Can a Passenger Hack an Airplane?

Original Article ↗ Hacker News Discussion ↗

Commercial aviation security is scrutinized here through the question of whether a passenger could hack an airliner mid-flight. Commenters generally conclude that modern aircraft segregate flight-control systems from passenger-facing networks like in‑flight entertainment, often via one‑way or physically isolated buses mandated by regulators, making direct takeover from a seat highly implausible—though legacy systems, Electronic Flight Bags, and cabin subsystems (Wi‑Fi, PA, audio media ports) may expose softer targets for mischief or disruption. The exchange also contrasts aviation’s rigorous safety engineering with more lax practices in consumer tech and cars, highlighting both the rarity of catastrophic failures and the ongoing need to harden interfaces that bridge secure and insecure domains.

Overall answer to the headline

  • Consensus: from a passenger seat, you can’t realistically “hack and fly” the plane.
  • Some argue Betteridge’s law applies: headline overstates the actual risk.
  • Others note old or poorly maintained systems can still expose meaningful—but not flight‑control—risks.

Aircraft networks and isolation

  • Multiple commenters emphasize regulatory and engineering separation between:
    • Aircraft Control Domain (ACD) and
    • Passenger/Information/Entertainment networks.
  • Typical pattern: ACD → unidirectional or tightly controlled bus → Network Extension Device → passenger systems.
  • Some details: ARINC 429/644 are described as logically or physically one-way; NEDs must be physically unidirectional or contain security controls.
  • Skepticism remains: unless the link is truly one‑way at the physical level, “complete isolation” is doubted.

Flight information sources (speed, altitude, position)

  • Several comments note that passenger displays don’t need ACD access:
    • Devices could rely on their own GPS receivers.
    • Passengers can read similar data from phone GPS apps or external services like FlightAware/ADS‑B.
  • Debate over GPS export controls (COCOM): most consumer receivers still work fine at commercial airliner speeds and altitudes.

Actual and alleged hacking

  • The article referenced research showing:
    • Old in‑flight entertainment systems (e.g., running NT 4.0) were exploitable.
    • Vulnerabilities in Electronic Flight Bag apps could impact performance calculations (still indirect).
  • Discussion of a high‑profile researcher who claimed to have issued climb commands via the IFE:
    • FBI documents assert he said he affected engine behavior.
    • Many commenters doubt the technical plausibility and/or note he may only have affected a simulator.
    • Universally condemned as reckless if true.

Broader safety and threat surfaces

  • Several compare aircraft to cars:
    • Modern cars often lack strict separation between infotainment and control buses (e.g., CAN), raising concerns.
    • OTA update capability is noted as a potential attack vector.
  • Some raise battery/fire risks from hacked phones or laptops, but others point out no known cases and see this as speculative.

Other notes

  • Examples of non‑safety hacks/pranks: crashing IFE into a command prompt, abusing in‑flight chat, and speculation around hijacked PA/audio via accessible media slots.
  • Multiple complaints that the blog post is clickbaity, promotional, and annoyingly formatted (duplicated pull quotes).