Hacker uses an Android to remotely attack and hijack an airplane
Darlene Storm
The Hack in the Box [1] (#HITB2013AMS [2]) security conference in Amsterdam has a very interesting lineup of talks [pdf [3]]. One that jumped out was the Aircraft Hacking: Practical Aero Series [4] presented by Hugo Teso [5], a security consultant at n.runs in Germany. According to the abstract, “This presentation will be a practical demonstration on how to remotely attack and take full control of an aircraft, exposing some of the results of my three years research on the aviation security field. The attack performed will follow the classical methodology, divided in discovery, information gathering, exploitation and post-exploitation phases. The complete attack will be accomplished remotely, without needing physical access to the target aircraft at any time, and a testing laboratory will be used to attack virtual airplanes systems.
While keeping an eye on Twitter #HITB2013AMS [2], greatly interesting tweets started to appear as hackers who attended were excited. I will add some of those throughout this article.
[6]
[7] Before his presentation, Teso recommended that people should have a little background knowledge on aviation and aircraft systems [8] to better understand what he was going to explain. Here’s a few important facts: Automated Dependent Surveillance-Broadcast (ADS-B) has no security as was pointed out at Def Con 20 shortly before a hacker was able to inject ghost planes into radar [9]. It is unencrypted and unauthenticated. Teso said, “Attacks range from passive attacks (eavesdropping) to active attacks (message jamming, replaying, injection.” The Aircraft Communications Addressing and Reporting System (ACARS) also has no security; it “is used for exchanging text messages between aircraft and ground stations via radio (VHF) or satellite.” Although his talk did not focus on the vulnerabilities in those two protocols, he used them to find targets.
CONTINUE READING
http://blogs.computerworld.com/print/22036