Note (October 2026): The original article said a hacker could hijack any plane with a mobile app. Teso’s 2013 demonstration ran only against a PC-based training simulator, and the FAA and EASA both said the technique does not work on certified flight hardware; the text below has been corrected.
No verified case shows a mobile app hijacking a real airliner. In April 2013, security researcher Hugo Teso demonstrated an Android app called PlaneSploit at the Hack in the Box conference in Amsterdam. It altered the course of virtual planes on a PC-based training simulator. The FAA and EASA said the technique does not work on certified flight hardware.
Key Takeaways
- Hugo Teso, a security consultant at the German firm n.runs and a trained commercial pilot, presented PlaneSploit at Hack in the Box Amsterdam in April 2013.
- The demo targeted a PC-based training version of a flight management system (FMS), not a real aircraft in flight.
- The FAA said the technique cannot engage or control the autopilot through the FMS or stop a pilot from overriding the autopilot.
- The weaknesses Teso pointed to are real: ADS-B and ACARS messages are not encrypted or authenticated by design.
- Aviation cybersecurity rules have tightened since; the EU’s Part-IS information security rules became fully applicable on 22 February 2026.
At the security conference “Hack in the box” held in Amsterdam in April 2013, a security researcher demonstrated live how an attacker could take over the flight management system of a simulated plane using a mobile app and other software tools.
Hugo Teso, a security consultant at the German firm n.runs who is also a trained commercial pilot, showed how an attacker with a mobile device could reach the flight management level of a virtual plane in his lab setup, as reported by Computerworld on April 10, 2013.
Teso’s talk focused on two aviation data systems. Automatic Dependent Surveillance-Broadcast (ADS-B) is the surveillance technology aircraft use to broadcast their position for tracking. Aircraft Communications Addressing and Reporting System (ACARS) carries short text messages between aircraft and ground stations over radio or satellite. Neither system encrypts or authenticates its messages by design, which is the weakness Teso set out to exploit.
According to Teso, an attacker with flight management system hardware containing real flight code, plus a radio transmitter, could study how aircraft software responds to malicious messages.
Teso explained that he bought flight management hardware sold for training on eBay, including a Rockwell-made unit, and used ACARS messages to break into the onboard computer of a virtual aircraft. The flight management system feeds navigation data to the autopilot, so in his simulation he could upload new flight data and send the virtual plane on a different track.
Teso also developed an Android app called “PlaneSploit” which he ran on a Samsung Galaxy smartphone. In the demonstration it changed the heading, altitude and speed of virtual planes; Teso argued real aircraft could be affected the same way, a claim aviation regulators rejected. The app came out of about three years of aviation security research by Teso, including a long analysis of the plane’s navigation software using flight code sold for training purposes.
According to the Computerworld report, Teso claimed he could remotely take full control of an aircraft and even set one plane on a collision course with another. Within days, the FAA and EASA rejected that claim, saying the technique does not work on certified flight hardware.
What Did Hugo Teso Actually Demonstrate?
Hugo Teso demonstrated a remote attack on a virtual aircraft, not a real one. CSO Online reported on April 14, 2013 that he ran PlaneSploit against a PC running training software for a commercial jet navigation system, using a smartphone app and an antenna.
Teso built an exploit framework he called SIMON, and PlaneSploit was the Android app that delivered its attack messages. Help Net Security, quoted by NPR, said the app used the Flightradar24 live flight tracker to let the user tap on any aircraft in range. Teso himself called PlaneSploit a proof-of-concept used in a virtual environment.
Teso said hacking a real jet in flight would be too dangerous and unethical, which is why he used a lab. He also showed how false data could be sent to cockpit displays and how some cabin systems, such as passenger oxygen masks, could be triggered in the simulation.
Timeline of the PlaneSploit Story
| Date | Event |
|---|---|
| April 10, 2013 | Teso presents at Hack in the Box Amsterdam; Computerworld reports the talk. |
| April 11-12 | NPR and others cover the claim; the FAA, EASA and Honeywell dispute it. |
| April 14 | CSO Online reports the FAA statement that the app works only on a simulator. |
| April 15 | Aviation Today reports the FAA named the targeted system as the Honeywell NZ-2000 FMS. |
What Did the FAA and EASA Say?
The US Federal Aviation Administration said Teso’s technique does not pose a flight safety concern because it does not work on certified flight hardware. The FAA added that the technique cannot engage or control the aircraft’s autopilot through the FMS or prevent a pilot from overriding the autopilot, so a hacker cannot obtain full control of an aircraft as claimed.
The European Union Aviation Safety Agency (EASA) gave a similar assessment. EASA said there are major differences between PC-based training FMS software and embedded FMS software, and that the simulation software lacks the overwriting protection and redundancies built into certified flight software. Honeywell, which makes the cockpit software, also disputed the claims.
ADS-B and ACARS: Why Researchers Worry About Them
ADS-B and ACARS are real aviation systems with known security limits, even though the PlaneSploit hijack claim did not hold up on certified aircraft.
| System | What it does | Known security limit |
|---|---|---|
| ADS-B (Automatic Dependent Surveillance-Broadcast) | Aircraft work out their position by satellite navigation and broadcast it regularly to air traffic control and other aircraft. | Messages are not encrypted or authenticated, so anyone can read them and fake messages can be broadcast. |
| ACARS (Aircraft Communications Addressing and Reporting System) | Sends short digital messages between aircraft and ground stations over airband radio or satellite; designed by ARINC and deployed in 1978. | Computerworld’s 2013 report described it as having no built-in security. |
ADS-B is now widespread. The United States has required many aircraft, including all commercial passenger carriers, to carry ADS-B equipment since January 2020, and the equipment has been mandatory for some aircraft in Europe since 2017. Because ADS-B lacks authentication, air traffic systems validate its data against other sources such as primary radar and multilateration, which compares signal timing to check that an aircraft is where it says it is.
How Has Aviation Cybersecurity Changed Since PlaneSploit?
Regulators have moved from answering single demos to building formal cybersecurity rules. In April 2015, the US Government Accountability Office (GAO) report GAO-15-370 warned that internet-connected aircraft could face unauthorized remote access to avionics and recommended that the FAA develop a cybersecurity threat model; GAO lists all three of its recommendations as implemented.
In Europe, EASA’s Part-IS information security rules now require aviation organizations to run an information security management system. Delegated Regulation (EU) 2022/1645 became applicable in October 2025, and Implementing Regulation (EU) 2023/203 became applicable on 22 February 2026, covering air operators, maintenance organizations, air navigation service providers, training organizations and others.
What Does This Mean for Passengers?
- No public evidence of a phone-based airliner hijack: the best-known claim, PlaneSploit, worked only in a simulator according to the FAA and EASA.
- Pilots stay in control: the FAA said the 2013 technique could not stop a pilot from overriding the autopilot.
- Weak links are real but known: unencrypted data systems such as ADS-B are cross-checked against other surveillance sources.
- Security research helps: demonstrations like Teso’s push regulators and manufacturers to test certified systems more closely. Readers interested in how such testing works can see this guide to ethical hacking and penetration testing.
For broader context on aircraft and the industry, see the overview of different types of airplanes and the changes expected in the aviation sector this decade. For everyday digital safety, read how much the average person needs to know about cyber security, and for fiction on the theme, browse these hacking movies.
Frequently Asked Questions
Can a smartphone app hijack a commercial plane?
No verified case shows a smartphone app hijacking a commercial plane. Hugo Teso’s PlaneSploit app worked against a PC-based training simulator in 2013, and the FAA said the technique does not work on certified flight hardware.
What is PlaneSploit?
PlaneSploit is an Android proof-of-concept app built by security researcher Hugo Teso. It delivered attack messages from his SIMON exploit framework to virtual aircraft and was shown at Hack in the Box Amsterdam in April 2013.
Who is Hugo Teso?
Hugo Teso was described in 2013 coverage as a security consultant at the German firm n.runs and a pilot certified to fly commercial aircraft, who had spent about three years researching aviation security.
Is ADS-B encrypted?
No. ADS-B messages are neither encrypted nor authenticated, so anyone with a receiver can read them. Air traffic systems therefore validate ADS-B data against other sources such as primary radar and multilateration.
Did the FAA respond to the hijacking claim?
Yes. In April 2013 the FAA said the technique does not pose a flight safety concern because it does not work on certified flight hardware, and that it cannot engage or control the autopilot through the FMS.
Justwebworld has published guides since 2012. How we write and update articles Report an error
