Hacker Demonstrates Remote Airplane Hijacking Using Android Phone

The Hack in the Box security conference is taking place in Amsterdam this week, and one of the talks was fairly interesting. Hugo Teso, who is a security professional as well as a licensed pilot demonstrated how one could remotely hijack an airplane using nothing but an Android device as the tool.

It turns out that two important aviation systems — the Automated Dependent Surveillance-Broadcast (ADS-B) and the Aircraft Communications Addressing and Reporting System (ACARS) — are completely unencrypted and unauthenticated, allowing anyone with the right tools and a little know-how to access the system remotely without too much trouble.

Teso simply hit up eBay for "actual flight code software" that's normally used for training pilots, as well as nabbing a radio transmitter. During the demonstration, Teso audited real aircraft code by searching for vulnerabilities on a fleet of virtual aircrafts (using real airplanes in this case would obviously be unethical and quite illegal. Along with an Android app called PlaneSploit (which won't be hitting the Google Play store), Teso was able to control the steering of a Boeing jet, as long as the plane was in autopilot mode.

Teso has been working in the IT industry for 11 years now, and before that he was a trained and licensed commercial pilot for 12 years. His 23 years of combined experienced with the two professions has led him to teach the public about the state of the security of aviation computer systems and communication protocols, which are actually not that secure, as Teso demonstrated.

[via Help Net Security]