CISA says insecure CAN bus networks on aircraft can be exploited

WASHINGTON - Earlier this week, the Cybersecurity and Infrastructure Security Agency (CISA), which is part of the Department of Homeland Security, issued an industrial control systems (ICS) alert to warn that unsecured CAN bus networks used in avionics can be exploited by bad actors.

"An attacker with physical access to the aircraft could attach a device to an avionics CAN bus that could be used to inject false data, resulting in incorrect readings in avionic equipment," the agency said in its report released on July 30, 2019. "The researchers have outlined that engine telemetry readings, compass and attitude data, altitude, airspeeds, and angle of attack could all be manipulated to provide false measurements to the pilot. The researchers have further outlined that a pilot relying on instrument readings would be unable to distinguish between false and legitimate readings, which could result in loss of control of the affected aircraft."  

According to CISA, the bad actor would have to have unsupervised physical access to integrate any malicious code. The agency suggested that the best course of action to keep the networks unaffected would be to limit access to aircraft.  

"CISA recommends aircraft owners restrict access to planes to the best of their abilities," wrote the agency. "Manufacturers of aircraft should review implementation of CAN bus networks to compensate for the physical attack vector. The automotive industry has made advancements in implementing safeguards that hinder similar physical attacks to CAN bus systems. Safeguards such as CAN bus-specific filtering, whitelisting, and segregation should also be evaluated by aircraft manufacturers. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures."  

DHS also provides information related to improving ICS cyvbersecurity with defense-in-depth strategies. To learn more, click here. To read the full report, please click here.