James Careless

On July 30, 2019, the U.S. Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) released&nbsp;ICS-ALERT-19-211-01&nbsp;about the hackability of CAN Bus avionics networks in civilian aircraft. Some larger aircraft use CAN bus, such as the Airbus A380, which uses the technology&nbsp;for entertainment systems but&nbsp;not for vital avionics. As for&nbsp;the flight deck, some avionics available for&nbsp;experimental and certified light airplanes&nbsp;use CAN bus.

 


“An attacker with physical access to the aircraft could attach a device to an avionics CAN bus that could be used to inject false data, resulting in incorrect readings in avionic equipment,” said CISA. “The researchers have outlined that engine telemetry readings, compass and attitude data, altitude, airspeeds, and angle of attack could all be manipulated to provide false measurements to the pilot. The researchers have further outlined that a pilot relying on instrument readings would be unable to distinguish between false and legitimate readings, which could result in loss of control of the affected aircraft.”

 


Faced with this threat, “CISA recommends aircraft owners restrict access to planes to the best of their abilities,” said the ICS Alert. “Manufacturers of aircraft should review implementation of CAN bus networks to compensate for the physical attack vector.”

 


The “public report of insecure implementation of CAN bus networks” that motivated CISA to issue this alert came from the software security firm Rapid7, led by the company’s senior security consultant Patrick Kiley. He outlined his concerns online in the July 30, 2019 Rapid7&nbsp;blog entry, Investigating and Reversing Avionics CAN Bus Systems. CISA issued&nbsp;its ICS Alert based on Kiley’s research the same day.

 


The fact that CISA acted on Kiley’s research at lightning speed (unusual in itself for a federal agency) suggests that the CAN bus hacking vulnerability is one that needs to be taken seriously. At the same time, Kiley’s reasons for doing this research (discussed at length with&nbsp;AIN), the mainstream media’s trumpeting of this hack’s existence, and the aviation industry’s reluctance to speak candidly on this topic have arguably made the CAN bus vulnerability a bigger issue than it deserves to be.

 


This article’s mission is to put the CAN bus vulnerability in context; both to make sense of the actual vulnerability&nbsp;and to see what it says about the aerospace industry’s ability to deal with serious cyber threats.

 


<h2>CAN Bus Vulnerability</h2>

 


Patrick Kiley is a security analyst, a “white hat” (good guy) hacker, and an engineer building his own Rutan-derived Cozy MK IV experimental amateur-built airplane. While doing so, Kiley learned that some homebuilt airplanes use the CAN bus network architecture found in modern computer-heavy cars and trucks.

 


The good side of using CAN bus is that its two-wire shared avionics network “was really easy to hook up,” Kiley told&nbsp;AIN. The downside: “I knew CAN bus had zero security built-in, so I decided to investigate whether any security research has been done.”

 


He couldn’t find any, so Kiley launched a research project at Rapid7 to see how vulnerable an aircraft running on CAN bus is to hacking. A link to his full research paper, Investigating CAN Bus Network Integrity in Avionics Systems, is available in the Rapid7 blog entry. Kiley’s CAN bus paper was prepared in part for the DEF CON 27 hackers’ convention in Las Vegas August 8-11, 2019.

 


Here’s the CAN bus vulnerability as laid out in Kiley’s research paper:&nbsp;“A single CAN bus network uses a shared medium, which means that all nodes (i.e. avionics devices) on the network see all individual messages on the network. Unfortunately, from a security perspective, CAN bus nodes do not natively enforce the trust models and authentication schemes common in other networking applications. Therefore, any device placed onto a CAN bus that manipulates the voltages of the High and Low wires can send any message using any arbitration ID and expect it to be acted upon by the device on the bus expecting a message from that particular arbitration ID.”

 


In plain English, a hacker can attach an external microprocessor-driven device to the CAN bus network within the aircraft and then use that device to send false readings to the avionics connected to it. According to Kiley, the external device can be programmed to start sending false readings when the aircraft achieves a certain altitude, airspeed, or any other metric shared by the aircraft’s avionics across the CAN bus network.

 


Connecting the external device to the CAN bus network is easy. “You just need to tap two wires, using a Raspberry PI microcomputer with a CAN adapter, an Arduino, or a Carloop,” said Kiley. (A Carloop is an automotive diagnostic device that plugs into a car’s OBD II port under the dash. It is the same port used by car mechanics to read trouble codes when the “check engine” light comes on. “Nothing needs to be disabled,” he said, “you just need to access the wires.”

 


Since Carloops are available in 3G/LTE models that connect directly to cellphone networks, a hacked aircraft could be controlled from a distance, with the hacker able to see the aircraft’s avionics readings in real time, provided the airplane is within reach of the cellphone network.

 


“The scenario would work like this,” said Kiley: “Build a 3G/LTE Carloop device. Attach that device to the CAN+ and CAN- connectors of the Carloop, using vampire taps. Have that Carloop establish a connection to a server under the control of the adversary. Use that server to send commands to the Carloop, thereby controlling the CAN bus of the aircraft.”

 


<h2>Reality Check</h2>

 


Two conditions—physical access to the aircraft and its use of the CAN bus architecture—are important limits to the risks associated with the CAN bus hack, especially as relate to business aircreaft. This explains the exasperation expressed by National Business Aviation Association spokesman Dan Hubbard, when faced with the many frantic general media stories on this subject, such as this one from the Associated Press: “US issues hacking security alert for small planes.” Even if an intruder manages to break into a secured hangar and access the aircraft’s CAN bus network, he said,&nbsp;“it is never sitting out on the dining table in the cabin” ready to be hacked.&nbsp;In fact, the CAN bus network wires are incorporated into inaccessible areas of the airframe, and the bus wires are not labeled, “attach hacking vampire taps here.”

 


These facts lead to a third limit: A CAN bus hacker would have to be a savvy computer programmer, plus familiar with computer and avionics systems, to succeed. This eliminates casual hackers from the mix, reducing the threat, though not&nbsp;removing it entirely.

 


These limits explain why General Aviation Manufacturers Association v-p of operations Jens Hennig isn’t overly concerned about the CAN bus vulnerability. “Nobody views the risk around that as being very high,” he said.

 


Patrick Kiley himself has never presented the CAN bus vulnerability as a serious likelihood, just as a risk that exists and needs to be managed, the way CISA did when it issued its CAN bus alert.

 


“After we published my article and during DEF CON, I spoke to a few individuals who informed me of a standard that will greatly enhance the current CAN security model,” Kiley said. “The organization is called AUTOSAR [a worldwide industry group working on automotive open architecture], and the standard is a specification of secure onboard communication [SECOC].”

 


<h2>CAN or Not?</h2>

 


The Aircraft Electronics Association is well aware of the issues raised by the&nbsp;ICS alert. Ric Peri, the association's v-p of industry and government affairs, told AIN, "The systems that they tested and based their research and subsequent report on are for experimental aircraft, LSA, or entry-level certified GA [bridging technology]." He acknowledged that "the CAN bus&nbsp;is used throughout aviation at varying levels," but "the link [as many have reported] to all of GA is not realistic nor accurate.&nbsp;As the certitude of aircraft and systems increases, so does the cybersecurity oversight and controls.&nbsp;As you can see from the 2017 research on CAN bus&nbsp;in vehicles, it is not the CAN bus&nbsp;itself but rather the architecture of the system which is technically being reported.&nbsp;Low-cost systems are more vulnerable than higher cost, more sophisticated systems.&nbsp;This is true in computers, automobiles, as well as aircraft.&nbsp;I believe that the media is doing more to encourage hackers to 'break'&nbsp;our cybersecurity measures every time we report that we have controls in place.&nbsp;Nothing is foolproof and the more we talk about it not being a problem, the more this becomes a challenge for those who dabble in this arena."

 


Based on the available facts, the CAN bus vulnerability is judged to be a real but difficult-to-execute threat against aircraft. And heeding CISA’s advice to keep aircraft properly secured and monitored is a reasonable response to this vulnerability; as is keeping an eye out for any signs of tampering within an aircraft on an ongoing basis.

News and information about crew, passenger, aircraft and airport security issues.

Putting the CAN Bus Hack into Context

Are aviation CAN bus networks vulnerable to cyber attacks? Yes, but the prospect is highly unlikely. 

2024 Corporate Aviation Leadership Summit

Charles Alcock

News about significant aircraft accidents and information from accident reports.

News and information on safety procedures and concerns.

News and issues relating to international air transport and cargo carriers, national airlines and regional airlines, including aircraft, engines, personnel, acquisitions, accidents, safety, security and training.

News and issues relating to business, corporate and private aviation, primarily regarding turbine-engine-powered airplanes and helicopters. Subjects include aircraft, engines, maintenance, operations, personnel, acquisitions, accidents, safety, security, and training.

Security consultants are warning clients to increase vigilance

Aircraft Operators Face Rising Threats in Gulf and Russia

Jeremy Kariuki

A recount of the days following the 9/11 terror attacks

Thinking on the fly: Unprecedented times, leadership during 9/11

New developments at airports including regulations and noise issues; legal disputes; openings, acquisitions and mergers.

Russia widely believed to have gotten an explosives-carrying drone into the German airport

Leipzig Drone Threat Raises Security Risk in Europe

Charlotte Bailey

Essential news and analysis on the defense aerospace business. Your trusted source for new and ongoing programs and requirements in military aircraft (manned and unmanned), engines, avionics, weapons and associated systems, including ground-based air defense.

More In Security

Aircraft Operators Face Rising Threats in Gulf and Russia

Security consultants are warning clients to increase vigilance

Thinking on the fly: Unprecedented times, leadership during 9/11

A recount of the days following the 9/11 terror attacks

Leipzig Drone Threat Raises Security Risk in Europe

Russia widely believed to have gotten an explosives-carrying drone into the German airport

Canada Targets Increased Domestic Defense Production

Saab offers Gripen with future fighter choice still to be decided

Air Chiefs: Allied Integration Essential as Threats Intensify

Evolving threats demand deeper multinational cooperation

Boeing Offering Cyber Protection with SkyGuard Service

Digital twin technology eliminates the need for physical access to the aircraft

TSA Urges Operators To Prep Pax during FIFA Traffic Surge

GA has faced Real ID compliance challenges

Security Specialist Warns of Bizav Cyberattack Threats

Cyviation said small operators need more help to be protected

AIN Products

SUBSCRIPTIONS

RESOURCES

ABOUT AIN