CISA says insecure CAN bus networks on aircraft can be exploited

Aug. 1, 2019
CISA issued an industrial control systems (ICS) alert to warn that unsecured CAN bus networks used in avionics can be exploited by bad actors.

WASHINGTON - Earlier this week, the Cybersecurity and Infrastructure Security Agency (CISA), which is part of the Department of Homeland Security, issued an industrial control systems (ICS) alert to warn that unsecured CAN bus networks used in avionics can be exploited by bad actors.

"An attacker with physical access to the aircraft could attach a device to an avionics CAN bus that could be used to inject false data, resulting in incorrect readings in avionic equipment," the agency said in its report released on July 30, 2019. "The researchers have outlined that engine telemetry readings, compass and attitude data, altitude, airspeeds, and angle of attack could all be manipulated to provide false measurements to the pilot. The researchers have further outlined that a pilot relying on instrument readings would be unable to distinguish between false and legitimate readings, which could result in loss of control of the affected aircraft."  

According to CISA, the bad actor would have to have unsupervised physical access to integrate any malicious code. The agency suggested that the best course of action to keep the networks unaffected would be to limit access to aircraft.  

"CISA recommends aircraft owners restrict access to planes to the best of their abilities," wrote the agency. "Manufacturers of aircraft should review implementation of CAN bus networks to compensate for the physical attack vector. The automotive industry has made advancements in implementing safeguards that hinder similar physical attacks to CAN bus systems. Safeguards such as CAN bus-specific filtering, whitelisting, and segregation should also be evaluated by aircraft manufacturers. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures."  

DHS also provides information related to improving ICS cyvbersecurity with defense-in-depth strategies. To learn more, click here. To read the full report, please click here.

About the Author

Jamie Whitney

Jamie Whitney joined the staff of Military & Aerospace Electronics and Intelligent Aerospace. He brings seven years of print newspaper experience to the aerospace and defense electronics industry.

Whitney oversees editorial content for the Intelligent Aerospace Website, as well as produce news and features for Military & Aerospace Electronics, attend industry events, produce Webcasts, oversee print production of Military & Aerospace Electronics, and expand the Intelligent Aerospace and Military & Aerospace Electronics franchises with new and innovative content.

Voice your opinion!

To join the conversation, and become an exclusive member of Military Aerospace, create an account today!