[HN Gopher] Air-Bus Hijacking: Silently Taking over Avionics Sys...
___________________________________________________________________
Air-Bus Hijacking: Silently Taking over Avionics Systems
Author : pjf
Score : 43 points
Date : 2024-07-04 16:02 UTC (6 hours ago)
(HTM) web link (dl.acm.org)
(TXT) w3m dump (dl.acm.org)
| wucke13 wrote:
| The observation that ARINC 429 can be tapped, and that an active
| wiretap can alter data on the bus is of little surprise. The
| technological challenge is not high, the bus is comparable to a
| serialport at ~115200 baud. Considering that the technology
| surfaced in the 1970s, it is of no surprise that physical access
| restriction is the only means of security.
|
| More interesting IMHO would be what can be done to accelerate the
| adoption of new technologies (especially w/r/t cryptography) in
| avionics. This is more than anything a cultural problem; How to
| convince regulative bodies, how to satisfy processes, how to re-
| balance the proven-in-use argument (where stuff gets more
| favorable safety assessments when it has been used long enough)
| vs crypto-agility (where the same thing from today just tomorrow
| becomes insecure without changing itself, because of some
| external discovery).
|
| The technology is there, but the aviation community is not _yet_.
| Another nice read in this domain is "Economy Class Crypto:
| Exploring Weak Cipher: Usage in Avionic Communications via
| ACARS"[1, 2]. I only say mono-alphabetic substitution cipher.
|
| An interesting connection of Blockchain-tech, safety and security
| can be found in "Verifiable Computing in Avionics for Assuring
| Computer-Integrity without Replication" [3]. Here the authors
| leverages zero-knowledge proofs to prove to a downstream actuator
| that its commands are indeed correct results yielded by the
| application of the appropriate control law on the provided sensor
| inputs. However, this work is probably at least a decade away
| from being applicable in actual certified aircraft.
|
| [1]
| https://link.springer.com/chapter/10.1007/978-3-319-70972-7_...
| [2] https://www.cs.ox.ac.uk/files/9693/fc-paper.pdf [3]
| https://publ.sec.uni-stuttgart.de/reinhartluettighuberliedtk...
| masfuerte wrote:
| I don't want the cockpit to lose contact with the engines
| during a flight because a certificate just expired. And even if
| this particular example isn't realistic, adding security to a
| system will necessarily add lots of new failure modes. It seems
| likely that it will be really hard to do this without making
| the system as a whole less reliable.
| GTP wrote:
| I know yoh mean this in a general sense, but I just whish to
| point out for everyone that in this scenario you don't
| actually need certificates: a MAC to prove authenticity is
| enough.
| baby_souffle wrote:
| >a MAC to prove authenticity is enough.
|
| This would work in most cases, yes.
|
| I think the point that 'masfuerte' was making is that
| simplicity and redundancy are _the_ bedrock of reliability.
|
| Even if all the new hardware and software to implement this
| new security model on avionics busses is 100% open and
| audited by every laudable computer science / security
| specialist, it's just _more_ to possibly go wrong. That
| tends to change how people think about risk (weather
| rationally or not!)
| theamk wrote:
| Not really, you still need some system to distribute the
| shared key.
|
| The paper's method suppresses original message then
| generates btand-new one, so if the key is easy to find out,
| then the spoofed message will have a correct MAC. Which
| means you need a cryptographically secure method to
| distribute the key, but you also have multiple consumers
| and you want to be able to replace broken devices too. This
| sounds like a non-trivial cryptosystem, and assymetric
| crypto + certificates is one possible solution.
| constantcrying wrote:
| Why is the security of attacks against a data bus a relevant
| topic? An attacker who has access to the data bus can attack
| the plane in arbitrary ways, whatever he wants to do it is easy
| to imagine a way for him to accomplish what he wants, even if
| the bus were secure.
| wobfan wrote:
| Yeah, exactly. Just drop all packets.
| wucke13 wrote:
| For a local databus it has been relatively unimportant.
| However, there are radio data links in/out of the aircraft.
| The scope of data for these links is quite limited today, but
| likely to grow significantly in the future. There
| cryptographic properties become important, and a currently
| missing. An example would be ACARS.
|
| Also in some aircraft types these data buses are
| unfortunately not so very hard to access (i.e. accessible
| from the cabin, with undetected access being even plausible
| in some cases). So some resilience might not hurt in these
| cases.
|
| It's important that failure of critical systems is far less
| threatening than systems providing plausible, yet incorrect
| data. Redundancy and monitoring catches most of the former
| but not the latter.
| rectang wrote:
| From the abstract:
|
| > _This paper investigates cyber-physical attacks on avionics
| data buses, specifically focusing on the ARINC 429 protocol. The
| objective is to demonstrate how message injection, modification,
| and deletion attacks can be executed, enabling an attacker to
| gain full control over the transmitted data._
|
| I wish that vehicular systems all had air-gap level separation of
| messages, rendering it physically impossible to disrupt messages
| to critical systems like flight controls. I suppose that's a
| naive perspective, but in the long run it's hard to believe that
| we won't have to resort to provably correct systems to thwart
| attacks.
|
| > _To accomplish this, we propose a method that involves
| modifying messages on the data bus without segmenting it._
|
| Can we really live with avionics platforms as a setting for the
| same kind of perpetual arms race against attackers that we have
| for general operating systems?
| joe_the_user wrote:
| Another question would be: "Can we create systems intended to
| be permanently disconnected from the Internet?". Unfortunately,
| the answer seems to be no. You can see indications in the way
| that small water purification systems connect to the net just
| to save engineers from going in a weekends.
| constantcrying wrote:
| >"Can we create systems intended to be permanently
| disconnected from the Internet?"
|
| Any modern jet will function without internet.
| buildsjets wrote:
| Not permanently, which is the conjecture laid out by OP. At
| some point, there will need to be nav data updates, updates
| to the aircraft's required systems, updates to IFE systems,
| etc. Modern jets do all of that wirelessly. Additionally,
| every single modern jet uploads all recorded engine
| parameters from the flight to the engine manufacturer after
| it arrives at the gate. Do I know what I am talking about?
| Ref. username.
| constantcrying wrote:
| Sure, I have worked on multiple plane systems which were
| connected wirelessly, even to the internet. (Although
| that is something which I am extremely glad I have left
| behind me and would never brag about in my profile name)
|
| Even though, a modern jet is still able to function
| without internet.
| SoftTalker wrote:
| There are other means of remote access besides internet. POTS
| (i.e. dial-up modems), cellular wireless, and other forms of
| radio are several that come to mind.
|
| Internet is almost certainly the cheapest and easiest thing,
| which is why it's used.
| constantcrying wrote:
| If it requires physical access an attacker can also attack the
| analog systems which are controlled by the software.
|
| >I wish that vehicular systems all had air-gap level separation
| of messages, rendering it physically impossible to disrupt
| messages to critical systems like flight controls.
|
| This is just false. There is nothing in the world which makes
| physically separating two airplane systems impossible.
|
| >Can we really live with avionics platforms as a setting for
| the same kind of perpetual arms race against attackers that we
| have for general operating systems?
|
| The comparison is false. OSs are exposed to the entire world.
| Airplane systems require physical access.
| contingencies wrote:
| _Airplane systems require physical access._
|
| ... to potentially only _one_ of the components within the
| system, at any point in its lifetime, across the entire
| supply chain and all build, test /verify, operations and
| maintenance processes.
|
| (Edit in reply to child: Yes, obviously "the components
| within the system" means those actually connected, not a
| number 3 sprocket in seat 63E's incline mechanism. You have
| re-iterated my point.)
| constantcrying wrote:
| False. Most components are not connected to any of the
| relevant busses.
|
| And if you had control over the _specific_ component you
| need the plane is already compromised, whether the bus is
| open to spoofing or not is an irrelevant question.
| p_l wrote:
| Not physically disconnecting AFDX network from IFE network was
| one of the reasons 787 got delayed, because even with various
| Bush cuts to enforcement Boeing was told to go pound sand and
| redo the wiring until non-avionics bits were physically
| separated from avionics.
|
| TL;DR _it 's already a standard and has been ever since
| possiblity of sharing the networks came to be_
| Veserv wrote:
| The problem described in the paper is not what you think it is.
| The paper effectively says: "Assume we control the wire to the
| flight controls, then we have complete control over whatever is
| sent to the flight controls." Not to belittle the technical
| work in constructing a implant that can manipulate the
| electrical signals in the wire in realtime, but the consequence
| of such access is as obvious as it is uninteresting.
|
| Not to say that physical compromise of the wire is unbeatable;
| encryption makes it effectively impossible to spoof or rewrite
| messages, but the wires and communication protocol are already
| only intended for communication between trusted components (if
| you are communicating to untrusted components then you have to
| use something else like a data diode). The only really
| interesting part of the highlighted attack vector is that the
| "trusted wires" are likely not particularly physically
| separated from "non-trusted wires" or easy access which makes
| physical compromise at least plausible to achieve for a
| external malicious actor as compared to physically modifying
| one of the actual critical flight computers.
| likeabatterycar wrote:
| > then you have to use something else like a data diode
|
| From what I read ARINC 429 is a one-way bus making this
| completely redundant and unnecessary.
| likeabatterycar wrote:
| > I wish that vehicular systems all had air-gap level
| separation of messages
|
| From what I'm reading, ARINC 429 is as air-gapped as you can
| get. It is a one-way serial protocol (separate wires for
| transmit and receive). Only the wires that need to be connected
| are. Messages go from->to where they need to be.
|
| Unless by air gapped you literally mean "don't connect anything
| together" at which point you no longer have a functioning
| vehicle.
| constantcrying wrote:
| To be honest this is both unsurprising and IMO very irrelevant.
|
| Spoofing a CAN or ARINC429 bus requires physical access. At that
| point an attacker has access to the physical systems of the
| plane, at which point the plane is compromised anyway. What he
| uses to take over the plane is essentially arbitrary and there is
| absolutely nothing that would give any protection.
| bilbo0s wrote:
| I was wondering why anyone would go through all that trouble if
| s/he already had that level of control of the plane?
|
| Good to have someone more knowledgeable explain that I'm not
| necessarily crazy.
| Two4 wrote:
| Imagine a scenario where a plane is carrying a person who is
| enemy to a certain nation state. A nation state who is not
| above, say, using umbrella air dart guns to poison their
| enemies with radioactive compounds - just to make it clear
| that we're solidly in the realm of using James Bond style
| bullshit to secure national interests in our particular
| scenario. If this nation state were to plant a device on the
| avionics bus that would spoof the airspeed readout and cause
| the pilot to nose up on takeoff before the plane has reached
| critical velocity, it would be very difficult to find this
| device in the aftermath of the fiery crash, and also very
| difficult to not blame this on a faulty sensor or pilot
| error. I say fiery, because there would likely be a full tank
| of fuel, further reducing survivability in this scenario. A
| scary thought.
| constantcrying wrote:
| This can be accomplished just as easily by targeting the
| analog input for the actuators or the analog input of the
| stick. Or attack one of the other myriads safety critical
| systems outside of the bus.
| giantg2 wrote:
| And... attacking manually gives more plausibility to it
| being an accident rather than having a dongle attached to
| the plane, or code potentially surviving on the system.
| wil421 wrote:
| Why wouldn't you just mess with a mechanical component or
| simply murder someone without doing it while they are on an
| airplane?
|
| Car bombings still happen sometimes but it's much easier to
| just shoot someone or push them off a balcony.
| a3n wrote:
| Why wasn't Prigozhin killed on the ground?
| constantcrying wrote:
| Presumably because he was surrounded by troops reasonably
| loyal to him, making any assassination difficult.
|
| That he was killed by manipulating the data bus seems
| entirely speculative and exceedingly unlikely. If you
| have that kind of access to the plane you can plant a
| bomb or if you just want to down the plane Russia has
| potent anti-air weapons which trivially can take down a
| sub sonic passenger jet.
| Veserv wrote:
| Maybe if it crashed in the ocean. If it crashed on land,
| then they would almost certainly find the device in the
| wreckage as in the Pan Am 103 bombing [1] where they found
| even scraps of disintegrated clothing in the suitcase
| carrying the bomb. The flight recorder would also almost
| certainly show the nonsensical inputs and outputs and the
| pilot confusion. And, unlike other industries, aviation
| does real root cause analysis to identify every factor
| involved in a crash so it would be exceedingly unlikely
| they would throw their hands up into the air and just blame
| the pilot or something as stupid like that.
|
| The chances of a attack like this being undetectable are
| exceedingly low. You would likely need to compromise nearly
| every aspect of the plane to make sure you have suppressed
| every available cross-checking mechanism. Does not stop it
| from happening, but it would not, in any way, be some sort
| of magic assassin weapon.
|
| [1] https://en.wikipedia.org/wiki/Pan_Am_Flight_103_bombing
| _inve...
| chinathrow wrote:
| Right, a simple wire cutter is more than enough once you have
| physical access to the avionics bay.
| lb1lf wrote:
| A wirecutter would presumably cause an issue which would
| manifest itself prior to takeoff.
|
| Either that, or you must make your way into the bay while in
| flight with said wirecutters.
|
| Now, a dongle quietly manipulating enough variables to make
| the plane uncontrollable in flight, on the other hand... (No
| idea if that is even possible given access to this bus, but I
| will read this paper with some interest tomorrow (As I fly
| AMS-EWR... :)
| AdamJacobMuller wrote:
| Manipulating actual flight controls is probably hard.
|
| Manipulating sensors is probably comparably easy, and, if
| you can adjust the AOA sensors to make the plane think its
| in level flight while spoofing altitude data, you can
| probably manipulate the pilots (auto or not) into a CFIT.
|
| It's happened on other flights where pilots became confused
| by conflicting information (AF447 and many others) so
| giving them consistently wrong data is going to cause a
| consistently bad output.
|
| Anyway though I deeply agree that once you have physical
| access all bets are off. Sure, you can put a bug in which
| causes a complicated aircraft failure but you could also
| just put a time-delayed container of thermite or tannerite
| in the right place.
|
| I'd be much more worried about a software update causing a
| major issue, either intentionally or even more likely and
| more worrying, accidentally ALA 737Max.
| constantcrying wrote:
| >Manipulating actual flight controls is probably hard.
|
| Why? The flight sticks have an ADC, just control
| current/resistance there to get the desired digital
| values. Of course assuming fly by wire an symmetrical
| input on both sticks.
|
| Probably far easier than manipulating the digital data
| downstream, which is subject to lots of checks.
| BiteCode_dev wrote:
| With timer of 35 minutes.
| Vox_Leone wrote:
| >>Spoofing a CAN or ARINC429 bus requires physical access. At
| that point an attacker has access to the physical systems of
| the plane, at which point the plane is compromised anyway.
|
| I gather a perp only has to access the right piece of equipment
| in any phase of the logistics.
|
| These buses are employed mostly in the avionics industry, but
| they are also utilized in ground vehicles, weapons systems, and
| other commercial and military equipment industries.[1]
|
| [1] https://www.logic-fruit.com/glossary/arinc-429-guide/
| numpad0 wrote:
| That sounds like saying that one could potentially launch a
| nuke by walking into an operational nuclear submarine and
| pressing buttons in the right order.
| a3n wrote:
| I think it's better to take away options, rather than throw up
| your hands.
|
| Just because someone can load up my car on a flat bed tow truck
| doesn't mean it's pointless for me to have locks on the doors
| and ignition.
| constantcrying wrote:
| >I think it's better to take away options, rather than throw
| up your hands.
|
| No, wasting time, resources and money while increasing the
| inherent complexity and risk of a system to gain absolutely
| no benefit is a very bad idea.
|
| >Just because someone can load up my car on a flat bed tow
| truck doesn't mean it's pointless for me to have locks on the
| doors and ignition.
|
| Idiotic comparison, which makes me think you are just totally
| disingenuous. The point I made was that with the same amount
| of effort a plane is compromised, with or without a secure
| bus. This is _fake security_ , it doesn't protect anything.
|
| Just tell me an attack on the bus of an airplane which
| couldn't have just as easily been performed outside of the
| bus.
___________________________________________________________________
(page generated 2024-07-04 23:01 UTC)