We’ve heard a lot about airplane hacking and what might be possible, but on Sunday Polish airline LOT canceled 10 flights “due to IT systems failure” which was allegedly caused by hackers attacking the airline ground computer systems.
About 1,400 passengers were grounded at Warsaw Chopin Airport after the attack on the ground computer systems which are used to issue flight plans. According to KONTAKT24, LOT said it was “the first such attack in history.” The airline was “paralyzed” for five hours and canceled 10 flights bound for Hamburg, Copenhagen, Munich, Stockholm, Brussels and other domestic and international destinations. Another dozen flights were delayed.
Chopin Airport “LOT encountered (an) IT attack that affected our ground operation systems,” read LOT’s second press release. “As a result, we’re not able to create flight plans and outbound flights from Warsaw are not able to depart. We’d like to underline that it has no influence on plane systems. Aircrafts that are already airborne will continue their flights. Planes with flight plans already filed will return to Warsaw normally.”
TVN24 reported that the Polish Government Center for Security informed the airline about the “attack” on LOT systems. “We're using state-of-the-art computer systems, so this could potentially be a threat to others in the industry,” LOT spokesman Adrian Kubicki told Reuters. He added that the computer system was hacked in the afternoon and fixed about five hours later.
Chopin Airport The third LOT press release read, “The situation after the IT attack on our ground operation system is already under control. We are working on restoring the regularity as soon as possible. Our operating center is already preparing flight plans. We will try to ensure that the largest number of passengers are informed and continue commenced journeys.”
When security researcher Chris Roberts heard the news, he tweeted:
Chris Roberts Back in April, after Roberts tweeted about possibly probing United Airlines aircraft systems, the FBI was waiting on him when his plane landed; the feds seized his electronics and interviewed him. Later the FBI allegedly said Roberts hacked in-flight systems 15 to 20 times over a three year period.
But some security professionals doubt LOT was the victim of a cyberattack at all as LOT allegedly said “an unauthorized person had access to their network.” If that were true, could it be a case of poor internal security controls which allowed a person to play around with LOT’s ground operation system?
LOT’s Kubicki said the attack on the airline’s ground operation systems is being investigated by the authorities. It will be interesting to find out what actually happened, whether it was a curious person poking around, an attacker remotely hacking the airline’s system, or a different scenario. Unless Poland is trying to pass some new surveillance law, as a government entity allegedly informed the airline about the attack, then it seems unlikely an airline would take such a hit to its brand after claiming it was hacked.
In the last few months there was the airplane hacking news involving security researcher Chris Roberts, American Airlines delayed flights after an app crashed pilots’ iPads, and an A400M military plane crashed after vital engine software files were accidentally wiped. Sadly, if it hasn’t already happened then it seems like the scary day is approaching when airplane hacking will stop being an “it could happen” scenario and become an “it did happen” scenario. Yikes!