“Used Default IDs and Passwords”
Chris Robert, the researcher told FBI that he exploited in flight entertainment system and then overwrote code on airplane’s Thrust Management Computer while in flight. Robert said he used Kali Linux to perform penetration testing of the IFE system. He used the default IDs and passwords to compromise the IFE systems,
…connected to other systems on the airplane network after he exploited/gained access to, or “hacked” the [in-flight entertainment] system. He stated that he then overwrote code on the airplane’s Thrust Management Computer while aboard a flight. He stated that he successfully commanded the system he had accessed to issue the climb command. He stated that he thereby caused one of the airplane engines to climb resulting in a lateral or sideways movement of the plane during one of these flights. He also stated that he used Vortex software after compromising/exploiting or “hacking” the airplane’s networks. He used the software to monitor traffic from the cockpit system.
He stated that he thereby caused one of the airplane engines to climb resulting in a lateral or sideways movement of the plane during one of these flights,” FBI Special Agent Mark Hurley wrote in his warrant application (.pdf). “He also stated that he used Vortex software after comprising/exploiting or ‘hacking’ the airplane’s networks. He used the software to monitor traffic from the cockpit system.
Robert had this to say
It would appear from what I’ve seen that the federal guys took one paragraph out of a lot of discussions and a lot of meetings and notes and just chose that one as opposed to plenty of others,” he said, declining to elaborate further
There's really not much any of you can do to convince me that sending low level commands to an engine in flight is anywhere near safe.
— Wesley McGrew (@McGrewSecurity) May 16, 2015
Either he lied about fucking with live planes or actually fucked with live planes. Both are unacceptable for an infosec professional.
— Nick DePetrillo (@nickdepetrillo) May 16, 2015
Published document with more details.
