Remote control airliners - hacking via smartphone or AWACS

[Alan_Firminger]

Researcher hacks aircraft controls with Android smartphone
http://www.theregister.co.uk/2013/04/11/hacking_aircraft_with_android_ handset/

This may give the TSA some ideas

By Iain Thomson in San Francisco • Get more from this author

Posted in Security, 11th April 2013 01:12 GMT

A presentation at the Hack In The Box security summit in Amsterdam has demonstrated that it's possible to take control of aircraft flight systems and communications using an Android smartphone and some specialized attack code.

Hugo Teso, a security researcher at N.Runs and a commercial airline pilot, spent three years developing the code, buying second-hand commercial flight system software and hardware online and finding vulnerabilities within it. His presentation will cause a few sleepless nights among those with an interest in aircraft security.

Teso's attack code, dubbed SIMON, along with an Android app called PlaneSploit, can take full control of flight systems and the pilot's displays. The hacked aircraft could even be controlled using a smartphone's accelerometer to vary its course and speed by moving the handset about.

"You can use this system to modify approximately everything related to the navigation of the plane," Teso told Forbes. "That includes a lot of nasty things."

First, Teso looked at the Automatic Dependent Surveillance-Broadcast (ADS-B) system that updates ground controllers on an aircraft's position over a 1Mb/s data link. This has no security at all, he found, and could be used to passively eavesdrop on an aircraft's communications and also actively interrupt broadcasts or feed in misinformation.

Also vulnerable is the Aircraft Communications Addressing and Reporting System (ACARS), the communication relay used between pilots and ground controllers. Using a Samsung Galaxy handset, he demonstrated how to use ACARS to redirect an aircraft's navigation systems to different map coordinates.

"ACARS has no security at all. The airplane has no means to know if the messages it receives are valid or not," he said. "So they accept them and you can use them to upload data to the airplane that triggers these vulnerabilities. And then it's game over."

[scienceplease 2]

No details on the aircraft types but at a guess, it would include Boeing 757s and 767s....

[Alan_Firminger]

The original report is here .

[TonyGosling]

Vulnerabilities in aircraft systems allow remote airplane hijacking, researcher says
Communication technologies like ADS-B and ACARS can be abused to remotely exploit vulnerabilities in aircraft systems, a researcher said

By Lucian Constantin
April 11, 2013 04:04 AM ET
http://www.computerworld.com/s/article/9238320/Vulnerabilities_in_airc raft_systems_allow_remote_airplane_hijacking_researcher_says

IDG News Service - The lack of security in communication technologies used in the aviation industry makes it possible to remotely exploit vulnerabilities in critical on-board systems and attack aircraft in flight, according to research presented Wednesday at the Hack in the Box security conference in Amsterdam.

The presentation, by Hugo Teso, a security consultant at consultancy firm N.runs in Germany, who has also had a commercial pilot license for the past 12 years, was the result of the researcher's three-yearlong research into the security of avionics.

Teso showed how the absence of security features in ADS-B (automatic dependent surveillance-broadcast), a technology used for aircraft tracking, and ACARS (Aircraft Communications Addressing and Reporting System), a datalink system used to transmit messages between aircraft and ground stations via radio or satellite, can be abused to exploit vulnerabilities in flight management systems.

He did not experiment on real airplanes, which would be both dangerous and illegal, according to his own account. Instead Teso acquired aircraft hardware and software from different places, including from vendors offering simulation tools that use actual aircraft code and from eBay, where he found a flight management system (FMS) manufactured by Honeywell and a Teledyne ACARS aircraft management unit.

Using these tools, he set up a lab where he simulated virtual airplanes and a station for sending specifically crafted ACARS messages to them in order to exploit vulnerabilities identified in their flight management systems -- specialized computers that automate in-flight tasks related to navigation, flight planning, trajectory prediction, guidance and more.

The FMS is directly connected to other critical systems like navigation receivers, flight controls, engine and fuel systems, aircraft displays, surveillance systems and others, so by compromising it, an attacker could theoretically start attacking additional systems. However, this aspect was beyond the scope of this particular research, Teso said.

Identifying potential targets and gathering basic information about them via ADS-B is fairly easy because there are many places online that collect and share ADS-B data, such as flightradar24.com, which also has mobile apps for flight tracking, Teso said.

ACARS can be used to gather even more information about each potential target, and by combining this information with other open-source data, it is possible to determine with a fairly high degree of certainty what model of FMS a specific aircraft is using, Teso said.

After this is done, an attacker could send specifically crafted ACARS messages to the targeted aircraft to exploit vulnerabilities identified in the code of its FMS. In order to do this, the attacker could build his own software-defined radio system, which would have a range limit depending on the antenna being used, or he could hack into the systems of one of the two main ground service providers and use them to send ACARS messages, a task that would probably be more difficult, Teso said.

[TonyGosling]

Feds Say That Banned Researcher Commandeered a Plane
http://www.wired.com/2015/05/feds-say-banned-researcher-commandeered-p lane/

A security researcher kicked off a United Airlines flight last month after tweeting about security vulnerabilities in its system had previously taken control of an airplane and caused it to briefly fly sideways, according to an application for a search warrant filed by an FBI agent.
Chris Roberts, a security researcher with One World Labs, told the FBI agent during an interview in February that he had hacked the in-flight entertainment system, or IFE, on an airplane and overwrote code on the plane’s Thrust Management Computer while aboard the flight. He was able to issue a climb command and make the plane briefly change course, the document states.
“He stated that he thereby caused one of the airplane engines to climb resulting in a lateral or sideways movement of the plane during one of these flights,” FBI Special Agent Mark Hurley wrote in his warrant application (.pdf). “He also stated that he used Vortex software after comprising/exploiting or ‘hacking’ the airplane’s networks. He used the software to monitor traffic from the cockpit system.”
Hurley filed the search warrant application last month after Roberts was removed from a United Airlines flight from Chicago to Syracuse, New York, because he published a facetious tweet suggesting he might hack into the plane’s network. Upon landing in Syracuse, two FBI agents and two local police officers escorted him from the plane and interrogated him for several hours. They also seized two laptop computers and several hard drives and USB sticks. Although the agents did not have a warrant when they seized the devices, they told Roberts a warrant was pending.
A media outlet in Canada obtained the application for the warrant today and published it online.
The information outlined in the warrant application reveals a far more serious situation than Roberts has previously disclosed.
Roberts had previously told WIRED that he caused a plane to climb during a simulated test on a virtual environment he and a colleague created, but he insisted then that he had not interfered with the operation of a plane while in flight.
He told WIRED that he did access in-flight networks about 15 times during various flights but had not done anything beyond explore the networks and observe data traffic crossing them. According to the FBI affidavit, however, when he mentioned this to agents last February he told them that he also had briefly commandeered a plane during one of those flights.
He told the FBI that the period in which he accessed the in-flight networks more than a dozen times occurred between 2011 and 2014. The affidavit, however, does not indicate exactly which flight he allegedly caused to turn to fly to the side.
He obtained physical access to the networks through the Seat Electronic Box, or SEB. These are installed two to a row, on each side of the aisle under passenger seats, on certain planes. After removing the cover to the SEB by “wiggling and Squeezing the box,” Roberts told agents he attached a Cat6 ethernet cable, with a modified connector, to the box and to his laptop and then used default IDs and passwords to gain access to the inflight entertainment system. Once on that network, he was able to gain access to other systems on the planes.
Reaction in the security community to the new revelations in the affidavit have been harsh. Although Roberts hasn’t been charged yet with any crime, and there are questions about whether his actions really did cause the plane to list to the side or he simply thought they did, a number of security researchers have expressed shock that he attempted to tamper with a plane during a flight.
“I find it really hard to believe but if that is the case he deserves going to jail,” wrote Jaime Blasco, director of AlienVault Labs in a tweet.
Alex Stamos, chief information security officer of Yahoo, wrote in a tweet, “You cannot promote the (true) idea that security research benefits humanity while defending research that endangered hundreds of innocents.”
You cannot promote the (true) idea that security research benefits humanity while defending research that endangered hundreds of innocents
— Alex Stamos (@alexstamos) May 16, 2015
Roberts, reached by phone after the FBI document was made public, told WIRED that he had already seen it last month but wasn’t expecting it to go public today.
“My biggest concern is obviously with the multiple conversations that I had with the authorities,” he said. “I’m obviously concerned those were held behind closed doors and apparently they’re no longer behind closed doors.”
Although he wouldn’t respond directly to questions about whether he had hacked that previous flight mentioned in the affidavit, he said the paragraph in the FBI document discussing this is out of context.
“That paragraph that’s in there is one paragraph out of a lot of discussions, so there is context that is obviously missing which obviously I can’t say anything about,” he said. “It would appear from what I’ve seen that the federal guys took one paragraph out of a lot of discussions and a lot of meetings and notes and just chose that one as opposed to plenty of others.”
History of Researching Planes
Roberts began investigating aviation security about six years ago after he and a research colleague got hold of publicly available flight manuals and wiring diagrams for various planes. The documents showed how inflight entertainment systems on some planes were connected to the passenger satellite phone network, which included functions for operating some cabin control systems. These systems were in turn connected to the plane avionics systems. They built a test lab using demo software obtained from infotainment vendors and others in order to explore what they could to the networks.
In 2010, Roberts gave a presentation about hacking planes and cars at the BSides security conference in Las Vegas. Another presentation followed two years later. He also spoke directly to airplane manufacturers about the problems with their systems. “We had conversations with two main airplane builders as well as with two of the top providers of infotainment systems and it never went anywhere,” he told WIRED last month.
Last February, the FBI in Denver, where Roberts is based, requested a meeting. They discussed his research for an hour, and returned a couple weeks later for a discussion that lasted several more hours. They wanted to know what was possible and what exactly he and his colleague had done. Roberts disclosed that he and his colleague had sniffed the data traffic on more than a dozen flights after connecting their laptops to the infotainment networks.
“We researched further than that,” he told WIRED last month. “We were within the fuel balancing system and the thrust control system. We watched the packets and data going across the network to see where it was going.”
Eventually, Roberts and his research partner determined that it would take a convoluted set of hacks to seriously subvert an avionics system, but they believed it could be done. He insisted to WIRED last month, however, that they did not “mess around with that except on simulation systems.” In simulations, for example, Roberts said they were able to turn the engine controls from cruise to climb, “which definitely had the desired effect on the system—the plane sped up and the nose of the airplane went up.”
Today he would not respond to questions about the new allegations from the FBI that he also messed with the systems during a real flight.
The Tweet Heard Round the World
Roberts never heard from the FBI again after that February visit. His recent troubles began after he sent out a Tweet on April 15 while aboard a United Airlines flight from Denver to Chicago. After news broke about a report from the Government Accountability Office revealing that passenger Wi-Fi networks on some Boeing and Airbus planes could allow an attacker to gain access to avionics systems and commandeer a flight, Roberts published a Tweet that said, “Find myself on a 737/800, lets see Box-IFE-ICE-SATCOM,? Shall we start playing with EICAS messages? ‘PASS OXYGEN ON’ Anyone?” He punctuated the tweet with a smiley face.
Find myself on a 737/800, lets see Box-IFE-ICE-SATCOM, ? Shall we start playing with EICAS messages? "PASS OXYGEN ON" Anyone ?
— Chris Roberts (@Sidragon1) April 15, 2015
The tweet was meant as a sarcastic joke; a reference to how he had tried for years to get Boeing and Airbus to heed warnings about security issues with their passenger communications systems. His tweet about the Engine Indicator Crew Alert System, or EICAS, was a reference to research he’d done years ago on vulnerabilities in inflight infotainment networks, vulnerabilities that could allow an attacker to access cabin controls and deploy a plane’s oxygen masks.
In response to his tweet, someone else tweeted to him “…aaaaaand you’re in jail. :)”
Roberts responded with, “There IS a distinct possibility that the course of action laid out above would land me in an orange suite [sic] rather quickly :)”
When an employee with United Airlines’ Cyber Security Intelligence Department became aware of the tweet, he contacted the FBI and told agents that Roberts would be on a second flight going from Chicago to Syracuse. Although the particular plane Roberts was on at the time the agents seized him in New York was not equipped with an inflight entertainment system like the kind he had previously told the FBI he had hacked, the plane he had flown earlier from Denver to Chicago did have the same system.
When an FBI agent later examined that Denver-to-Chicago plane after it landed in another city the same day, he found that the SEBs under the seats where Roberts had been sitting “showed signs of tampering,” according to the affidavit. Roberts had been sitting in seat 3A and the SEB under 2A, the seat in front of him, “was damaged.”
“The outer cover of the box was open approximately 1/2 inch and one of the retaining screws was not seated and was exposed,” FBI Special Agent Hurley wrote in his affidavit.
During the interrogation in Syracuse, Roberts told the agents that he had not compromised the network on the United flight from Denver to Chicago. He advised them, however, that he was carrying thumb drives containing malware to compromise networks—malware that he told them was “nasty.” Also on his laptop were schematics for the wiring systems of a number of airplane models. All of this would be standard, however, for a security researcher who conducts penetration-testing and research for a living.
Nonetheless, based on all of the information that agents had gleaned from their previous interview with Roberts in February as well as the Tweets he’d sent out that day and the apparent signs of tampering on the United flight, the FBI believed that Roberts “had the ability and the willingness to use the equipment then with him to access or attempt to access the IFE and possibly the flight control systems on any aircraft equipped with an IFE systems, and that it would endanger public safety to allow him to leave the Syracuse airport that evening with that equipment.”
When asked by WIRED if he ever connected his laptop to the SEB on his flight from Denver to Chicago, Roberts said, “Nope I did not. That I’m happy to say and I’ll stand from the top of the tallest tower and yell that one.”
He also questions the FBI’s assessment that the boxes showed signs of tampering.
“Those boxes are underneath the seats. How many people shove luggage and all sorts of things under there?,” he said. “I’d be interested if they looked at the boxes under all the other seats and if they looked like they had been tampered. How many of them are broken and cracked or have scuff marks? How many of those do the airlines replace because people shove things under there?”
Regardless of whether the authorities have a case against him, however, there has already been some fallout from the incident. Roberts told WIRED that today investors on the board of directors of One World Labs, a company he helped found, decided to withdraw their investments in the company. As a result, One World Labs had to lay off about a dozen employees today, half of its staff.
Roberts said there were other factors contributing to the board’s decision but his legal situation “was probably the final straw.”
“The board has deemed it a risk. So that was one factor in many that made their decision,” he said. “Their decision was not to fund the organization any further.”

[TonyGosling]

How To Hack An Aircraft
Kate O'Flaherty
I’m a freelance cyber security journalist.
https://www.forbes.com/sites/kateoflahertyuk/2018/08/22/how-to-hack-an -aircraft/

Weak systems and software complexity put aircraft systems at increasing risk of attack.
SYNOPSYS - Hacking an aircraft is easier than you might think. Last year, a Department of Homeland Security (DHS) official admitted that he and his team of experts remotely hacked into a Boeing 757.

In 2016, there were more than 50 reports of GPS interference at Manila International Airport - which can lead to “missed approaches” forcing flight crews to re-approach the runway using backup navigation systems.

The results of an attack on a plane can be catastrophic. After the 2008 crash of Spanair flight 5022, it was discovered that a central computer system used to monitor technical problems in the aircraft was infected with malware. An internal report by the airline revealed the infected computer failed to find three technical problems with the aircraft which, if detected, might have stopped the plane from taking off in the first place.

The ability to breach an aircraft system has already been demonstrated. Security researcher Ruben Santamarta has shown how attacks such as bypassing the credit card check and SQL injection can be conducted on an in-flight entertainment system. Such assaults can even be perpetrated from the ground, he says.

Meanwhile, US regulator the Federal Aviation Administration(FAA) has warned that some computer systems on the Boeing 747-8 and 747-8F may be vulnerable to outside attacks due to the nature of their connectivity.

YOU MAY ALSO LIKE
In addition, weak encryption systems in aircraft communications addressing and reporting systems have raised issues around the privacy of messages sent via the data-link.

According to Nitha Suresh, a cybersecurity consultant at Synopsys, the surveillance signal used to broadcast the position of aircraft can potentially be eavesdropped or spoofed by highly skilled attackers.

The risk is particularly elevated in aviation due to the complexity of aircraft systems. Over the years, the size of the software supporting them has grown exponentially, says Suresh.

This complexity – including multiple lines of code – lowers the testability of the software, leaving behind vulnerabilities which can be exploited by a skilled attacker.

Adding to this, the software goes through many overhauls and updates during the lifecycle of the plane. “Unless this job is carried out with extreme caution, there is a great deal of potential for security bugs to creep into the software,” Suresh says.

In addition, modern avionics software development takes advantage of commercial off-the-shelf components. But this can potentially allow an attacker to tunnel through and enter the heart of the system, Suresh warns.

She says software vendors should take necessary precautions in terms of plugging the loopholes, “just like they would with any other open architecture”.

At the same time, Suresh points out that major development standards don’t currently include detailed cybersecurity policies. Although she concedes, the Aircraft Systems Information Security Protection (ASISP) 2015 initiative by the FAA “is a move in the right direction”.

So, what can be done to prevent malicious actors from attacking aircraft? The risks can, to an extent, be mitigated by the effective decision-making capability of an experienced pilot – who might spot something unusual, says Suresh.

But she emphasizes the importance of understanding the attack surface. “There should be a common repository of threats to both hardware and software detected by the developers and assessors. This needs to be maintained by regulatory agencies like the FAA and should also be available across different development platforms.”

Meanwhile, development teams should be able to compile all known threats to build a model. “Within this threat model, there should be information about threats that exclusively affect the product or piece of software at hand,” she adds.

Suresh also recommends taking advantage of threat intelligence and security awareness. “Anyone who is directly or indirectly involved with critical systems should be made aware of the security threats looming.”



I am freelance cyber security journalist with over a decade’s experience reporting on the issues impacting users, businesses and the public sector. My interests within cyber security include critical national infrastructure, nation state cyber attacks, data misuse

[TonyGosling]

IN-FLIGHT AIRPLANES CAN NOW BE HACKED FROM THE GROUND, CYBER EXPERT WARNS
BY JASON MURDOCK ON 6/6/18 AT 12:35 PM
U.S. Indicts Nine Iranians In Hacking Investigation
https://www.newsweek.com/flight-airplanes-can-now-be-hacked-ground-cyb er-expert-warns-962420

A security researcher is set to prove how security weaknesses in satellite communication (SATCOM) technology exposed “some of the largest airlines in the U.S. and Europe” to hackers and could be exploited by adversaries to reveal NATO bases in conflict zones.

Building on research first published in 2014, Ruben Santamarta, an expert at cybersecurity company IO/Active, will tell attendees at 2018’s BlackHat hacker conference in August how “entire fleets” of airplanes were left accessible from the internet, leaving hundreds of in-flight craft at risk. His talk, using the same name as a previous research report, is titled “Last Call for SATCOM Security.”

Santamarta says that he has now proven his previous theories—which suggested ships, aircraft, military personnel, emergency services, media, and industrial facilities were all vulnerable—and is now able to demonstrate exactly how a plane’s WiFi network can be tampered with from the land below.

"As far as I know I will be the first researcher that will demonstrate that it's possible to hack into communications devices on an in-flight aircraft…from the ground," he told Dark Reading this week. "We also managed to get access to important communications devices in the aircraft,” he added.

Cybersecurity
Researcher Ruben Santamarta is set to demonstrate how to tamper with planes via satellite communication (SATCOM) technology.
ISTOCK

While I/O Active, already well-known in cybersecurity circles for experiments in car hacking, has attempted to report all the potential bugs to impacted companies, the researcher has acknowledged that a number of “significant vulnerabilities” are still exploitable. None of his analysis put lives at risk, but he said the bugs in some SATCOM devices "could be used to perform cyber-physical" attacks.

"This has to be explained carefully, and we've got all the technical details backing our claim. It's not an apocalypse, but basically there are some scenarios that are possible,” he told DarkReading, adding that he will show SATCOM devices being weaponized by leveraging the security flaws.

A brief tease on the BlackHat website says his 2014 hypotheses will be taken into real-world territory. “We will go one step further and demonstrate how to turn compromised SATCOM devices into RF weapons,” it reads. “This talk will cover new areas on the topic, such as reverse engineering, Radio Frequency (RF), SATCOM, embedded security, and transportation safety and security.”

Until last year, the notion of effective plane hacking was largely believed to be purely theoretical. But as noted by Aviation Today last November, the U.S. Department of Homeland Security (DHS) reconsidered this approach after its cyber experts remotely breached the defenses of a Boeing 757 commercial plane.

Robert Hickey, aviation program manager at the agency’s Science and Technology Directorate, said during a security conference in Virginia that much of his work remains classified, but revealed it didn’t take long to develop a working hacking exploit. “We got the airplane on Sept. 19, 2016,” he said. “Two days later, I was successful in accomplishing a remote, non-cooperative, penetration.” Hickey confirmed that his team broke through the network using “radio frequency communications.”

While the research was alarming, showing how future terrorists could take over planes using technology alone, Boeing stressed at the time there was “no hack of the airplane’s flight control systems.”

Back in 2015, a cybersecurity researcher called Chris Roberts hit the headlines after he told FBI investigators that he had broken into various in-flight entertainment systems more than a dozen times between 2011 and 2014, claiming to be aware of bugs in Boeing and Airbus craft. As noted by Wired, a warrant application suggested that he was able to make a plane briefly alter its course.

Roberts said that his tweet that was brought to the attention of the FBI while he was on a United Airlines flight was meant as a joke, Wired reported. He was arrested while carrying “nasty” hacking malware but, ultimately, no charges were filed and his seized equipment was returned.

Santamarta has been warning of the hacking risks for years. “We live in a world where an ever-increasing stream of digital data is flowing between continents,” his 2014 paper read. “It is clear that those who control communications traffic have an upper-hand. The ability to disrupt, inspect, modify, or re-route traffic provides an…opportunity to carry perform surveillance or conduct cyberattacks."

He added: "When it comes to security, it is no longer acceptable to rely on perceptions."

[TonyGosling]

ALEX DAVIES
TRANSPORTATION
11.12.1807:18 PM
HOW TO LAND A ‘COMPLETELY UNCONTROLLABLE’ PASSENGER JET
https://www.wired.com/story/air-astana-flight-1388-portugal-loss-contr ol/

Pilots are trained to follow a simple creed when something goes wrong: Aviate, navigate, and communicate, in that order.MARINA LYSTSEVA/TASS/GETTY IMAGES
THE TROUBLE STARTED almost immediately. A few minutes after taking off from Lisbon on Sunday, the pilots of an Air Astana Embraer 190 jet called Mayday. “We have flight control problems,” he told air traffic control, asking for a path to the sea for an emergency landing.

“We have six people on board,” one pilot said a few minutes later, according to an audio recording available via LiveATC.net. “Airplane is completely uncontrollable.”

Those six included three pilots and three engineers, according to FlightGlobal, who were taking the aircraft from Portugal, where it had been undergoing maintenance, to Kazakhstan, where Air Astana is based. In the first portion of the flight, the Embraer traced the sort of flight path you’d draw if you took your Spirograph on a roller coaster. Eventually, the pilots regained control and, escorted by a pair of fighter jets, flew south to an airport with good weather and landed safely.

“Due to technical reasons the crew decided to perform an unplanned landing,” Air Astana said in a statement on Twitter. The investigation into what happened is just beginning, but the loss of control points to a few possibilities, says Shawn Pruchnicki, a former airline pilot who teaches aviation safety, human factors, accident investigation, and complex aircraft operation at Ohio State University’s Center for Aviation Studies. The plane’s control surfaces (the flaps, ailerons, and so on) could have frozen, or the power control units that move them might have failed. It might be related to the plane’s recent maintenance, or the timing could be coincidental.

Pilots are trained to follow a simple creed when something goes wrong: Aviate, navigate, and communicate, in that order. In a loss-of-control situation, Pruchnicki says, aviating means figuring out what systems are working and how you can use them to stay level.


Flight 1388 followed a wild course during its harrowing flight. (Note FlightRadar24 tracked the plane using 'multilateration,' which isn't perfectly precise. Read more about it here.) FLIGHTRADAR24
“Try to maintain control of the aircraft at all times, using whatever means you have to,” Pruchnicki says. “There are some aerodynamic techniques that can be used for an airplane that is seemingly out of control that really sharp pilots, especially those with acrobatic training, can attempt to regain control.”

Imagine you’re stuck banking steeply to the right and losing altitude, and the ailerons (those flappy bits on the wings) are frozen. In normal flight, the pilot uses the rudder to point the nose right or left. Here, with the plane at an angle, the pilot could step on the left pedal to move the rudder, pulling the nose up and maintaining altitude. “The airplane will still stay 90 degrees”—tilted to the right, that is—”but it’ll be controllable in a different axis.”

Or say you’re having trouble turning: Changing how much power goes to each engine might help. The Brazilian-made Embraer 190’s engines sit under its wings, so applying thrust can pitch the plane up a bit. The point is, pilots have lots of tools at their disposal. When one tool malfunctions, pilots have to get creative with how they use the others.

The Air Astana pilot’s request for directions to the ocean—“We need vectoring to the sea please, we will be ditching”—indicate that at that moment, he didn’t think he could reach an airport or even a large field. The ocean’s swells can make things tricky, but “it might be the best choice, out of some really crappy choices.” At least you won’t hit any buildings, and you don’t have to worry about lining up with a runway.

An hour after calling Mayday, the pilot announced he had control of the plane and could maintain a set heading and altitude. By this point, they were accompanied by a pair of F-16 fighter jets scrambled by the Portuguese air force, which led the Embraer south toward the airport in Beja.

Even when your navigation systems are working, that kind of guidance is helpful because it gives you one less thing to worry about. “All of this takes a lot of mental bandwidth, and it’s nice to have a jet that you can just fly next to,” Pruchnicki says. “That way the burden is shifted onto them. It’s good crew resource management.” Remember that aviating—maintaining control of the plane—comes before navigating. (The fighter pilots can also take a look at the parts of the plane you can’t see and maybe figure out what’s wrong.)

Once at Beja, the Embraer’s crew needed three approaches to get onto the ground, but safely touched down at around 3:30 in the afternoon.