Critical Infrastructure Security
,
Governance & Risk Management
,
Operational Technology (OT)
Airport Baggage Carousels Are Weapons, in the Right Hands
Consider the airport baggage carousel. It’s big, clunky and tedious to wait by. But look at it like a war planner does, and it’s suddenly very different: An almost certainly poorly secured technology system that foreign adversaries could exploit to disrupt military mobilization across the United States.
See Also: From Ancient Myths to Modern Threats: Securing the Transition from Legacy to Leading Edge
That’s no exaggeration. In the event of a war with China, the U.S. military would rely on civilian infrastructure like airports, railways and ports to move American troops across the country.
Faced with an imminent military conflict, those transportation hubs would convert into high-profile targets for Chinese cyberattacks, as U.S. intelligence agencies warned in 2024. Suddenly, the set of interconnected IT and OT systems underlying those nodes would face a digital onslaught – systems including security scanning equipment, reservation systems, luggage ticket scanners and conveyors, access control technology and runway lighting systems.
The cascading effects on national aviation of an attack on a luggage handling system were demonstrated last year, by a largely unsuccessful ransomware attack at Seattle-Tacoma International Airport. The hackers’ malware, and “responsive actions” from the network’s security team, impacted services like baggage label printing and reading, shared check-in and ticketing, public WiFi, airport information display boards and the airport website.
Thousands of passengers were separated from their luggage, which had to be labeled and sorted by hand. The effects weren’t just an inconvenience to Seattle-Tacoma passengers. In America’s dominant hub-and-spoke model of aviation, delays at one airport sweep across the nation. More than 170 flights were delayed following the incident, local TV station FOX 13 reported. The delays rippled across the Northwest – and would have been far worse had the attack been a strategic strike against an airport servicing a cluster of military bases such as San Diego International Airport or America’s two largest hub airports in Atlanta and Chicago.
Major airports have dedicated cybersecurity teams, and still are vulnerable, said retired Air Force Lt. Gen. Mary O’Brien, a former deputy chief of staff for intelligence, surveillance and reconnaissance operations and cyber effects.
“They are operating on very tight budgets,” she said. “The infrastructure is outdated. They have technical debt, software that they’re afraid to patch.” Security programs that they could afford are “probably going to be lower priced, probably inadequate.”
But smaller airports, which might lack a full-time cybersecurity staff were even more vulnerable, she said. “They are tragically easy targets.”
“For moving the numbers [of troops] that we’ll need to fight a major war, we’re going to use our commercial rail, port and aviation systems 90% of the time,” said retired Rear Adm. Mark Montgomery, during an industry conference in Columbia, MD, earlier this year. Montgomery was executive director of the congressionally chartered Cyberspace Solarium Commission and now leads CSC 2.0, a nonprofit that tracks the implementation of its recommendations.
Two dozen commercial carriers are enrolled in the U.S. Air Force’s Civil Reserve Air Fleet which, in time of war, would mobilize hundreds of civilian airliners and cargo craft to fly troops and materiel both domestically and internationally. And even military transports would use civilian airports, he said.
That reliance makes the civil aviation system a soft underbelly for the U.S. military, he warned, citing a recent report from CSC 2.0, which examined the vulnerabilities in civilian infrastructure used by the U.S. military, like the aviation system.
“U.S. adversaries know that compromising this critical infrastructure through cyber and physical attacks would impede America’s ability to deploy, supply and sustain large forces” in a war overseas, the report reads.
For cybersecurity practitioners seeking to defend airport networks, the most worrying issue is that they often don’t have visibility into OT deployments.
Eric Bowerman, assistant vice president for cybersecurity at Dallas Fort Worth International Airport, joked that he sometimes discovers new OT systems by spotting them after they’ve been installed. “Whenever I walk through the terminals, there’s always a new blinking light somewhere that I have to worry about securing,” he said.
In a presentation at the Defend the Airport conference in Maryland earlier this year, white hat hackers who asked for anonymity used a mockup of a small airport IT network to show how cyber saboteurs could access and shut down OT baggage handling systems.
Reflexive assertions that OT systems are kept apart from IT systems aren’t heard as often as they once were. For most OT control systems, “There is no air gap,” said cybersecurity consultant Fred Gordy, who used to work as a systems integrator for airport authorities. What begins as a tightly air-gapped system over time easily loses its isolation, whether because of carelessness and staff turnover or merged networks and sheer inertia.
Runway lighting systems are another risk case for nation-state hacking, Gordy said. Using free specialized search engines and open-source documentation, he showed how to reach control dashboards for runway lighting systems at multiple airports.
While navigational technologies like GPS can find an airport, and even a runway, in the dark, pilots still rely on runway lighting systems to visually confirm GPS data and navigate their landing, especially in high winds or conditions of limited visibility.
“You can see where this might be a risk,” Gordy said, “where bad actors just start turning off these lights on a heavy weather night.”
Buttressing OT security in America’s commercial airports could take years, but many experts fear the nation doesn’t have that much time to act.
The prospect of a Chinese mainland invasion of Taiwan has gone from niche worry to mainstream concern, particularly after Beijing appeared to order its military to be ready to launch an island landing by 2027. The actual prospect of war breaking out that year may easily be exaggeration and hype, but few in Washington think the threat of Chinese hacking isn’t real.
So long as China refuses to renounce using force against Taiwan, its threat actors will almost certainly be looking for ways to slow down the U.S. response, one creaky baggage carousel at a time.