Modern aircraft increasingly connected to internet, which could potentially lead to hackers seizing control of a plane mid-flight, says GAO.
Hackers on commercial flights could now bring down the plane they are on by using the on board Wi-Fi, a US government watchdog has warned.
The US Government Accountability Office (GAO) does not suggest it would be easy to do but it points out that as airlines and the Federal Aviation Administration attempt to modernise planes and flight tracking with internet-based technology, attackers have a new vulnerability they could exploit.
The GAO says: “Modern aircraft are increasingly connected to the internet. This interconnectedness can potentially provide unauthorized remote access to aircraft avionics systems.”
The report highlights the fact that cockpit electronics are indirectly connected to the passenger cabin through shared IP networks. The connection between passenger-accessible systems and the avionics of the plane is heavily moderated by firewalls, but information security experts have pointed out that firewalls, like all software, can never be assumed to be totally infallible.
“Four cybersecurity experts with whom we spoke discussed firewall vulnerabilities, and all four said that because firewalls are software components, they could be hacked like any other software and circumvented,” explains the office.
“According to cybersecurity experts we interviewed, internet connectivity in the cabin should be considered a direct link between the aircraft and the outside world, which includes potential malicious actors,” the report adds.
The Federal Aviation Administration does not currently verify the cybersecurity of a new airliner before certifying it for scope, although it “currently issues rules with limited scope, called Special Conditions, to aircraft manufacturers when aircraft employ new technologies where IP interconnectivity could present cybersecurity risks”.
The report praises the FAA for the steps it has taken to get its cybersecurity policies in order, but says that “opportunity exists for further action”, and particularly highlights as a cause for concern the fact that cybersecurity responsibility is split over multiple FAA offices.
A worst case scenario is that a terrorist with a laptop would sit among the passengers and take control of the airplane using its passenger Wi-Fi, said Rep. Peter DeFazio, an Oregon Democrat on the House Transportation and Infrastructure Committee who requested the investigation.
“That’s a serious vulnerability, and FAA should work quickly” to fix the problem, DeFazio said.
The GAO released a separate report last March that determined the FAA’s system for guiding planes and other aircraft also was at “increased and unnecessary risk” of being hacked.
One area of weakness is the ability to prevent and detect unauthorised access to the vast network of computer and communications systems the FAA uses to process and track flights around the world, the report said. The FAA relies on more than 100 of these air traffic systems to direct planes.
In January 2015, the GAO praised the FAA for taking steps to protect air-traffic controllers, but warned that “significant security control weaknesses remain that threaten the [FAA’s] ability to ensure the safe and uninterrupted operation of the national airspace system”.