Hackers could take control of a plane using in-flight entertainment system

A flaw in an in-flight entertainment system used by major airlines including Emirates, Virgin and Qatar could let hackers access a planes' controls.

The security hole in the Panasonic Avionics in-flight system is used in planes run by 13 major airlines and could put passengers' information and safety at risk, as well as disrupting their flight experience, according to researchers at IOActive. Panasonic denied that is is possible to inflict such damage through its systems.

Exploiting the problem, researcher Ruben Santamarta managed to "hijack" in-flight displays to change information such as altitude and location, control the cabin lighting and hack into the announcements system.

"Chained together this could be an unsettling experience for passengers," said Santamarta, principal security consultant at IOActive who was behind the discovery.

Santamarta was also able, in some instances, to use the flaw to access credit card details of frequent fliers stored in the automatic payment system. And he said it was possible the vulnerability could be used to access the aircraft's controls.

He said such attacks is "totally feasible" from a technical perspective.

"I don't believe these systems can resist solid attacks from skilled malicious actors," he said. "This only depends on the attacker's determination and intentions, from a technical perspective it's totally feasible."

The extent of the damage the hack could inflict on a plane depends on how successfully the airline has isolated its systems. For example, the passenger entertainment shouldn't be connected to the passenger owned devices or aircraft control. But sometimes it is.

As a result, Santamarta warned that airlines should be "incredibly vigilant" with in-flight systems and make sure they are properly segregated from the aircraft's controls.

IOActive alerted Panasonic to the vulnerabilities back in March 2015, giving it sufficient time to fix the problems before going public with the information. It is not clear what action Panasonic has taken, but it denies the plausibility of the research.

"The allegations made by IOActive regarding in-flight entertainment systems manufactured by Panasonic Avionics contain a number of inaccurate and misleading statements," said Panasonic Avionics. "IOActive has chosen to make highly misleading and inflammatory statements suggesting that hackers could 'theoretically' gain access to flight controls by hacking into Panasonic's IFE systems."
IOActive's ethical hackers gained notoriety last year when they took control of a Jeep Cherokee from 10 miles away and cut its engine while driving on the motorway, making it veer off the road.

They did this by hacking into the Jeep's on-board systems, which gave them access to the car's steering, brakes and transmission. The flaw also affected more than 470,000 cars made by Fiat Chrysler.

In 2014, when he began hacking planes out of a fear of flying, Santamarta discovered hundreds of software updates for multiple major airlines publically available online that he has exploited in his research.

Using this he discovered another way to hack planes through their satellite communications systems. At the time, he demonstrated how a plane's Wi-Fi or entertainment system could be used to tamper with satellite communications, or interfere with navigation and safety controls.

"I've been afraid of flying for as long as I can remember," he said. "It might sound like a sick cure but, as a hacker, learning everything I could about how planes work, from the aerodynamics to electronics, has reduced the fear significantly."

Emirates said it works with Panasonic to regularly update its systems and resolve any problems. "The safety of our passengers and crew on board is a priority and will not be compromised," the company said.

In 2015, a prominent hacker managed to make an airliner “climb” and move “sideways” after infiltrating its in-flight entertainment system.

Chris Roberts, founder of the cybersecurity firm One World Labs, was escorted from a United Airlines flight after sending in-air tweets bragging that he could deploy the oxygen masks.