Highlights
– Terrorists and criminals have targeted transportation systems in the past.
– The mainstream media has recently reported on two vulnerabilities in critical infrastructure.
– The global and interdependent sector remains at risk.
Hacking Railways
First, in Lodz, Poland a 14-year “hacker” constructed a device that allowed him to control the rail switches of the local tram network (source). After months of study of the city’s tram system, the teenager constructed a infrared transmitter similar to a television remote that was capable of controlling the tram system’s rail switches. The device worked all to well and according to Miroslaw Micor, a spokesman for the Lodz Police, “four trams were derailed, and others had to make emergency stops.” Approximately twelve people were hurt in the chaos that resulted from the teenager’s mischief.
It appears that this teenage hacker built a standard “signal preemption” device similar in nature to the devices used by emergency services vehicles to trip traffic signals – i.e. switch signals from red to green to enable a clear path for emergency vehicles. These devices typically rely on an IR transponder and an IR receiver. It is likely that the teenager simply reengineer his television remote into a transponder set a frequency understood by the receivers in Lodz railway network.
Hacking Airplanes
In another story, according to documents published by the Federal Aviation Administration (FAA), the Boeing 787 may have design vulnerabilities in its computer systems that could potentially allow a passenger to control the planes sensitive avionics system used to fly the plane (source). Specifically, the FAA notes that the system designed to give passengers in-flight Internet access is connected to the planes avionics, navigation, and communications systems.
Boeing spokeswoman Lori Gunter contends that a passenger could not these sensitive flight control systems, as there are a series of safeguards in place including physical separation of the passenger’s Internet access from the sensitive flight control networks as well as software firewalls that protect the sensitive networks. Gunter stated, “there are places where the networks are not touching, and there are places where they are.”
Unfortunately, this guarantee of security rings hollow. Cyber security experts note a network is only secure as its weakest link. Therefore, even if there avionics, navigations, and communications system are “touching” the passenger’s in-flight Internet access network only in one spot, then all of these networks are at risk of exploitation.
Security Through Obscurity
Just as the Lodz railway designers discounted the idea that an outsider could manipulate the switches on the railway network because they were obscure, it appears that the Boeing designers are relying on obscurity to protect the sensitive flight control systems of the 787.
Although it would likely require a skilled engineer with malicious intent to exploit these vulnerabilities and cause physical harm, these stories demonstrate the dangers of not taking security seriously. In both these cases it appears that the system designers relied on “security through obscurity”, which is relies on hiding but not locking down crucial system access point. “Security through obscurity” never works because a determined adversary will always spend the time required to probe a system and will more than likely find a hidden but unprotected access point. Once inside the system the malicious actor has the ability to cause untold amounts of damages such as derailing a tram or possibly crashing a plane.
