating Teso's find would be if unleashed on an actual airplane.

"No one else has had an opportunity to test this researcher's claims as he has, thankfully, kept secret details of the vulnerabilities he was able to exploit," Cluley said. "We are also told that he has informed the relevant bodies, so steps can be taken to patch any security holes before someone with more malicious intent has an opportunity to exploit them."

Teso said at the summit that he's reached out to the companies that make the systems he exploited and that they were receptive to addressing his concerns. He also said he's contacted aviation safety officials in the United States and Europe.

"From the sound of things, this researcher has got himself a lot of media attention, but still believes in responsible disclosure, rather than potentially putting aircraft and passengers at risk," Cluley said.

Teso isn't the first so-called "white hat" hacker to expose what appear to be holes in air-traffic security.

Last year, at the Black Hat security conference in Las Vegas, computer scientist Andrei Costin discussed weaknesses he said he found in a new U.S. air-traffic security system set to roll out next year. The flaws he found weren't instantly catastrophic, he said, but could be used to track private airplanes, intercept messages and jam communications between planes and air-traffic control.

[Don Hudson]

As a friend has suggested, "hacking an aircraft's systems is a project that would require the resources of a nation-state."

Though most anything is possible, I don't think that's going to occur any time soon.

Now that the media has picked up this nonsense and broadcast it to a fear-burdened population, I'll bet you the next thing we hear from Mr. Teso is that he has just the solution...for a price.

He's just jealous of all the attention Kim Jong Un is getting.

[Don Hudson]

Hi malcolm;

Oh, I'm aware of the existence of such entities. The point is, a high school techno-whiz or university engineering geek can't do this over a weekend even though such systems undoubtedly have the vulnerabilities claimed.

The key point is, how does the connection between ACARS or ADS and the aircraft's flight control system work? Some have posited a "TCAS" or "GPWS" hack, but then what is the goal of the hacking...to demonstrate possibility, to control an aircraft for nefarious intent, or to frighten momentarily?

I doubt very much whether this is "news" to very many in the ADS-ACARS-CPDLC industries but such claims as are made by the author will be a puzzle to flight control systems engineers.

I know of no aircraft types in which there is a direct connection. The B787 network bus may share facilities and services but that airplane is a very different animal than even current Airbus products.

There are ways to defeat this particular vulnerability already being expressed elsewhere.

[Mitch Cronin]

I find it interesting that just a few days before this bit of "news" broke, I saw a question appear on another forum, asking what programming language is used in FMS's.... and was stunned to see people quite willing to answer.

The good news is, even if all this fella's claims are legit, the last line of defence on board the aircraft - the pair in the comfy chairs there... could easily deal with it. ....even if they didn't understand it at the time.

....Which brings an interesting side note to mind.... It would be interesting if this is just what it takes to shut down the folks who continue to feel pilotless aircraft are worth working toward.

[Don Hudson]

Mitch;

I think the iPad, in use in thousands of cockpits, is by far the greater concern. Apple has not been known for robust security because they figured no one was interested in hacking their OS when Windows was "much more rewarding" - (I'd never do anything serious like banking or sending sensitive data using an iPhone). Performance, flight plans, weight-balance, enroute & approach charts are just some of the features that can be hacked with far greater risk than the present nonsense about taking control of an airplane using an Android. We both know that that just isn't possible but that doesn't mean that hacking can be set aside, (I mean, how would one hack your beloved DC10 or my beloved DC8?!)

Pilotless airplanes would work now if people were willing to bet it all but as a routine mode of travel I think that by the time it is viable, we don't need it.

I suspect those who hate paying us (the technical people on the ground and in the air) dream of the day when they don't have to negotiate with machines because they don't get tired, don't need feeding, don't take vacations, don't get the flu or viru...um, on second thought, cancel that last.

[Dropzone]

What is it about young people that makes them so obsessed with being destructive ???....I was a teenager once and I can honestly say I never felt the urge to riot or destroy things...........just asking the question..........

[boestar]

Fame and recognition by their peers. It is far better to be notorious than famous. in those circles anyhow.