Modern airliners are rather complicated feats of engineering. Innumerable safety-critical components are connected with tens of miles of wiring, complex digital buses, and dozens (perhaps hundreds) of computers. But, as hackers, we know that any computer can be hacked and, of course, aircraft avionics are no different.
Modern aircraft typically use the ARINC 429 protocol. This differs from many protocols we see where multiple transmitters are allowed. ARINC 429 has a single transmission source. This makes a transmission-override attack hypothetically difficult, as an attacker was thought to need to physically replace a legitimate transmitter (like a flight management computer), a rather daunting task. However, the ARINC 429 transmitters sit behind a pair of 37.5 ohm resistors, so by transmitting on the same line, an attack device can simply override the legitimate transmitter’s power.
With this methodology, the researchers created a proof of concept demonstration using a GE 2907A4 flight management computer (FMC), a GE 577F1 multipurpose control and display unit (MCDU), and an Integrated Flight Systems Accessory Unit (IFSAU). These are all components commonly used on the ever-popular Boeing 737, wired together as would be standard on that aircraft. The FMC communicates over ARINC 429 with the pilot’s MCDU, which is used to program the autopilot and perform takeoff calculations (among other things). After analyzing the protocol between the FMC and MCDU, they were able to freeze the pilot’s display, overwrite it, or even change values received and displayed.
With this methodology, three attacks were proposed. Most dramatically, the autopilot could be reprogrammed, bringing the aircraft to a new waypoint. However, it was also possible to modify the weight and balance information in the FMC. These values are critical for flight safety, and even subtle miscalculations could spell disaster. However, it’s worth noting the pilots do retain full control of the aircraft, especially on the fly-by-cable 737. Still, any number of these attacks could lead to unsafe conditions aboard an aircraft.
However, this is all theoretical. Can it actually be pulled off in the real world? Unfortunately, yes. Though the obvious attack vector would be tapping into wires, this proves challenging by nature of individual wires being difficult to find in such large bundles, and ARINC 492’s operation probes to look for misbehaving devices. Rather, the researcher found an open maintenance port in the 737’s electronics bay with access to ARINC 429. They designed a tiny device capable of tapping into the port, which they believe can be inserted in 30 to 60 seconds by someone on the ground without even needing a ladder. Access to an aircraft is unfortunately poorly restricted, and determining exactly where the device came from would be extremely difficult. The device itself is a tiny ESP32 board that plugs into the data port. Operation is over WiFi.
Though the paper assumes the ever-troubled 737 is the target, nothing stops this from working on other aircraft. Moreover, by retaining physical controls, the 737 may have ended up being safer than some other aircraft.
Thanks [anfractuosity] for the tip!
This articles is written by : Nermeen Nabil Khear Abdelmalak
All rights reserved to : USAGOLDMIES . www.usagoldmines.com
You can Enjoy surfing our website categories and read more content in many fields you may like .
Why USAGoldMines ?
USAGoldMines is a comprehensive website offering the latest in financial, crypto, and technical news. With specialized sections for each category, it provides readers with up-to-date market insights, investment trends, and technological advancements, making it a valuable resource for investors and enthusiasts in the fast-paced financial world.