FBI questions in-flight hacker who claims plane takeover

A hacker told the FBI last week he has been able to crack aircraft computers on numerous occasions—as a passenger. According to the affidavit, Chris Roberts claims he caused a plane to move laterally and climb while he was connected to its onboard entertainment system.

During an April 15 flight on United Airlines from Chicago to Syracuse, N.Y., Roberts tweeted he might activate the drop-down masks or the plane’s alert systems, all in a bid to identify security risks ahead of malicious hackers.

Though United officials said it was doubtful his hacking escapade was possible, FBI agents questioned him upon arrival. Experts say potential onboard cyber threats should be taken seriously as newer model airplanes are increasingly connected to the internet.

Roberts’ company, One World Labs, specializes in finding such risks.

Before the April flight, Roberts met with the FBI in February and March to highlight vulnerabilities with certain aircraft entertainment systems, the affidavit said. He explained how he managed to breach a plane’s systems between 15 and 20 times during 2011 and 2014, simply by connecting his laptop via ethernet cable to an electronics box beneath his seat.

Speaking through his attorney at the San Francisco-based Electronic Frontier Foundation, Roberts claimed he only wanted to help improve aircraft safety.

Roberts’ hacking trips came to light a month after a report by the U.S. Government Accountability Office, which said some passenger airliners are open to hacking through their wireless networks.

“Modern aircraft are increasingly connected to the internet,” the report noted. “This interconnectedness can potentially provide unauthorized remote access to aircraft avionics systems.”

The proof of such a risk is in passenger-seat video monitors: They visually map the plane’s real-time location as passengers switch between video and television programs and the map, indicating a link between flight control and entertainment networks, said Steven Bellovin, a computer science professor at Columbia University.

And an airplane offering Wi-Fi access to passengers may do so through the same data link pilots use to communicate with the airline, he said.

United Airlines—maker of the ultra-connected Dreamliner—noted Roberts’ claims about being able to manipulate computer systems on board a flight, but spokesman Rahsaan Johnson said airline officials are “confident” Roberts could not access the flight control systems in the way he described.

A Boeing statement said in-flight entertainment systems and navigational systems are not intertwined. Other electronics designers and experts say Roberts’ claim is highly dubious because changes to flight plans loaded into the airplane’s communications systems can only happen with a pilot’s approval, even if a hacker gained entry.

Tim Erlin, director of IT security and risk strategy at the cybersecurity firm Tripwire, said passenger-to-cockpit computer connectivity may depend on the aircraft model and how old the plane is: “If a system was installed well before these kinds of attacks and tools were conceived of, there would have been no reason not to connect them, and it might have been perceived as extra cost and complexity to keep them separate.”

Whether Roberts’ self-styled “white hat” hacking is truly aimed at improving security, airlines face daily security issues: Four U.S.-bound international airliners received anonymous threats just this week.

The Associated Press contributed to this report.