An FBI agent's claim that a hacker may have exploited weaknesses aboard more than a dozen commercial flights, including sending commands to a jet engine in mid-air, has sparked new worries over the safety and cybersecurity of the nation's passenger planes.
The hacker, a security researcher, said the FBI misinterpreted him, and jetmakers and security experts have cast doubt on claims that he was able to control a flight. But the episode has added to a mounting sense of vulnerability ahead of what's expected to be the busiest summer for air travel in years.
The FBI investigation comes one month after more than 50 American Airlines flights were delayed due to a bug in a critical iPad flight-navigation app that pilots could fix only by nudging closer to an airport's Wi-Fi.
And it comes only two months after the deadly crash of a Germanwings jet in the French Alps, caused by a co-pilot who locked the captain out of the cockpit and began the descent, killing all 150 people on board. Despite that tragedy and the cyber scares, air travel has never been safer — 20 commercial flights crashed last year, making it one of the safest in aviation history.
But a new wave of technology is raising questions about security for an industry that has long kept a tight grip on information flowing among pilots, air-traffic controllers and top officials..
The aviation industry's "previously centralized and controlled culture," said Tim Erlin, a director at security software firm Tripwire, "is being forced to deal with the basic, but prevalent, security issues more open systems have been confronting for years."
In an application last month for a search warrant, an FBI agent said researcher Chris Roberts had used a simple plug, installed beneath the seats of many commercial planes, to tap into in-flight entertainment systems up to 20 times since 2011.
From there, according to the FBI, Roberts said he was able to change code on a plane's internal computers and even command a plane to climb and fly sideways. Roberts last month got agents' attention by tweeting that he might "start playing" with his jet's controls.
Roberts defended the tweet as a joke riffing off his previous warnings to jetmakers Airbus and Boeing over their planes' security flaws, which he said could leave control systems for the plane's cabin and oxygen mask systems open to attack. "My only interest has been to improve aircraft security," he tweeted Sunday.
But other aviation and security experts said the claims, of tapping into flight controls via a seat outlet, stretched the imagination, because entertainment and crucial flight systems are often kept separate. Hacking a plane's engine controls through its entertainment system, they argue, is a bit like controlling a car's steering wheel through its CD player.
Jetmakers defended their security against worries of a fleet-wide flaw. In Boeing jets, entertainment systems are kept separate from flight and navigation, pilots have multiple navigational systems at their disposal, and the jet's flight plan can't change without pilot approval, Boeing spokesman Doug Alder said.
"On every flight, there are multiple layers of security and procedures in place to protect passengers and crew," said Victoria Day, a spokesperson for Airlines for America, the industry's trade group.
But the industry came under fire in a Government Accountability Office report last month, which said that in-flight Wi-Fi networks on some Boeing and Airbus planes could allow an attacker to commandeer a flight.
Cockpit electronics connect to the same networks as the passenger cabin, and the firewalls that divide them can, as cybersecurity experts told the watchdog, "be hacked like any other software and circumvented."
Security experts like Christopher Soghoian, who in 2006 built a tool exploiting an airline weakness by allowing people to print fake boarding passes, poked back at the industry itself, saying it had sacrificed security when it made features like the under-seat port, designed for entertainment systems, easily available to anyone.
"In order to show video ads to passengers," Soghoian tweeted, "airlines placed an easy to access 'hack this plane' data port under every seat."
Some of air travel's biggest tech headaches have arisen from the same hazards troubling other industries. About 10,000 frequent flyers of American and United airlines were told in January their accounts had been compromised by hackers who booked themselves free or upgraded flights.
Air miles and loyalty programs have become easy targets for hackers, analysts said, because they often lack the security controls protecting credit cards, checking accounts and other forms of currency.
But the industry's tech problems have also challenged the basic safety measures of commercial flight, including last month, when dozens of American Airlines pilots were stranded on the runway after the iPad app that gives them their flight plans crashed.
The airline had in 2013 turned to the app as an alternative to heavy bags of paper maps, saying the switch would allow for quicker updates, take weight off pilots and even save $1 million a year in fuel. But the glitch showed the risk of too much tablet dependence, especially because the airline didn't carry backup paper terminal charts in its cockpits.
To counter technical problems, United Airlines this month launched the industry's first "bug bounty," offering free airline miles to hackers who alert the carrier to vulnerabilities in its website, app and reservations system.
But security researchers said the airline stopped short of preventing the most damage, by saying it would not accept submissions detailing weaknesses in planes' onboard Wi-Fi, entertainment systems and flight electronics.
Years of bankruptcies and megamergers have left fewer airlines to compete over a growing traveler base, and some analysts have argued the air carriers have been slow to implement important upgrades.
But some airlines are "starting to see that messy operations are very expensive," said Seth Kaplan, a managing partner for trade publication Airline Weekly.
"When you invest money wisely in tech, and not just a blank check, you get this virtuous cycle where you don't have as many delays, you're not losing as many bags" — and passengers feel more confident to step on the plane.
The Washington Post
Tue May 19 2015
The FBI investigation comes one month after more than 50 American Airlines flights were delayed due to a bug in a critical iPad flight-navigation app that pilots could fix only by nudging closer to an airport's Wi-Fi.
Is climate change making tropical storms more frequent? Scientists say it's unclear
Scientists say it remains unclear how much climate change is reshaping the storm season.
Samples obtained by Chinese spacecraft show moon's ancient volcanism
The material provides new insight into the moon's geological history including the oldest evidence to date of lunar volcanism.
The scamdemic targeting the young and vulnerable
Teenagers and young adults are becoming prime targets for a new wave of cyber scams, a trend raising alarm bells across Southeast Asia.
Japanese manicurist takes on plastic pollution, one nail at a time
Before global leaders address plastic pollution, a Japanese manicurist highlights the issue by incorporating it into her nail designs.
What to watch for ahead of US presidential inauguration
Here's a timeline of events between now and inauguration day.
The battle to reduce road deaths
In Malaysia, over half a million road accidents have been recorded so far this year.
Pro-Palestinian NGOs seek court order to stop Dutch arms exports to Israel
The Dutch state, as a signatory to the 1948 Genocide Convention, has a duty to take all reasonable measures at its disposal to prevent genocide.
How quickly can Trump's Musk-led efficiency panel slash US regulations?
Moves by Trump and his appointees to eliminate existing rules will be met with legal challenges, as many progressive groups and Democratic officials have made clear.
2TM: Consultations on PTPTN loans, admission to IPTA at MOHE booth
Consultations on PTPTN loans and admission to IPTA are among services provided at the Higher Education Ministry booth.
Kampung Tanjung Kala residents affected by flooded bridge every time it rains heavily
Almost 200 residents from 60 homes in Kampung Tanjung Kala have ended up stuck when their 200-metre (m) long concrete bridge flooded.
COP29 climate summit draft proposes rich countries pay $250 billion per year
The draft finance deal criticised by both developed and developing nations.
Bomb squad sent to London's Gatwick Airport after terminal evacuation
This was following the discovery of a suspected prohibited item in luggage.
Kelantan urges caution amidst northeast monsoon rains
Kelantan has reminded the public in the state to refrain from outdoor activities with the arrival of the Northeast Monsoon season.
Former New Zealand PM Jacinda Ardern receives UN leadership award
Former New Zealand prime minister Jacinda Ardern was given a global leadership award by the United Nations Foundation.
ICC'S arrest warrants for Netanyahu, Gallant an apt decision - PM
The decision of the ICC to issue arrest warrants against Benjamin Netanyahu and Yoav Gallant is apt, said Datuk Seri Anwar Ibrahim.
KTMB provides two additional ETS trains for Christmas, school holidays
KTMB will provide two additional ETS trains for the KL Sentral-Padang Besar route and return trips in conjunction with the holidays.
BNM'S international reserves rise to USD118 bil as at Nov 15, 2024
Malaysia's international reserves rose to US$118.0 billion as at Nov 15, 2024, up from US$117.6 billion on Oct 30, 2024.
Findings by dark energy researchers back Einstein's conception of gravity
The findings announced are part of a years-long study of the history of the cosmos focusing upon dark energy.
NRES responds to Rimbawatch press release on COP29
The Ministry of Natural Resources and Environmental Sustainability (NRES) wishes to offer the following clarifications to the issues raised.
Online Safety Bill and Anti-Cyberbullying Laws must carefully balance rights and protections
The Online Safety Advocacy Group (OSAG) stands united with people in Malaysia in the fight against serious online harms.