Re: I'm a GA Pilot and I've wondered
@Mayday: While attacks on your aircraft's CAN bus should certainly not be the most important of your worries as a pilot it should be noted that this type of attack potentially provides two specific advantages for a professional and well-funded attacker:
- stealth: an attacker could conceivably sabotate the aircraft in a way that is virtually indetectable not only during a pre-filght check but even a thorough routine inspection.
- precision: an attacker could arrange for a fatal failure to happen just when it its most dangerous and the pilot has least time to react, say, during initial climb at 200 ft GND; and it would be possible to plant the exploit code weeks or months in advance and activate it only during a pre-set time window, only on a very specific route, or by casually strolling by while holding a bluetooth dongle some time before takeoff - the possibilities are virtually endless...
@Frederic Bloggs: Yes, EFIS-equipped GA aircraft have purely barometrical backups for ASI (Air Speed Indicator) and altimeter but not necessarily any backups for the engine control. Just think of all the havoc you could wreak on a FADEC-controlled engine if you were able to manipulate the FADEC (Full Authority Digital Engine Control) unit via the CAN bus. But even just manipulating readouts of critical engine temperatures could soon prove to be fatal for the aircraft and all persons aboard. And no, planting any such malware in-flight is probably impractical. But as the attacker, you don't want to be on board when it strikes anyway.
That said, none of the scenarios explored above will ever kill nearly as many GA pilots as the classical combination of bad weather and imprudent/impatient pilot...
Biting the hand that feeds IT
