Airline industry swooping in to prevent cyberattacks

Nov 08, 2013 by Paresh Dave

Worried that computer hackers attacking banks and media companies could easily shift targets, the airline industry is taking preemptive steps to ensure it doesn't become the next victim.

Although the "hacking" of planes midair to bring them down is unlikely, many networks, including airline reservation systems and airport parking meters, could be vulnerable to cyberattacks, which could disrupt air travel, weaken travelers' confidence and deal a major blow to a fragile economy.

"The aviator guys are getting together because they see what's going on in every other sector," said Paul Kurtz, chief strategy officer for computer security firm CyberPoint International. "It's just a matter of time before the bad guys start wondering, 'How do we start making money off attacking the aviation industry?' "

New technologies and tighter budgets have added to the complexity of safely transporting 2.6 billion air passengers a year worldwide. But officials at , airports and aircraft makers believe they can develop enough safeguards to limit the effects of hackers.

Boeing Co., which by the nature of its business has always focused on aircraft safety and reliability, is now also stressing network and computer systems security. Worries about defects such as hydraulic leaks have been brought up alongside concerns that a miscreant could surreptitiously inject malicious commands somewhere in the 18 million lines of that help power its latest jet, the 787 Dreamliner.

"I know the media worries about the kid in seat 14B on his laptop hacking the flight controls," Michael Sinnett, Boeing's vice president of product development, said at an industry conference this summer. "I'm here to tell you that's not going to happen. But the question is, 'Do I have to worry about a guy inside my system for four years before the code even hits the streets?' "

Most of the code is written by Boeing contractors, and Boeing and aviation regulators test for errors. Even afterward, Boeing assumes programs will do something unexpected and prepares backup plans.

For pilots, large suitcases filled with instruction manuals have been reduced to laptops and, more recently, tablet computers. Weather updates and other flight-related information - once relayed via or paper printouts - are increasingly beamed by Wi-Fi and the new NextGen air traffic control system directly into the cockpit.

Kurtz said protecting those links is relatively easy in the U.S.

"But somewhere in Asia or Africa, the updates and maintenance might not be as (buttoned-down)," he said.

Yet not all airports in the U.S. are ready to guarantee secure connections for airlines. LAX has been among the large airports at the forefront of strengthening defenses through education and monitoring.

But Dom Nessi, LAX's , said that the airport doesn't offer airlines a dedicated connection because "we don't think we can give them a secure service."

Like other airports, LAX remains a juicy target for hackers. A phishing attack in late June and early July tried to deceive airport employees into opening fraudulent emails, Nessi said.

The airport's cybersecurity investigators said the "highly targeted" emails encouraged users to download files that when opened could have given the remote attacker "complete control over the victim machine," including the ability to monitor their Internet browsing and email.

The experts traced the attack to a foreign government, Nessi said. Phishing emails have led to several major cyberattacks, including one that led to a New York Times website outage for two days in August.

"Every day a new threat emerges, so you have to build an organization that evolves and evolves rapidly," Nessi said.

The two Washington, D.C., area airports recently began rigorous testing of computer networks and teaching employees about protecting their computers from hackers, said Martha Woolson, information technology security manager for the Metropolitan Washington Airports Authority.

Woolson said a year and a half ago several employees fell for a phishing email designed to look like one sent by US Airways. During a recent wave of phishing, more than 30 airport workers came to her for advice when they received the email.

Woolson has gone as far as distributing magnets with a simple warning, "When at work, don't go to any site that would embarrass your granny."

Cybersecurity experts suggested that airlines and airports must expect that hackers eventually will shut down crucial systems. Having a strategy in place to quickly recover is essential, they said.

"Many airlines are worried about hackers but have no idea where to start," said Joe Ayson, senior director for aviation cybersecurity firm AvIntel. "Our goal as a practice is to ensure there's a constantly revised mitigation process in place that's an actual living, breathing part of operations."

He recounted the recent experience of an airline in Africa whose reservation system had been sputtering for six weeks. The airline didn't realize it had been plagued by a computer virus. Ayson's team found ways to keep the airline running despite the issues.

Peter Andres, vice president of corporate security for Deutsche Lufthansa AG, said being a "sexy" industry heightens the challenges.

"There are so many people who love to play with simulators, who listen to controls, who really study this stuff," Andres said. "But that of course gives more transparency and tools to people who have malicious intent."

Airlines, airports and aircraft makers see themselves at a crossroads. The sooner they can show that computer-related threats have been minimized, the more likely the industry won't face additional government regulation.

"It's the kind of homework that's been long overdue," Andres said.

About the only regulation desired by the industry is legislation protecting airlines from liability and lawsuits if they share information about "hacks" with one another and the government.

To be sure, airlines run the risk of overreacting about the risks of technology. Boeing's Sinnett compared cybersecurity with lightning. Every plane is struck by lightning once a year, he said to conference attendees. But Boeing doesn't expect a plane to get hit by a dozen shocks at once.

"You account for it as much as you can and reduce its impact," Sinnett said. "It's not perfect physics, but it's a black art."

Explore further: Movie world fears for freedom of speech as N.Korea parody pulled

1 /5 (1 vote)
add to favorites email to friend print save as pdf

Related Stories

American Airlines fixes computers, delays go on

Apr 16, 2013

American Airlines says it has fixed an outage in its main reservations system that is disrupting travel for thousands of passengers whose flights have been delayed or canceled.

EU climate chief revives airline carbon tax proposal

Oct 16, 2013

The EU's top climate-change official said Wednesday that Brussels was within its rights to tax airlines for emissions in its airspace, reviving a controversial proposal that drew a storm of criticism.

Several airlines see delays from computer outage

Aug 06, 2013

Several airlines are experiencing flight delays nationwide because of a problem with a computer system they use for services such as reservations, check-ins and online booking.

Widespread flight delays hit United Airlines

Aug 28, 2012

United Airlines passengers were stranded at airports around the United States for hours on Tuesday due to network outages that affected its airport and website operations.

Recommended for you

Report: FBI's anthrax investigation was flawed

4 hours ago

The FBI used flawed scientific methods to investigate the 2001 anthrax attacks that killed five people and sickened 17 others, federal auditors said Friday in a report sure to fuel skepticism over the FBI's ...

Study reveals mature motorists worse at texting and driving

Dec 18, 2014

A Wayne State University interdisciplinary research team in the Eugene Applebaum College of Pharmacy and Health Sciences has made a surprising discovery: older, more mature motorists—who typically are better drivers in ...

Napster co-founder to invest in allergy research

Dec 17, 2014

(AP)—Napster co-founder Sean Parker missed most of his final year in high school and has ended up in the emergency room countless times because of his deadly allergy to nuts, shellfish and other foods.

LA mayor plans 7,000 police body cameras in 2015

Dec 16, 2014

Mayor Eric Garcetti announced a plan Tuesday to equip 7,000 Los Angeles police officers with on-body cameras by next summer, making LA's police department the nation's largest law enforcement agency to move ...

User comments : 0

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.