Hacker Shows How to Break Into Military Communications

The E-3A AWACS Component crew of a NATO AWACS plane control computer and radar screens during a patrol over Romania and Poland, Friday, April 18, 2014.

Frank Augstein / AP

AA Font size + Print

The E-3A AWACS Component crew of a NATO AWACS plane control computer and radar screens during a patrol over Romania and Poland, Friday, April 18, 2014.

Design flaws in communication equipment could affect aircraft and troop communication equipment. By Patrick Tucker

LAS VEGAS Soldiers on the front lines use satellite communications systems, called SATCOMS to call in back up, lead their comrades away from hot spots and coordinate attacks, among other things. Airplanes use SATCOMS to rely on data between the ground and the plane, and ships use them to avoid collisions at sea and call for help during storms or attacks. A well-known hacker says he’s found some major flaws in the communication equipment that ground troops use to coordinate movements. The equipment is also common on a variety of commercial ships and aircraft rely on to give pilots vital information. In other words, you can hack planes.

Speaking at the Black Hat cyber security conference, analyst Ruben Santamarta of IOActive presented a much-anticipated paper showing that communications devices from Harris, Hughes, Cobham, Thuraya, JRC, and Iridium are all highly vulnerable to attack. The security flaws are numerous but the most important one — the one that’s the most consistent across the systems— is back doors, special points that engineers design into the systems to allow fast access. Another common security flaw is hardcoded credentials, which allows multiple users access to a system via a single login identity.

Santamarta claims that a satellite communication system that’s common in military aviation, the Cobham Aviator 700D, could be hacked in a way that could affect devices that interact with critical systems possibly resulting in “catastrophic failure.” In conversation with reporters, Santamarta was careful to point out that none of the vulnerabilities he found could directly cause a plane to crash or override pilot commands. But the security gaps were significant enough that a hacker could make it much harder to fly.

The most serious vulnerability he found on Cobham’s equipment allowed a hacker access to systems swift broadband unit, or SBU, and the satellite data unit, SDU. “Any of the systems connected to these elements, such as the Multifunction Control Display Unit (MCDU), could be impacted by a successful attack,” he writes in his paper. “The SBU contains a wireless access point.”

The MCDU unit provides information on such vital areas as the amount of fuel left in the plane. A hacker could give the pilot a lot of bad information that could imperil the aircraft, as happened in 2001 aboard Transat Flight 236, when a mechanical error did not inform the pilots that fuel was being diverted to a leaky tank. The pilots didn’t know the severity of the mechanical problem until there was a massive power failure in mid-air.

“IOActive found vulnerabilities an attacker could use to bypass authorization mechanisms in order to access interfaces that may allow control of the SBU and SDU. Any of the systems connected to these elements, such as the Multifunction Control Display Unit (MCDU), could be impacted by a successful attack,” he writes.

Cobham spokesman Greg Caires told Defense One that the back door was a “feature” that the helps ensure ease of maintenance. “We determined that you have to be physically present at the terminal to use the maintenance port,” he said. Santamarta disputed that and reiterated that while you do need physical access to pull off certain attacks, other vulnerabilities within the SBU “can be attacked through the Wi-fi.”

The seas aren’t safe either. Santamarta showed that he could access the SAILOR 6000 satellite communications device, also manufactured by Cobham, which is used in naval settings by countries, including the United States, participating in the Global Maritime Distress and Safety System an international framework to allow for better communication among maritime actors. “This system, which the world’s maritime nations - including the United States - have implemented, is based upon a combination of satellite and terrestrial radio services and has changed international distress communications from being primarily ship-to-ship-based to primarily ship-to-shore-based (Rescue Coordination Center),” according to the Department of Homeland Security.

In a dramatic portion of his presentation, Santamarta live-hacked a SAILOR 6000 operating system (firmware) on stage. When he uploaded new software and then attempted to send a distress signal, rather than show a message received, the system showed a slot machine. “Because we’re in Las Vegas.”

A would-be enemy could exploit design flaws in some very commonly pieces of military communications equipment  used by soldiers on the front lines to block calls for help, or potentially reveal troop positions.

The SATCOMS in question were the Harris Broadband Global Area Network or BGAN (specifically the RF-7800-VU024) BGAN and the several BGANs from Hughes. These are in wide use among the U.S. and NATO militaries. Troops use BGANs to communicate with units beyond the line of sight. Traffic over these systems is encrypted and Santamarta did not claim that he could intercept and decrypt the data, so there’s no threat of enemies listening in on restricted calls. But Santamarta’s paper does show that it’s possible not only to disrupt the communication but also discover troop locations, which could leave soldiers open to ambush.

Representatives from Harris and Hughes did not immediately respond to a request for comment from Defense One.

Santamarta said he relayed his findings to all of the vendors and sarcastically referred to their responses as “awesome.” Hughes officials told him that the flaws did not “pose a security risk” and called back doors a “common practice in electronic products,” because vendors and technicians sometimes forget passwords.

“At this point, there are no patches. We don’t expect any,” Santamarta said.

Caires told Defense One that they became aware of Santamarta’s research in April and that it’s an issue that the company is taking “very seriously.”

It’s also an issue that’s unlikely to go away. If Cobham says that its equipment can’t be hacked remotely, then it’s not going to take any steps to address vulnerabilities that can be exploited over Wi-fi.  The company is defending its use of back doors, which Caires called a “feature” that makes maintaining the system much easier.

It’s a consideration that Santamarta dismisses unequivocally.  “I can’t recommend ever a back door. It’s a security risk. It’s not a good idea.”

Close [ x ] More from DefenseOne
 
 

Thank you for subscribing to newsletters from DefenseOne.com.
We think these reports might interest you:

  • Federal IT Applications: Assessing Government's Core Drivers

    In order to better understand the current state of external and internal-facing agency workplace applications, Government Business Council (GBC) and Riverbed undertook an in-depth research study of federal employees. Overall, survey findings indicate that federal IT applications still face a gamut of challenges with regard to quality, reliability, and performance management.

    Download
  • PIV- I And Multifactor Authentication: The Best Defense for Federal Government Contractors

    This white paper explores NIST SP 800-171 and why compliance is critical to federal government contractors, especially those that work with the Department of Defense, as well as how leveraging PIV-I credentialing with multifactor authentication can be used as a defense against cyberattacks

    Download
  • GBC Issue Brief: Supply Chain Insecurity

    Federal organizations rely on state-of-the-art IT tools and systems to deliver services efficiently and effectively, and it takes a vast ecosystem of organizations, individuals, information, and resources to successfully deliver these products. This issue brief discusses the current threats to the vulnerable supply chain - and how agencies can prevent these threats to produce a more secure IT supply chain process.

    Download
  • Data-Centric Security vs. Database-Level Security

    Database-level encryption had its origins in the 1990s and early 2000s in response to very basic risks which largely revolved around the theft of servers, backup tapes and other physical-layer assets. As noted in Verizon’s 2014, Data Breach Investigations Report (DBIR)1, threats today are far more advanced and dangerous.

    Download
  • Information Operations: Retaking the High Ground

    Today's threats are fluent in rapidly evolving areas of the Internet, especially social media. Learn how military organizations can secure an advantage in this developing arena.

    Download

When you download a report, your information may be shared with the underwriters of that document.