The Department of Homeland Security (DHS) has issued a warning about vulnerabilities on an aircraft’s CAN bus, that could allow the aircraft to be hacked.

The CAN (Controller Area Network) bus is a serial communications protocol. It allows different systems to talk to each other using a standardised protocol. It is commonly used in smaller aircraft, including business jets. It is also used on the Airbus A380 to transmit data from the overhead cockpit panel.

But a new report by Rapid7, an online cybersecurity firm, found that someone having physical access to the aircraft could attach a small device that would give false flight data to the pilots flying the aircraft.

Rapid7 says that this could include altitude and airspeed reading, as well as possible access to the aircraft’s autopilot.

According to Rapid7, the CAN bus nodes do not enforce trust models and authentication schemes from other networking applications, and data sent through the CAN bus does not have any cryptographic protections.

Because of this, Rapidy7 says: “… any device placed onto a CAN bus that manipulates the voltages of the High and Low wires can send any message using any arbitration ID and expect it to be acted upon by the device on the bus expecting a message from that particular arbitration ID.”

Which in layman’s terms means that an external device attached to the aircraft can send data to flight systems, and that the CAN bus has no in-built protection to stop that happening.

Although an attack on an aircraft could have catastrophic consequences, Rapid7 is keen to point out that physical access to aircraft is highly regulated and controlled. “While we believe that relying wholly on physical access controls is unwise, such controls do make it much more difficult for an attacker to access the CAN bus and take control of the avionics systems,” says the report.