Security researcher Ruben Santamarta from IOActive, found an unprotected database from Boeing's server, when he was doing some web searchers for technical documents related to his research on airplane's cybersecurity.
After doing some reading, he realized that the database consisted of codes for Boeing's 737 and 787 passenger jets. It was left accessible to the public, and available for anyone to see. Santamarta downloaded everything he found.
That was in 2018.
Fast forward to 2019, Santamarta revealed that the leaked codes led him to find some security flaws on the Boeing's giant airplanes.
According to him, after digging into the codes, he found some security flaws in Boeing's 787 Dreamliner's components, located at the the plane's multi-tiered network.
He said that hackers can exploit this flaw to launch a multi-stage attack to cause issues to the plane’s in-flight entertainment system, to even the plane's critical systems like flight controls and sensors.
Santamarta contacted Boeing, and the database was taken down from the public. But the company denied that such attack on its planes is even possible.
This is why on August 7th, 2019, Santamarta brought his findings to the public on the Black Hat security conference in Las Vegas, U.S.. In the event, he detailed the multiple serious security flaws in the code for a component of the 787 known as a Crew Information Service/Maintenance System (CIS/MS).
The CIS/MS in a plane is responsible for applications like maintenance systems, as well as the collection of navigation documents and manuals. Santamarta said that he found memory corruption vulnerabilities in the system.
He claimed the hackers could exploit this flaw, to gain further access to more restricted part of a plane's network.
Eventually, hackers could ruin the in-flight entertainment system, to even sending commands to sensitive components and sensors. This could make the hackers to gain control of the plane by hacking their way into its engine and brakes.
Boeing said that its plane's network would make such attempt impossible, saying that:
"IOActive reviewed only one part of the 787 network using rudimentary tools, and had no access to the larger system or working environments. IOActive chose to ignore our verified results and limitations in its research, and instead made provocative statements as if they had access to and analyzed the working system. While we appreciate responsible engagement from independent cybersecurity researchers, we’re disappointed in IOActive’s irresponsible presentation."
Santamarta agreed with Boeing, considering that he himself has no access to the airplane, and not having a full picture or the flying machine. He can't prove whether his theory is right.
"We don't have a 787 to test, so we can't assess the impact," Santamarta said. "We’re not saying it’s doomsday, or that we can take a plane down. But we can say: This shouldn’t happen."
However, other security researchers who have reviewed Santamarta's findings, argue that while a cyberattack on a plane's most sensitive systems remains unknown, the flaws uncovered in the 787's code shows how Boeing lacked the attention to cybersecurity.
They also say that the company's responses to their findings aren't very convincing, given the people's lives can be at stake.
But still, Santamarta's finding also represents a step forward towards showing the possibility of an actual plane-hacking technique.
In a follow-up call with WIRED, the company's spokesperson said that it's investigating deeper into Santamarta's claims, and in the meantime, has put an actual Boeing 787 in "flight mode" for testing for its security engineers to attempt to exploit the vulnerabilities that Santamarta had exposed.
They found that they couldn't carry out a successful attack. Honeywell, which supplied Boeing with the code for the CIS/MS, also said that "after extensive testing, Honeywell and its partners determined there is no threat to flight safety as the 787’s critical systems cannot be affected."
Boeing at the moment, is already having a hard time, concerning that two of its Boeing 737 Max 8 planes were involved in two fatal crashes.
The first was on October 29, 2018, when Lion Air Flight 610, 737 MAX 8 registration PK-LQP, plunged into the Java Sea, only 13 minutes after take off from Soekarno–Hatta International Airport, Jakarta, Indonesia. The flight was a scheduled domestic flight to Depati Amir Airport, Pangkal Pinang, Indonesia.
All 189 of its passengers and crew on board died.
The second was On March 10, 2019, when Ethiopian Airlines Flight 302, 737 MAX 8 registration ET-AVJ, crashed about six minutes after takeoff from Addis Ababa, Ethiopia.
The incident killed all 149 passengers and 8 crew members on board.
