General Aviation (GA) Electronic Flight Bags
Surveys security weaknesses in connected General Aviation Electronic Flight Bag applications and provides mitigation strategies for developers.
Summary
The Rise of Connected Electronic Flight Bags
General aviation pilots increasingly rely on tablet-based Electronic Flight Bags (EFBs) for real-world flight planning, weather updates, aeronautical charts, and weight-and-balance calculations.
Common Vulnerability Classes in EFB Applications
Security assessments across multiple commercial EFB products reveal recurring flaws in insecure API communications, unauthenticated local data storage, and weak cryptographic validation of aeronautical charts.
Risks of Untrusted Data Feeds in Flight Planning
Corrupted navigation data or spoofed weather overlays delivered via insecure cloud backends can mislead pilots during flight preparation or cause situational awareness failures in flight.
Developer Guidance for Hardening EFB Software
Mitigating security risks requires EFB developers to enforce certificate pinning, sanitize external sensor feeds from portable ADS-B receivers, and validate navigation database integrity.
Related talks
OWASP Foundation·29 min
Brendan Hann
Brendan Hann analyzes Insiders Guide to Mobile AppSec with Latest OWASP MASVS.
OWASP Foundation·29 min
AppSecUSA 2018 examines Fixing Mobile AppSec - Sven Schleier.
OWASP Foundation·52 min
Analysts investigate attack surfaces and defenses concerning APPSEC Cali 2018 - Where, how, and why is SSL traffic on mobile getting intercepted?.


