Speaker 1: In a world of connected vehicles, the real drivers might
Speaker 1: be the hackers. I'm Jonathan Strickland, and this is tech
Speaker 1: stuff daily. In information security, there's a practice called penetration testing.
Speaker 1: The concept is pretty simple. A hacker or team of
Speaker 1: hackers attempts to gain entry into what is supposed to
Speaker 1: be a secure system using various hacking techniques. The goals
Speaker 1: to expose any security vulnerabilities that need to be patched
Speaker 1: to make the system more impenetrable. Recently, a private company
Speaker 1: working with the Department of Homeland Security revealed that it
Speaker 1: was able to gain remote access to the on board
Speaker 1: systems of a Boeing seven fifty seven back in six
Speaker 1: at an airport in Atlantic City, New Jersey. While the
Speaker 1: DHS says the hacking team couldn't get access to the
Speaker 1: aircraft's flight control systems, this is still obviously a huge concern.
Speaker 1: The Department of Homeland Security was understandably read sent to
Speaker 1: share details of the successful attack. But here's what we
Speaker 1: do know. The intruder was able to access certain on
Speaker 1: board systems remotely via radio frequencies without having physical contact
Speaker 1: with the plane. The intruder also didn't rely upon collusion.
Speaker 1: There was no one on board the plane on the
Speaker 1: intruder's side. In other words, so it sounds like this
Speaker 1: researcher was able to use a fairly simple piece of
Speaker 1: equipment that could pass through airport security and gain access
Speaker 1: to the seven fifty seven's communication systems. According to the DHS,
Speaker 1: that's all the researchers were able to take over, and
Speaker 1: that is enough to be extremely troubling. But the DHS
Speaker 1: stressed that the researchers could not affect the flight path, software,
Speaker 1: or any of the actual controls of the aircraft. Typically,
Speaker 1: aircraft network systems are designed in such a way to
Speaker 1: prevent an intruder from getting to the avionics or flight
Speaker 1: controls part of an aircraft system. Historically, the way to
Speaker 1: do this was to have what is called an air gap.
Speaker 1: An air gap is when you create either a computer
Speaker 1: or network that has no connection to a larger outside network.
Speaker 1: A PC with no wired or wireless connections to the
Speaker 1: Internet would have an air gap. There's no way for
Speaker 1: a hacker to connect to the machine without first gaining
Speaker 1: physical access to it. Even with air gaps, you typically
Speaker 1: have communications and avionics depending upon the same general network.
Speaker 1: The two systems wouldn't have a direct line of communication
Speaker 1: between them, but would refer to some form of common
Speaker 1: communication interface. Air Gaps are more common between passenger networks
Speaker 1: and critical systems. In other words, if you connect to
Speaker 1: the in flight WiFi, you don't magically get access to
Speaker 1: an aircraft's critical systems. That's generally considered a good thing.
Speaker 1: As all sorts of vehicles have become more advanced and connected,
Speaker 1: we've seen multiple examples of poor security implementations that could,
Speaker 1: under the right circumstances, lead to catastrophe. A couple of
Speaker 1: years ago, some security researchers demonstrated that they could hack
Speaker 1: into certain Cherokee models remotely and affect the vehicle's behavior,
Speaker 1: including the sound system, windshield wipers, and even the accelerator.
Speaker 1: This was a fairly recent development. Previously, security experts needed
Speaker 1: physical access to a vehicle in order to make a
Speaker 1: wired connection between their computers and the cars onboard computer system.
Speaker 1: As we've trended more toward a wireless infrastructure, opportunities to
Speaker 1: exploit vulnerabilities have increased. So how do you fix it? Well?
Speaker 1: In the case of cars, it requires massive recalls to
Speaker 1: address hardware in some cases, but in others you can
Speaker 1: fix it with a software patch, which, depending upon the
Speaker 1: problem and the car manufacturer, might allow owners to download
Speaker 1: the update directly to their vehicle without leaving the driveway.
Speaker 1: But with planes, it's a little more complicated. According to
Speaker 1: Robert Hickey, who is an aviation program manager at the
Speaker 1: Department of Homeland Securities Science and Technology Director at Cybersecurity Division,
Speaker 1: any fixed for Boeing aircraft would be both time consuming
Speaker 1: and expensive. Specifically, he said quote the cost to change
Speaker 1: one line of code on a piece of avionics equipment
Speaker 1: is one million dollars and it takes a year to implement.
Speaker 1: Hickey said that newer aircraft models have better security measures,
Speaker 1: but that's not a huge comfort since the commercial aircraft
Speaker 1: in operation are legacy models, which means they are older
Speaker 1: models that lack the latest security measures. So in short,
Speaker 1: there is a relatively simple hack that relies on radio
Speaker 1: communications devices that anyone could get through airport security and
Speaker 1: potentially compromise the communication system on an aircraft. Whether you
Speaker 1: maintain control of the system once the aircraft moves out
Speaker 1: of transmission range hasn't been discussed, and maybe that you'd
Speaker 1: have enough influence to prompt to flight cancelation and that's it.
Speaker 1: That's still incredibly disruptive. Of course, the larger fear is
Speaker 1: that you'd have a perpetual back door into a plane's
Speaker 1: onboard network, and there's always the concern that somehow in
Speaker 1: the future hackers will find a way to affect avionics
Speaker 1: and not just communications. There are hard lessons to learn
Speaker 1: in the information age, and it seems like we must
Speaker 1: relearn some of them every year. We have to keep
Speaker 1: in mind that along with all the benefits wireless technologies
Speaker 1: have to offer, there are potential drawbacks. If we keep
Speaker 1: that in mind from the start, we're more likely able
Speaker 1: to address design flaws before they become part of a
Speaker 1: final product. That's all for today. To learn more about
Speaker 1: internet security, avionics, the science of flight, and more, subscribe
Speaker 1: to The Tech Stuff podcast. We publish on Wednesdays and
Speaker 1: Fridays and do a deep dive in all things in
Speaker 1: the world of technology. I'll see you against It.