Newer aircraft, including Boeing 787, vulnerable to hacking, GAO warns

This is an archived article and the information in the article may be outdated. Please look at the time stamp on the story to see when it was last updated.

WASHINGTON (CNN) — Hundreds of planes flying commercially today could be vulnerable to having their onboard computers hacked and remotely taken over by someone using the plane’s passenger WiFi network, or even by someone on the ground, according to a new report from the Government Accountability Office.

One of the authors of the report, Gerald Dillingham, told CNN the planes, include the Boeing 787 Dreamliner, the the Airbus A350 and A380 aircraft and have advanced cockpits that are wired into the same WiFi system used by passengers.

“Modern communications technologies, including IP connectivity, are increasingly used in aircraft systems, creating the possibility that unauthorized individuals might access and compromise aircraft avionics systems,” according to the report, which is based on interviews with cybersecurity and aviation experts.

The government investigators who wrote the report say it is theoretically possible for someone with just a laptop to:

— Commandeer the aircraft

— Put a virus into flight-control computers

— Jeopardize the safety of the flight by taking control of computers

— Take over the warning systems or even navigation systems ​

The report explains as the air traffic control system is upgraded to use Internet-based technology on both the ground and in planes, avionics could be compromised . Older planes systems aren’t highly Internet-based so the risk for aircraft 20 years and older is less.​

The GAO report does not draw a roadmap on how this could be done, but it does say someone would have to bypass the firewall that separates the WiFi from the rest of the plane’s electronics.

GAO Investigators say they spoke with four cybersecurity experts about the firewall vulnerabilities, “and all four said that because firewalls are software components, they could be hacked like any other software and circumvented. ”

Commercial pilot John Barton told CNN, “We’ve had hackers get into the Pentagon. So getting into an airplane computer system I would think is probably quite easy at this point.”

The report continues, “According to cybersecurity experts we interviewed, Internet connectivity in the cabin should be considered a direct link between the aircraft and the outside world, which includes potential malicious actors.”

“A virus or malware planted in websites visited by passengers could provide an opportunity for a malicious attacker to access the IP-connected onboard information system through their infected machines,” according to the report.

It says another way a hacker could get access to a plane’s computers is through a physical connection and notes that whenever there is a physical linkage, like a USB plug in a passenger seat, if those wires are linked in any way to the airplane’s avionics, that linkage creates a vulnerability.

Experts told investigators, “If the cabin systems connect to the cockpit avionics systems and use the same networking platform, in this case IP, a user could subvert the firewall and access the cockpit avionics system from the cabin.”

Members of the House Transportation and Infrastructure Committee, along with senators on the Commerce Committee requested the report.

Rep. Peter DeFazio, D-Ore., who is the ranking minority member of the House committee, tells CNN, “This report exposed a real and serious threat — cyberattacks on an aircraft in flight.”

He says that the Federal Aviation Administration, “must focus on aircraft certification standards that would prevent a terrorist with a laptop in the cabin or on the ground from taking control of an airplane through the passenger WiFi system. That’s a serious vulnerability. ”

The report concludes that the FAA needs to work on certification of aircraft avionics that will account for these vulnerabilities and remove them as possible threats to commercial aviation.

A source briefed on the report tells CNN that cyber security experts say these vulnerabilities exist and these scenarios are possible. But it is unclear how far the GAO went to test any of these possible scenarios. In the report, the GAO does not say whether this is based on actual testing or just theoretical mockups.

Captain Barton notes, “This is going to take a long time, vetted by the best experts in the world and safety people to make this technology secure and safe.”

In a letter to the GAO, Keith Washington, acting assistant secretary for administration with the FAA, said in part, the agency “recognizes that cyber-based threats to federal information systems are becoming a more significant risk and are rapidly evolving and increasingly difficult to detect and defend against. We take this risk very seriously.”

Washington went on to say “It is also important to note that the FAA had already initiated a comprehensive program to improve the cybersecurity defenses of the NAS (National Airspace System) infrastructure, as well as other FAA mission-critical systems. We are significantly increasing our collaboration and coordination with cyber intelligence and security organizations across the federal government and in the private sector.”

“The Dreamliner and the A350 were actually designed to have the technology in it going forward to be able to have remote control intervention between the pilot and the ground or if an emergency were to happen in the air, ” Barton said.

But he quickly added, “It’s going to take a long time before we get to the point where that technology is safe and secure.”

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s


  • aviation expert

    this article is such garbage and only meant to scare people…. this advanced air crafts have multiple security measures to prevent this and the WIFI and avionics are completely separate system. Get better experts

  • Engineer

    As someone who has helped develop the Flight Controls systems for the 787, I can honestly say this is 100% false. The author has no idea how aircraft systems interact or how Level A software is created, tested and certified. Additionally, this was previously addressed in ~2007 the first time this was brought up. It is even more impossible now than it was before. This report is utter garbage and shouldn’t even be reported on.

Notice: you are using an outdated browser. Microsoft does not recommend using IE as your default browser. Some features on this website, like video and images, might not work properly. For the best experience, please upgrade your browser.