Aviation Cybersecurity Risks: Ground Threats and Airborne Vulnerabilities

Post Views: 9

Aviation cyber risk is rooted in ground systems while aircraft remain unmonitored, according to an expert analysis.

Ground vs. Aircraft Risks

Eliran Almong, CEO of Cyviation, outlined how vulnerabilities in aviation infrastructure lead to financial losses and operational blind spots. He highlighted GPS signal interference that evades traditional security monitoring, a critical flaw in drone control software, and the need for systemic changes in data integrity verification. The discussion focused on the distinction between risks on the ground and those affecting aircraft. Almong emphasized that while cinematic scenarios of in-flight hacking dominate public perception, the real threats stem from unsecured data flows between ground systems and aircraft.

GPS Signal Interference

These include navigation databases, performance metrics, and software updates transmitted to flight management systems. The aircraft itself functions as an endpoint in a supply chain lacking visibility, making ground infrastructure the primary financial risk vector. A key concern identified is the inability of standard security tools to detect GPS spoofing or jamming. Unlike typical cyber threats, these attacks leave no digital footprint in security information and event management (SIEM) systems. Reports of inaccurate position data and degraded inertial navigation systems have been documented in regions including the Eastern Mediterranean, Black Sea, and Persian Gulf. Operators only become aware of such incidents through pilot reports, highlighting a critical gap in threat detection.

Drone Control Vulnerabilities

Another significant finding involves vulnerabilities in drone control systems. Research disclosed a flaw in PX4 Autopilot, a widely used flight-control platform, where command channels accept unsigned messages by default. This allows attackers on the same network to manipulate drone operations without requiring complex exploit chains. The vulnerability, designated CVE-2026-1579, received a high severity rating from CISA and underscores the risks of legacy systems designed without modern authentication protocols.

Electronic Flight Bag (EFB)

The conversation also addressed the Electronic Flight Bag (EFB), a device used for storing and accessing critical flight data. While often viewed as a security risk due to its connectivity and potential for personal use, Almong argued that the EFB is a symptom rather than the root issue. The true exposure lies in the data loading chain that supplies software updates and operational content to aircraft. Ensuring the integrity of this process requires robust verification mechanisms, which many operators lack.

Digital Twins and AV-ATT CK

To address these challenges, Almong advocated for the adoption of digital twins—virtual replicas of aircraft systems that enable testing of software updates and threat scenarios without compromising airworthiness. This approach aligns with the AV-ATT CK framework, an aviation-specific extension of MITRE ATT&CK, which maps threats such as GPS spoofing and Traffic Collision Avoidance System (TCAS) manipulation. By simulating attacks on digital twins, organizations can identify vulnerabilities in ground-to-air data flows and improve detection capabilities.

Prioritized Security Strategy

For smaller carriers with limited resources, Almong outlined a prioritized security strategy. This includes establishing a comprehensive inventory of software and dependencies, implementing multi-factor authentication across all systems, and securing administrative access points. Backup systems must be tested regularly to ensure recoverability. For aircraft visibility, he recommended leveraging third-party solutions rather than attempting in-house development, given the scarcity of specialized expertise.

Data Sharing Challenges

The discussion also touched on the challenges of balancing data sharing between airlines and manufacturers. Operators often restrict access to operational data to protect commercial interests, creating friction with OEMs and lessors. Almong emphasized the importance of maintaining data ownership and using isolated infrastructure to prevent cross-customer data exposure. Security telemetry and operational data should remain separate to avoid unnecessary collection and reduce risk.

Incident Response Planning

Finally, he stressed the importance of incident response planning, particularly for organizations with limited security staff. A well-defined protocol can mitigate the impact of breaches, distinguishing between manageable incidents and potential disasters. The focus should remain on practical, actionable measures rather than pursuing generic frameworks or overly complex threat intelligence programs.

“The aircraft itself functions as an endpoint in a supply chain lacking visibility, making ground infrastructure the primary financial risk vector.”