Old news. This bloke made headlines last month after United blacklisted him following a (hopefully) tongue-in-cheek tweet about
Deploying the oxy masks in flight.
That being said, I have no doubt it would be possible for someone sufficiently talented to view data on board, and perhaps even modify it. External systems are even easier. Howabout a TCAS RA based on a series of non-existent ADS-B transmissions? A false "Beware, pax in 14D is a hijacker" ACARS message to the crew?
How long it'll be before someone uses these vulnerabilities remains to be seen.