Hackers penetrate US air traffic control systems
According to a report by the US Federal Aviation Administration (FAA), in recent years hackers have repeatedly penetrated air traffic control systems via the internet. These incidents have been sufficiently serious that the hackers have been in a position to turn off power to servers.
In early 2009, hackers penetrated a web server, from where they were able to work their way further into FAA systems and were able to gain access to the personal details of 48,000 current and former FAA employees. In other cases, intruders were able to obtain an administrator password and use it to install their own applications on West coast air traffic domain controllers. In 2006, a virus even forced the FAA to shut down a portion of its air traffic control systems in Alaska.
Most intrusions merely caused problems operating local administrative networks; internal connections mean that such attacks could, however, quickly spread to air traffic control systems. This would endanger real time monitoring of airspace, communications and the dissemination of flight information.
One of the reasons for the many vulnerabilities is the introduction of commercial software and the switch to IP-based networks as part of efforts to modernise air traffic control. Compared to using (previous) proprietary programs, the risk from off-the-shelf applications is increased. According to the report, inadequately secured web applications in particular are currently a major problem.
The report concludes that it is no longer a question of whether an attack with disastrous consequences will occur, but of when. Rapid security measures are therefore required, with intrusion detection systems already having been installed in some areas.