Hacker Briefly Flies Plane Sideways After Accessing Engine Systems, FBI Says

Art VanDelay said:
If it looks like bull**** and it smells like bull**** ...... guess what it most likely is ? For some reason there are lots of techie IT types out there with small man syndrome. This guy sure sounds like one of them. Wonder why he hasn't just applied to law school ?
Click to expand...


:yeathat:
 
RalphInCA said:
Can you name a couple of companies?



Sent from my iPhone using Tapatalk
Click to expand...

Right now, the big defense contractors (Boeing, Lockmart, NG....etc) are doing it to meet DoD requirements.. But from where I sit, the sky is the limit for anyone who wants to start their own business.

It is more than just transportation and defense. Think about all the apps that are constantly coming out linking everything from your personal email to bank account to Facebook. People are rolling that stuff out so fast to get ahead of the competition that most of those applications are not tested and easily hackable.
 
Maxed-out said:
Read the following article from InfoWorld and then come back and post on this forum how this guy absolutely did not hack the aircraft's network and systems. Personally, I think it's already been done and the industry is trying to catch up, like everyone else. The comment and link provided in the article about the Boeing 737 MAX Advanced Onboard Network System was particularly interesting.

http://www.infoworld.com/article/2912372/security/can-you-hack-an-airplane.html
Click to expand...


I'm envisioning a bunch of IT geeks sitting around with chubbies watching the movie WarGames scheming how they can access the 21st Century version of the WOPR (War Operation Plan Response) supercomputer.
 
Silvaire said:
No he didn't and no he can't. United banned him because he's a s hit stirrer and troublemaker, not because he has any capability of commandeering command or control of flight control systems. Believe me, for the umpteenth time, it's not possible. The Flight Guidance, Flight Management, Flight Warning and Thrust Management Computers are not connected in any manner to the internet or any cabin entertainment system whatsoever. This is complete BS and is simply not possible except in Hollywood.
Click to expand...

can I ask where your knowledge comes from?

I feel the need to ask because this guy was talking about An IT hack on an airplane. I've heard what you just said about other systems before, tight before they were hacked. Heck, I've said something very similar before.

I've learned the hard way not to discount hackers. So unless you can say that you're the Boeing design engineer and you know there is no network connectivity between certain systems, I'm still going to doubt.
 
Maxed-out said:
Read the following article from InfoWorld and then come back and post on this forum how this guy absolutely did not hack the aircraft's network and systems. Personally, I think it's already been done and the industry is trying to catch up, like everyone else. The comment and link provided in the article about the Boeing 737 MAX Advanced Onboard Network System was particularly interesting.

http://www.infoworld.com/article/2912372/security/can-you-hack-an-airplane.html
Click to expand...
I find it beyond my ability to suspend disbelief that an airline would be run with the ability to manage flight controls remotely. Could it be done if the proper equipment were to be installed and tied in to a remote link? Sure. But I'm fairly sure that if that were the case we would have remote centers getting intimately involved when flight crews get in over their heads with a system malfunction.

I don't for a second believe that any flight controls that are capable of being remotely commanded are linked to the in-flight entertainment network. Prove it is so, and I'll heap praises and accolades on you. In the meantime, I'm not buying it for a second.

And by the way - none of the passengers on the flight in question said anything about any sudden course changes. Funny that they wouldn't notice anything amiss happening when the plane suddenly starts flying sideways.
 
Last edited:
Rigged4Flight said:
I find it beyond my ability to suspend belief that an airline would be run with the ability to manage flight controls remotely. Could it be done if the proper equipment were to be installed and tied in to a remote link? Sure. But I'm fairly sure that if that were the case we would have remote centers getting intimately involved when flight crews get in over their heads with a system malfunction.

I don't for a second believe that any flight controls that are capable of being remotely commanded are linked to the in-flight entertainment network. Prove it is so, and I'll heap praises and accolades on you. In the meantime, I'm not buying it for a second.

And by the way - none of the passengers on the flight in question said anything about any sudden course changes. Funny that they wouldn't notice anything amiss happening when the plane suddenly starts flying sideways.
Click to expand...


Maybe he was controlling Dutch roll with his flight sim rudder pedals which he takes with him wherever he goes. :)
 
RotorAndWing said:
And since these flights are recorded, it wouldn't be difficult to go back and see if the anomaly actually happened.
Click to expand...
According to the Wired article, his hack increasing engine power was done on his simulation, not in an actual airplane. All he claims to have done in actual airplanes is monitor the data traffic on the bus.

bflynn said:
His tweet claimed to have had access to send EICAS messages on the 737-700, which could be used to send false information to the flight crew. Google tells me EICAS is the Engine Indicating and Crew Alerting System. That would mean he didn't have direct access to the flight controls, but he did have some ability to introduce bogus messages.
Click to expand...
It's even worse than that...

He said he was on a B737 (800, not 700, though they are the same) and suggested that he's throw up some EICAS messages. This is laughable because NO B737 HAS EICAS!

The 737s are still built on the original design from the 1960. They have a lot of yellow lights on the instrument and overhead panels. Since they were eliminating the flight engineer, who presumably spent the flight monitoring all those panels, they added a master caution system with a recall panel. The mast caution lights up and the recall panel tells who which system (on the overhead) has a yellow light on. Very rudimentary compared to an EICAS system.
 
Fearless Tower said:
Don't be too smug.

I have no idea of the validity of this guy's claim, but we have done enough cyber security testing in the DoD that his claims are not out of the realm of possibility.
Click to expand...
So are death rays form Mars.
 
Well, we all here know this is bull**** because we established last month that planes cannot fly sideways.
 
Maxed-out said:
Read the following article from InfoWorld and then come back and post on this forum how this guy absolutely did not hack the aircraft's network and systems. Personally, I think it's already been done and the industry is trying to catch up, like everyone else. The comment and link provided in the article about the Boeing 737 MAX Advanced Onboard Network System was particularly interesting.

http://www.infoworld.com/article/2912372/security/can-you-hack-an-airplane.html
Click to expand...

Okay, are we now assuming the guy has a time machine? Because nobody has a 737 MAX yet, maybe in a couple of years. So I'm not gonna argue about something that doesn't exist yet.

My quals: been working on these things for about 30 years, installed and did the prototype certifications for Panasonic WiFi on Airbus, 777 and 757.

Again, and I don't care if you want to believe me or not, there is no way to hack into an aircraft's flight control systems via the passenger entertainment system. I don't care if you have a whole suitcase full of specially modified LAN cables and the latest MacBook Pro. It ain't happening.

So, being that that's an outright lie. Why does this clown continue to have any credibility in anyone's eyes?
 
Because it apparently makes for interesting reading?

The guy is a whacko IMO. And FOS, too.
 
I would think that if anyone could control commercial flights remotely, the airlines could, and if they could, we would not have had the recent commercial crash.
 
Silvaire said:
So, being that that's an outright lie. Why does this clown continue to have any credibility in anyone's eyes?
Click to expand...

Media will sensationalize it, then the ignorant will repeat it... Soon there will be generations of people believing that planes can be controlled through Netflix.
 
Circuit Flyer said:
I would think that if anyone could control commercial flights remotely, the airlines could, and if they could, we would not have had the recent commercial crash.
Click to expand...
If the planes were flown remotely, you'd only have to worry about homicidal maniacs instead of suicidal manics.
 
Silvaire said:
there is no way to hack into an aircraft's flight control systems via the passenger entertainment system.
Click to expand...

Please tell us, in technical terms, why you believe it's not possible. I know we're all curious.

I'd like to believe you because a) the claim seems far-fetched but then so have many of the feats pulled off by hackers, b) I'd just like to believe that airliners can't be hacked in this way, and c) you stated your job has provided you with relevant technical knowledge. Cool.

But saying "believe me" on an internet forum doesn't work because we (maybe just I) don't know you to the extent to establish that kind of instant and unquestioning credibility. It's not personal, it's just the innterwebs.



.
 
Last edited:
petrolero said:
Please tell us, in technical terms, why you believe it's not possible. I know we're all curious.
.
Click to expand...
Because (as was stated here before) the systems are isolated from one another:

In a statement, a Boeing spokesman said in-flight entertainment systems on airliners are isolated from flight and navigation systems.

To hack anything there must be 1) a physical connection, 2) there must also be a logical connection that enables WRITE operation from the hacker's side to the other one.
 
olasek said:
Because (as was stated here before) the systems are isolated from one another:

In a statement, a Boeing spokesman said in-flight entertainment systems on airliners are isolated from flight and navigation systems.

To hack anything there must be 1) a physical connection, 2) there must also be a logical connection that enables WRITE operation from the hacker's side to the other one.
Click to expand...

Define isolated....going to need to know more than that before I start saying what's possible. Is there an air gap between every system?
 
jesse said:
Define isolated....going to need to know more than that before I start saying what's possible. Is there an air gap between every system?
Click to expand...

:yeahthat: Physically isolated (assuming no wireless capability in the control systems networks)? Can't be hacked. Logically isolated (VLAN, firewall, router etc.)? Probably can be hacked.

John
 
Can data be sent through a power line? In other words, if the systems are totally isolated except for the bus they get their power from, can they still get hacked?
 
Greg Bockelman said:
Can data be sent through a power line? In other words, if the systems are totally isolated except for the bus they get their power from, can they still get hacked?
Click to expand...

There are networking systems (including broadband in some places) that work using RF over power lines. That said, there have to be proper network interfaces connected to them.

I'm not a flight systems engineer but I've done a ton of software, systems, network and some hardware design over the years and it's hard for me to imagine a way to hack (as in take control of, rather than crash) a system via the power lines.

John
 
jesse said:
Define isolated....going to need to know more than that before I start saying what's possible. Is there an air gap between every system?
Click to expand...

Yes that's what I was wondering as well. Saying "it's impossible - they're separate" is not specific enough. Nor do I need to see wiring diagrams.

I'm just wondering why it is literally impossible as opposed to "unlikely" or "extremely difficult." Because the difference means that an airliner's ability to be controlled by a passenger is only a matter of technical know-how and persistence.

Didn't the guy say he exploited a default password vulnerability? Really?? Isn't that how all those nudy pics of dumb celebs got leaked? That is like computers 101 stuff right there.
 
jsstevens said:
There are networking systems (including broadband in some places) that work using RF over power lines. That said, there have to be proper network interfaces connected to them.

I'm not a flight systems engineer but I've done a ton of software, systems, network and some hardware design over the years and it's hard for me to imagine a way to hack (as in take control of, rather than crash) a system via the power lines.

John
Click to expand...
Correct, be pretty hard, only thing I can really think of is if you were able to influence a system on the bus to negatively effect the bus's integrity and in chain cause something else on that bus to respond in whatever way you wanted. Not that realistic.

I'd also wonder if there are any flight system wiring harnesses that run by locations passengers could easily access, like, behind a panel in one of the lavs for example. With enough know-know and knowledge of the systems someone could do a lot of damage if so.
 
Even if there is a 'network connection' between both systems - say aircraft lat/long gets sent to IFE it is still not enough to 'hack' since the connection can very easily be made one-way only. You can't hack radio station by listening to a live program. I have spent my whole life doing network programming. Unless the flight control software is reading something from the IFE and acting upon it, it can't be hacked. And even receiving something is not enough to get 'hacked' - I can receive a virus in an email but until I open the email - hacking can't happen. By the same token I can't hack a system that sent me the email.
 
Last edited:
Well then the FBI should be returning his computer equipment quickly then, right?

Sounds like it's impossible and the feds knee jerked out of their ignorance.
 
I wouldn't blame the FBI, I'd blame the attention craving idiot who's making the claims.
 
bflynn said:
Well then the FBI should be returning his computer equipment quickly then, right?

Sounds like it's impossible and the feds knee jerked out of their ignorance.
Click to expand...

Like many subjects, there's been an astonishing amount of ignorance displayed. But I suspect the FBI, and certainly the airlines, would rather err on the side of caution while the public eye is upon them. Simply to avoid the same astonishing amount of ignorance to combine with social (and professional) media causing a panic about air travel.

I certainly don't know enough about the actual systems and interfaces to know whether it's impossible, plausible or likely. But I KNOW what I know, and by inversion, what I don't know. I use this knowledge to try my best to not display my astonishing amount of ignorance of say, animal husbandry.

John
 
MAKG1 said:
You mean like ACARS?

Though I guess that would be more of a social engineering attack than a hack.
Click to expand...

Well, I was thinking WiFi or bluetooth. Something the hacker could use to get network packets to/from the flight systems network while on the plane, again assuming the networks are physically separate.

Social engineering attacks are a whole 'nother can o' worms.

John
 
olasek said:
To hack anything there must be 1) a physical connection, 2) there must also be a logical connection that enables WRITE operation from the hacker's side to the other one.
Click to expand...

And the hardware in that connection must support such write operations.
 
It sounds pretty bogus to me. Maybe it's just bad reporting. Would an engine control use an instruction like "climb?" When you have people on board doing experiments with the network or wiring, I call it attempted sabotage.
 
kontiki said:
It sounds pretty bogus to me. Maybe it's just bad reporting. Would an engine control use an instruction like "climb?" When you have people on board doing experiments with the network or wiring, I call it attempted sabotage.
Click to expand...

No no it was CLMB. Omitting the "I" makes it sound all computer-y. :D
 
jsstevens said:
Like many subjects, there's been an astonishing amount of ignorance displayed. But I suspect the FBI, and certainly the airlines, would rather err on the side of caution while the public eye is upon them. Simply to avoid the same astonishing amount of ignorance to combine with social (and professional) media causing a panic about air travel.

I certainly don't know enough about the actual systems and interfaces to know whether it's impossible, plausible or likely. But I KNOW what I know, and by inversion, what I don't know. I use this knowledge to try my best to not display my astonishing amount of ignorance of say, animal husbandry.

John
Click to expand...

I like this. I know a decent amount of general network stuff. Enough to know that some of the statements so far are wrong. But - I don't know enough about the networks used by aviation to comment with any certainty.

A few assumptions I would make, that seem like they are no-brainers. 1) They do NOT use POE, anywhere on the plane. Power isolation due to both ground plane issues, and static(lightning) discharge would make POE unpossible. 2) They have hardened and isolated optical paths, with full shielding, maybe well above the ASDD standard, I just don't know, but it would make sense. 3) No one, with any brains at all would share the same router/switch/hub between flight controls and entertainment. The cost of a dedicated router is so low, and the bandwidth so minimal that you could put three separate chassis in every plane for the flight controls and not have any weight penalty involved. 4) No WiFi, no radio, no unpublished back door access to the flight control network - ever. Again, an assumption, but I think I can rest comfy that a flight control designer wouldn't be that stupid.

YMMV, objects in mirror, don't try this at home, pro driver closed course, and may cause anal leakage. I think the FBI are just making a spectacle of this to prove they know how to track hackers and can get in their face anytime, anywhere. It's a dog and pony all the way.
 
Anybody know if 737-800 entertainment system has internet connectivity?That would certainly create the possibility of accessing other networks on the airplane.

The Government Accountability Office issued a report recently chastising the FAA for failing to address potential weaknesses in airplane cybersecurity.

http://www.gao.gov/products/GAO-15-370

According to the report, systems that connect to the Internet can potentially provide unauthorized remote access to aircraft avionics systems. The GAO report said that a third of avionic communication systems connect to the Internet, and that figure is expected to reach as high as 60 percent in five years.

From the report:

Modern aircraft are increasingly connected to the Internet. This interconnectedness can potentially provide unauthorized remote access to aircraft avionics systems. As part of the aircraft certification process, FAA's Office of Safety (AVS) currently certifies new interconnected systems through rules for specific aircraft and has started reviewing rules for certifying the cybersecurity of all new aircraft systems.
Click to expand...
 
Denver is a small IT community.

Talked to a source close enough to have sneezed on him.

He's now attracted the attention of folks you don't want attention from.

Things not looking good for him in the local security professional community.

Enough said.
 
denverpilot said:
Denver is a small IT community.

Talked to a source close enough to have sneezed on him.

He's now attracted the attention of folks you don't want attention from.

Things not looking good for him in the local security professional community.

Enough said.
Click to expand...

If they are competent bad guy catchers that would suggest he was successful at something
 
petrolero said:
Please tell us, in technical terms, why you believe it's not possible. I know we're all curious...
Click to expand...

In technical terms? I'm not sure what you're looking for here, all I can say is that there are absolutely no connections between the passenger entertainment system and the flight control systems of a commercial airliner. Why anyone would think that there would be is beyond me. What purpose do you imagine such connections would serve? The PES does three things: it plays movies and music from the file server, dings a bell to call the flight attendant when you need your Tom Collins refilled and turns your reading light on and off. It doesn't need a connection with the Thrust Management Computer to do any of those things and if you think that the airline, Boeing or the FAA would allow Panasonic or GoGo to install a system that tapped into existing flight control and guidance systems you really need to just sit down and think about it.

the claims and allegations in this story are ludicrous, there's no other way to put it.
 
You must log in or register to reply here.
Back
Top