By: Alexander Nikolaev - Kaspersky Industrial Cybersecurity Expert at Kaspersky

A team of cybersecurity experts in Atlantic City remotely hacked into a Boeing 757’s critical systems with just laptops and radio gear – breaching its defences in two days to expose how easily a plane’s network could fall to digital invaders. Fast forward to March 2019, and the Boeing 737 Max etched a darker mark on aviation history when a flight crashed, killing 157, mere months after another flight carried out by the same aircraft model claimed 189 lives, both disasters traced to a poorly tested software flaw in the Maneuvering Characteristics Augmentation System (MCAS) that wrested control from pilots.

Together, these cases – one a wake-up call to cyber threats, and the other two deadly testaments to software oversight – paint a stark picture: as modern aircraft morph into flying networks, vulnerabilities from both malicious hacks and human error loom large, demanding more stringent cybersecurity measures in the industry.

Modern airplanes are no longer just mechanical flying machines – they are complex, interconnected flying computers. Any airliner introduced in the last 15-20 years operates with a high degree of automation, relying on sophisticated avionics and digital control systems. They offer advanced automation, real-time data transmission and fly-by-wire controls. But with this technological advancement comes an increased risk of cyber threats. While older aircraft had minimal digital integration, today’s planes are vulnerable to cyberattacks that could potentially compromise the safety of the crew, passengers and airport personnel. Furthermore, airline operations in general and airline supply chains could be in jeopardy.

Aircraft cybersecurity remains a largely closed field, with limited public information available due to strict regulations and industry closedness. Most research and security findings are restricted to a small circle of accredited aerospace professionals, making it difficult to assess the full extent of potential vulnerabilities. Unlike other industries where cybersecurity breaches and research are more openly discussed, aviation tends to keep such information confidential to prevent misuse by malicious actors.

There have been cases where security researchers, by repeatedly accessing the in-flight entertainment system, managed to reach deeper into the aircraft’s operational layers, even interacting with engine control systems. While no confirmed cyberattack has yet led to an aviation disaster, these findings highlight potential vulnerabilities.

There are three digital domains in an aircraft that can potentially be compromised

An aircraft’s digital infrastructure is divided into three main domains, each with different levels of criticality and access control:

1. Passenger domain

This includes the in-flight entertainment system, onboard Wi-Fi and passenger connectivity services. While separate from flight-critical systems, research has shown that persistent security testers have managed to penetrate deeper into aircraft systems through entertainment networks.

2. Pilot domain

Accessible to pilots (and also maintenance crews while the plane is on the ground undergoing technical procedures), this domain manages cockpit systems and operational settings.

Pilots now use tablets (such as iPads or Android devices) for navigation, weather updates and different flight-related calculations, but these are personal devices and not directly integrated into aircraft control systems. Tablets run either iOS or Android with pilot assistance apps downloaded directly from AppStore or Google Play. These do pose potential risks if compromised, as was mentioned earlier, though they are not directly integrated into flight control systems.

For instance, tablets are vulnerable to classic mobile attack vectors: malicious app updates, phishing campaigns tricking pilots into installing tainted software or exploits leveraging unpatched OS flaws. Once compromised, a tablet could feed pilots falsified data – altered navigation charts, fake weather reports or skewed performance calculations – leading to poor decision-making in flight. For instance, a hacker could manipulate GPS coordinates or wind speed readings. The risk amplifies if pilots connect these devices to unsecured Wi-Fi networks at airports or hotels, opening doors to man-in-the-middle attacks or if they inadvertently sideload apps from unofficial sources. While not a direct takeover of the plane, this indirect sabotage could add stress to the pilot’s duties, as they will have to analyse conflicting data from different sources – the tablet and the plane’s avionics.

3. Avionics domain

This is the most critical part of an aircraft, responsible for flight control systems, autopilot and communication with ground systems, stations and airlines. Any unauthorised interference with this domain could have catastrophic consequences. Aircraft do not run conventional operating systems like Windows or macOS. Instead, they use specialised, real-time operating systems (RTOS) designed for high reliability. These systems have minimal required functionality to reduce the risk of cyber threats. Flight Management System (FMS) run Unix-based systems with strict security controls.

With no evidence that a cyberattack has caused a plane to crash, is there really a risk?

Aviation’s cybersecurity risks mirror those faced by the maritime industry. For years, the shipping sector dismissed cybersecurity concerns, believing that ships were safe due to their specialised and closed systems. However, in the past decade, cyberattacks on vessels have surged, leading to significant financial losses.

One notable example of a cyberattack on a vessel occurred in February 2017, when hackers remotely compromised a German-owned container ship traveling from Cyprus to Djibouti. The attackers gained access to the ship’s navigation and maneuver controls, specifically targeting its steering and operational systems. The crew lost control of the vessel for several days, unable to steer it effectively, until an IT team boarded the ship to remediate the breach and restore functionality. The attack exploited vulnerabilities in the ship’s interconnected systems. While the exact motive – whether ransom, disruption or espionage – remains unclear, this case demonstrated the potential for cyberattacks to physically disrupt maritime operations, turning a vessel into a floating liability until expert intervention resolved the issue.

The aviation industry may be following a similar trajectory – until a major cyber incident occurs, many risks may continue to be overlooked.

The scarcity of public information on cyberattacks targeting aircraft stems from the highly specialised and tightly guarded nature of aviation cybersecurity. Unlike more common breaches in industries like finance or retail, plane-related incidents involve proprietary systems, classified technologies and national security implications, keeping details under wraps. Yet, this opacity doesn’t equate to safety: modern aircraft brim with digital systems, each a potential entry point for determined hackers. As aviation digitises further, the risk persists, simmering beneath the surface, obscured but far from absent.

Potential cyberattack vectors

Currently, most cyberattacks on an aircraft would require physical access, meaning an attacker would have to be on-site. However, as avionics systems become more connected, new attack vectors could emerge:

• Real-time data transmission: Aircraft continuously send operational data to ground servers, enabling airlines to monitor aircraft health 24/7. If an attacker compromises these ground servers, they could manipulate data sent to the aircraft, such as falsified pressure readings that could mislead pilots during landing.
• Autopilot manipulation: During long-haul flights, crew attention naturally declines due to fatigue. If an attacker were to inject false data – such as incorrect roll angle commands – the pilots might not notice until it’s too late.
• Fly-by-Wire: Modern airplanes rely on fly-by-wire systems, meaning pilot inputs are translated into digital signals that control the aircraft. While this improves efficiency, it also introduces potential cyber risks. If an attacker could disrupt these digital signals, it could interfere with critical control functions, potentially leading to dangerous flight conditions.

How can these threats be addressed?

Unlike computers, aircraft systems cannot be easily modified once they are in operation. Retrofitting cyber defences into existing aircraft is a challenge. However, some mitigation strategies include integrating firewalls to separate aircraft domains and prevent unauthorised access, and introducing more rigorous software testing to prevent software-related failures.

At Kaspersky, we contribute to the development of Secure-by-Design principles for next-generation aircraft, ensuring security is built into avionics from the start.

Secure-by-Design is an approach to system development where security is integrated from the very beginning, rather than being added as an afterthought. It involves designing software and hardware with built-in protections, minimising vulnerabilities and reducing the need for additional security patches. In aviation, this means ensuring that avionics and communication systems are inherently resistant to cyber threats, and at the same time protected by other safeguards like firewalls or monitoring tools.