Boeing supplier hackers bag € 50 million and expose flight risk vulnerabilities

FACC employee working on a Boeing 787 part Photo: FACC

Austrian aeronautics giant announced on its website that it was the victim of a cyber fraud to the value of €50 million. FACC is a tier-1 supplier to Boeing and are responsible for the manufacture of some parts for the 787 Dreamliner. Despite moving to assure investors that their IT infrastructure, IP rights as well as the operational business of the group were not affected by the criminal activities, their share prices declined significantly since the attack took place on 19 January 2016.

This is not the first cyber-attack on the airline industry. Security researcher, Chris Roberts claims that on a number of occasions and while on a flight, he was able to bypass the firewalls of the plane on board network using his laptop. Roberts claims that he reported that airline manufacturers, and their partners who manufacture their hardware and software parts, have failed to fix certain vulnerabilities on their products. These claims were reported on extensively in the media.

The 2015 Data Breach Investigations provide some interesting cybercrime statistics:

• There were over 79 000 reported security incidents last year in 61 countries reported on
• Of these security incidents, only 2122 resulted in a confirmed data breach
• The bulk of the security incidents take place in the Public Sector followed by Financial Services and then Information.

In 70% of attacks where the motive is known, there is a secondary victim who is the real target. The attackers have no real interest in the victim, save to get access to their true target.

The various components of the plane are manufactured by different suppliers and are connected to the on board computer network. If a hacker were to find the vulnerability on the programming of any component, either through hacking or through acquiring the software coding of that particular component, then through simple coding the component could receive instructions from the hacker. An example of this is a hacker could give the wings of the plane coded instructions to open or close midflight if he could gain access. Alternatively if the hacker’s true target was the onboard network of the plane, he could easily gain access once he is able to hack the component. This is the real danger of the Internet of Things.

FACC management have advised that they have taken immediate structural measures to mitigate the damage caused by the cyber-attack and are evaluating damages and structural claims and a forensic investigation is underway.