Some new apps and wireless devices being used by private pilots on flights are vulnerable to an extensive variety of security attacks, computer scientists from John Hopkins University and University of California, San Diego found.
When hacked, these apps and devices used for GPS information to data gathering about aircraft nearby could bring about disastrous consequences, the scientists said.
“Existing systems allowed an attacker to compromise system integrity in multiple ways, allowing attacker-controlled information to be presented to the pilot,” they wrote in the paper titled “On The Security of Mobile Cockpit Information Systems.”
They scrutinized three combinations of most-commonly used apps and devices by private pilots. These are the SageTech Clarity CL01 with the WingX Pro7 app, the Garmin GDL 39 receiver with the Garmin Pilot app, and the Appareo Stratus 2 receiver with the ForeFlight app.
The ForeFlight app is said to be among the top 50 grossing apps of Apple’s App Store and the most popular aviation app for iOS.
With such devices and apps, scientists found that casual pilots have access of same information that is available to a pilot of a private jet, but for only a fraction of the cost. These systems studied by the scientists are valued at $1,000, while the instruments found in high-end cockpit go beyond $20,000.
The examined devices receive data on the location of the aircraft, the location of another aircraft nearby, the weather, and airspace restrictions, which are displayed on the tablets through an app.
To show the information, all these systems need to be paired with tablet computers, more frequently with an iPad.
“When you attack these devices, you don’t have control over the aircraft, but you have control over the information the pilot sees,” Kirill Levchenko, study’s lead researcher and a computer scientist at UC San Diego’s Jacobs School of Engineering, said in a statement.
During the research, the computer scientists discovered important safety flaws in all the three systems mentioned.
Two of which even allowed the attacker to completely switch the firmware, said to be home to programs that are in control of the devices.
Appareo Stratus 2, for instance, permitted the downgrading of the firmware to any older version.
The attacker can likewise interfere with the communication between tablet and receiver through these three devices.
Both these types of security attacks allow the attacker full control over the “safety-critical real-time information” displayed to the pilot.
The attacker can also deceive the pilot that could lead them to taking measures unfavorable to safety of flights. This can be done by interfering with aircraft data, such as altitude, position, weather data, direction indications, and positions of other aircrafts as shown to the pilot.
Also increasing the possibility of a devastating outcome are factors such as pilot workload and visibility, the scientists said. For instance is the misrepresentation of aircraft position in its final approach during poor weather could lead to a crash into neighboring terrain or a collision with other aircrafts.
The scientists however pointed to some secure design practices to fix the identified flaws, such as appropriate pairing, replay protection, and preventing selective denial to secure the systems.
They explained that communication between tablet and receiver should be cryptographically secured.
The receiver should also pair with the tablet in the same method Apple smartphones get paired with particular computers.
An explicit user interaction should also be required before any device firmware update is made.
Data, such as approach procedures and maps, should also be downloaded to the tablet with the use of HTTPS or as signed digitally by the vendor.
In the US, the Federal Aviation Administration (FAA) has authority to regulate the use of these mobile computing devices or systems in the cockpit. It, however, opted not to regulate because these aren’t essential part of an aircraft, according to the scientists.
In commercial aircrafts, the FAA merely permits static information to be shown on tablet computers, warning pilots to depend on instruments to fly.
The scientists said most systems are rather new to the market.
“It’s a great time to make them secure from the get-go,” said Levchenko.
The scientists wished that exposing the vulnerabilities of such systems would enhance awareness among all users and would bring about demands for change.
Levchenko and colleagues presented their paper during the 21st ACM Conference on Computer and Communications Security on November 5 in Scottsdale, Arizona.
The complete report of their findings can be viewed here.
