From the discovery of a nuclear centrifuge-wrecking cyber weapon called Stuxnet in 2010 it has become clear that dangers composed in bits and bytes are now transferring across to the physical world, capable of shutting down power grids and hospitals, or seizing the core control systems of connected cars.

It's not quite so far-fetched to think that somebody with the tools, inclination, knowhow or the budget could do something similar to an airplane. Techworld asked some infosecurity experts just how vulnerable air transport is.

Image: Flickr Creative Commons/Kent Wien
Image: Flickr Creative Commons/Kent Wien

"The reality is modern systems – cars, planes, now ships – are highly computerised," says Eugene Kaspersky, CEO of Kaspersky Labs, speaking to Techworld at an event about securing the industrial internet. "And how well they are secured, I am afraid, they are still not 100 percent secure."

Plane hack: How an attack could happen

A company that has been investigating the vulnerabilities in the transportation sector is IoActive, which recently found itself in the headlines for successfully demonstrating a real-time hacking of a car. 

IoActive's 2014 whitepaper ‘A Wake-up Call for SATCOM Security' detailed how a passenger could access the beating heart of a plane: its avionics system.

"We demonstrated how a passenger from the cabin or the passenger's area could potentially access the avionics," Ruben Santamarta, principal security consultant at IOActive, tells Techworld.

Listen: Can you hack a plane? (16:00)

Typically there are four security domains on any given commercial aircraft. 

The aircraft control domain is the most critical: it's the section where all the vital systems controlling the aircraft and sending and receiving data are located.

Then there's the airline information services domain, where devices and applications used by the crew to receive or send data for airline operations is found, and this will be anything to do with the specific procedures of an airline. "This is an important domain, but not so critical," Santamarta says.

"Then we have two separated domains that are mainly focused on the passengers: the passenger information and entertainment services domain, and we have the passenger's own devices."

An attacker would be able to compromise satellite communication equipment that's usually present on aircraft – and from there, progress into other, more critical systems on the plane. "That is a way to attack an aircraft – and it could be performed by someone using the public Wi-Fi on board, or someone who had his laptop infected with malware and didn't even know someone was trying to hack into the aircraft. That is one scenario."

If that all sounds horrifying, Santamarta says that in some cases even if attack points are open and a hacker manages to worm into the inner workings of an aircraft, the jury's out on whether or not it would be possible to actually bring a plane down.

"We can't say whether that's possible or not in a general way," Santamarta says. "Every aircraft is different and has to be reviewed case by case. The manufacturer of an aircraft will have created a system in a specific way, then third party vendors or integrators can modify these systems, but they have to apply for a specific regulation to be able to add another system to the aircraft. It's very difficult to provide an answer generally: [an attack] has to be very specific for a certain model and a certain airline."

Plane hack: 'Where are we headed?'

Tom Patterson, ‘chief trust officer' at infosec company Unisys, has previously advised the White House and Parliament on matters of national security.

"When you look at a [safety] question like this, it's not about what has happened in the past," he says. "This question is more important: where are we headed? What is the direction? What are the changes that are happening?"

Nervous flyers needn't add cybersecurity to their list of anxieties just yet. At present, Patterson says, there's a very reliable separation between passenger access and the avionics domain of a plane. But there are changes coming.

"There are issues around keeping them separate, and keeping the security separated, and that requires the industry at large to make sure that's driven as the changes are being rolled out," he says. "There are changes in what passengers do in flight and how planes are being changed."

"One of the key points is to look at weight. In the old days, in-flight avionics were a completely separate system – they were on wires, on controllers, everything was separate. It would have been very difficult for an attacker to jump in there. What's happening now is, to lighten the planes, more systems are sharing common wires and common controllers."

"It's not that it's not safe today, but as things change both on the threat and the operations side, you also need to change the security strategy to use more modern technologies that adapt and will work in today's business environments."

Microsegmentation – the process of separating out different packets on a common wire – is one such technology that is keeping data exactly where it needs to be. And, after all, there is of course the failsafe of two human pilots in the cockpit, who are trained to respond to the most desperate situations imaginable.

Plane hack: Internet of things

The internet of things – that is, where objects and sensors send and receive data to and from one another – also presents challenges for transport.

"We are in a very interesting moment," IOactive's Santamarta says. He says the way features are being added to cars and other transport is similar to industrial control systems.

"All those devices that control power plants or service stations or the water supply, those kinds of critical things, several years ago nobody was paying attention to those systems, and the vendors were adding newer and newer features and connectivity to those modules," he says.

"And then all of a sudden, those devices became targets for criminals and for governments and then everything exploded. I think we are in a similar moment right now.

"That's scary but that's the reality of this sector. I think usually it's better to take the proper approach before it's too late, otherwise it's going to be a real problem to fix all those things once those functionalities have already deployed."

Plane hack: Spanair flight 5022

Ultimately though, the last time critical air systems were impacted by a cyber attack, it lead to disaster.

The attack was without motivation but the result was fatal – the most deadly air accident of 2008 was Spanair flight 5022.

"During the on-the-ground check, the computer systems were disconnected from the server centre because of a malicious attack," says Eugene Kaspersky. "It wasn't designed to do that, it was just a side effect."

"As a result, the engineers didn't recognise the technical problems with the plane – 2008, August, Madrid Barajas Airport. More than 100 people dead."

It is no wonder, then, that the air industry understands cyber security is of paramount importance, and those in both the public and private spheres are rigorous in their analysis. Unisys' Tom Patterson tells Techworld that there's a high level of collaboration between airlines, manufacturers, governments and aviation authorities.

"Air transport is one of the critical infrastructure sectors that's looked at globally, and is one of the leading sectors to share information and countermeasure information among all its participants around the world," Patterson says.

"We've got great leaders on both sides, facilities to work together, we definitely come together when there are emergencies, now what we're starting to do is get them to come together in advance of those things to prevent those emergencies from happening."