US authorities are looking into whether a cyber security professional was actually able to hack into the computer system of a plane and control the engines.
Chris Roberts, a cybersecurity consultant, was detained by the FBI in April 2014 following a United Airlines flight to Syracuse, New York, after officials saw tweets he had posted in which he mentioned hacking into the plane on which he was travelling.
Subsequent to his arrest, he allegedly told the FBI he had hacked into the computer systems of planes on up to 20 different occasions and had managed to control an aircraft engine during a flight, according to federal court documents.
An FBI search warrant application filed in the US District Court for the Northern District of New York describes the investigation of Roberts for possible computer crimes.
The warrant was first publicised on Friday by APTN, a Canadian News Service. Read the search warrant application (PDF)
During FBI interviews in February and March this year, the document says, Roberts told investigators he hacked into in-flight entertainment systems aboard aircraft.
According to the document, in an interview on February 13, 2015, Roberts explained to FBI agents he had hacked into in-flight entertainment systems made by Thales and Panasonic on Boeing 737, 757 and Airbus A-320 aircraft.
The warrant described that Roberts used a cable to connect a computer directly to a Seat Electronic Box under his seat, which connected to the plane’s in-flight entertainment system, which he accessed using default IDs and passwords.
He overwrote computer code for the planes’ thrust management computer, which he told agents allowed him to make the plane climb on his command.
On April 15, Roberts flew United from Denver to Chicago. On the flight, he tweeted about the possibility of accessing the plane’s In Flight Entertainment system.
The FBI sent an agent to inspect the flight when it arrived in Philadelphia, where it had flown after Chicago.
The agent inspected the Seat Electronic Box below seats 2A and 2B and found evidence of damage and tampering.
Roberts reportedly told the FBI he was furnishing the information “because he would like the vulnerabilities fixed”.
Roberts did not respond to requests for comment, but did tweet on Saturday that he’s been advised to keep quiet on the topic. “There’s a whole five years of stuff that the affidavit incorrectly compressed into one paragraph….lots to untangle,” he tweeted.
In response to the claims Boeing issued a statement which said:
“In-flight entertainment (IFE) systems on commercial airplanes are isolated from flight and navigation systems. While these systems receive position data and have communication links, the design isolates them from the other systems on airplanes performing critical and essential functions.
“Boeing is committed to designing airplanes that are both safe and secure – meeting or exceeding all applicable regulatory requirements for both physical and cyber security. For security reasons, we do not discuss specific airplane design features.
“It is worth noting that Boeing airplanes have more than one navigational system available to pilots. No changes to the flight plans loaded into the airplane systems can take place without pilot review and approval. In addition, other systems, multiple security measures, and flight deck operating procedures help ensure safe and secure airplane operations.”
