7 ms·

I found that part much more .. interesting: > As an example, Hypponen said he had recently spoken to a European aircraft maker that said it cleans the cockpits

I found that part much more .. interesting: > As an example, Hypponen said he had recently spoken to a European aircraft maker that said it cleans the cockpits of its planes every week of malware designed for Android phones. The malware spread to the planes only because factory employees were charging their phones with the USB port in the cockpit.

pm90 11y ago
What....? Seriously, wtf? Is it really that hard to provide outlets to charge your phone?
- EliRivers 11y ago
  Or alternatively, how about WTF are you doing plugging your phone into this fucking cockpit? You're here to do your job and if you want to carry your phone around with you in the factory all day that's up to you, but plugging your phone into the fucking cockpit you're meant to be working on will result in demotions, suspensions and unemployment all round. More politely put, I see no obligation on employers to provide employees with the means to recharge their personal phones :)
  - deleted 11y ago
    [deleted]
  - deleted 11y ago
    [deleted]
  - dagw 11y ago
    I see no obligation on employers to provide employees with the means to recharge their personal phones What makes you so sure it isn't (also) their work phone? Lots of people I know don't have a personal phone and a work phone, they just have a phone.
  - sgift 11y ago
    > More politely put, I see no obligation on employers to provide employees with the means to recharge their personal phones :) This is a classic "design a better human" problem - sure, you can try to 'persuade' people by threatening them with demotions, suspensions and unemployment. And then you can hope that this will work in every single instance. Or ... you can provide a few usb ports in a convenient location, so people use these instead of the usb port in your multi million dollar cockpit to charge their phones. Take your pick. For another example decide if it's easier to provide waste bins or to threaten people who litter streets.
    - deleted 11y ago
      [deleted]
    - EliRivers 11y ago
      They were working in a cockpit factory. They had many other options for charging their phone in a USB socket, and they still chose to charge it by plugging it into the cockpit. Your solution, in this situation, already existed and people still plugged phones into the cockpit. Why would they NOT do this, under your system? If I can plug my phone in right where I am, in the cockpit, or somewhere less convenient for me, why would I not just do it where I am, in the cockpit? There are no penalties for it, so why wouldn't I do it?
- lmm 11y ago
  Following the what, 11 different plug standards commonly in use for power internationally? Or provide a USB port that every phone in the world can use, and is smaller and more efficient to boot. I know which I'd pick.
- tyingq 11y ago
  Anything installed in an aircraft is subject to a regulatory avalanche of paperwork, testing, and approvals.
TillE 11y ago
The next sentence pretty much confirms my impression that this claim is almost certainly bullshit: > Because the plane runs a different operating system, nothing would befall it. But it would pass the virus on to other devices that plugged into the charger. That's just...not how computers work.
- elcapitan 11y ago
  It's true that that scenario is not relevant, but the fact that there is a direct connection between the usb ports for charging stuff and the planes' computer is obviously a point of intrusion for attacks like Stuxnet.
  - jessriedel 11y ago
    Might be the case that the USB ports are for interacting with the plane's computers, and the charging being done by the pilots is against the rules.
- MichaelBurge 11y ago
  I could maybe understand it if it was a USB hub, and the phones all had a defect that meant rogue USB signals could infect them. So if 2 people plugged into the same hub at the same time, it could spread. But if the claim is that the virus lie 'dormant' in the uninfectable plane OS, then I can't understand that.
  - nitrogen 11y ago
    USB devices cannot contact each other, only the master can communicate with the devices on the bus. It is a tree with one device at the root.
- SonicSoul 11y ago
  nice catch. can't help but think of Independence Day when Jeff Goldblum and Will Smith infect alien mothership with a mac virus from a 3.5 floppy which specifically disabled its protective shield. "will give it a cold" Edit: corrected it's its
SixSigma 11y ago
Callback to 2008 : Boeing's new 787 Dreamliner passenger jet may have a serious security vulnerability in its onboard computer networks that could allow passengers to access the plane's control systems, according to the U.S. Federal Aviation Administration. The computer network in the Dreamliner's passenger compartment, designed to give passengers in-flight internet access, is connected to the plane's control, navigation and communication systems, an FAA report reveals. Boeing spokeswoman Lori Gunter wouldn't go into detail about how Boeing is tackling the issue but says it is employing a combination of solutions that involves some physical separation of the networks, known as "air gaps," and software firewalls. Gunter also mentioned other technical solutions, which she said are proprietary and didn't want to discuss in public. "There are places where the networks are not touching, and there are places where they are," she said. http://www.wired.com/2008/01/dreamliner-security/ http://www.wired.com/2008/01/dreamliner-security/ http://cryptome.info/faa010208.htm http://cryptome.info/faa010208.htm
madaxe_again 11y ago
It'll be EADS - I've experienced their infosec first hand. Heavy on process and inquisatorial panels - yet they do stuff like emailing parts lists and schematics over the Internet, no protection.
cm3 11y ago
Yeah, it's sad that so many people actually use USB ports at airports to charge their devices, without knowing what they are connecting their devices to. I don't expect them to know better, but all their data could be copied, stuff could be modified. Isn't there an adapter which limits the active lines to just what's needed to pass power, no data, or is charging without some data exchange impossible?
- gpvos 11y ago
  The data lines are used for signalling which charging speed the device supports. You can cut them, but then you get the lowest denominator charging specs, which is quite slow.
- hga 11y ago
  https://www.crowdsupply.com/xipiter/usbcondom https://www.crowdsupply.com/xipiter/usbcondom
- 05 11y ago
  Not a problem if you use iOS9: https://labsblog.f-secure.com/2015/09/09/apple-ios-9-security-features/ https://labsblog.f-secure.com/2015/09/09/apple-ios-9-securit... For Android, you can root it and disable USB host functions when locked.

pm90 11y ago

What....? Seriously, wtf? Is it really that hard to provide outlets to charge your phone?

EliRivers 11y ago
Or alternatively, how about WTF are you doing plugging your phone into this fucking cockpit? You're here to do your job and if you want to carry your phone around with you in the factory all day that's up to you, but plugging your phone into the fucking cockpit you're meant to be working on will result in demotions, suspensions and unemployment all round. More politely put, I see no obligation on employers to provide employees with the means to recharge their personal phones :)
- deleted 11y ago
  [deleted]
- deleted 11y ago
  [deleted]
- dagw 11y ago
  I see no obligation on employers to provide employees with the means to recharge their personal phones What makes you so sure it isn't (also) their work phone? Lots of people I know don't have a personal phone and a work phone, they just have a phone.
- sgift 11y ago
  > More politely put, I see no obligation on employers to provide employees with the means to recharge their personal phones :) This is a classic "design a better human" problem - sure, you can try to 'persuade' people by threatening them with demotions, suspensions and unemployment. And then you can hope that this will work in every single instance. Or ... you can provide a few usb ports in a convenient location, so people use these instead of the usb port in your multi million dollar cockpit to charge their phones. Take your pick. For another example decide if it's easier to provide waste bins or to threaten people who litter streets.
  - deleted 11y ago
    [deleted]
  - EliRivers 11y ago
    They were working in a cockpit factory. They had many other options for charging their phone in a USB socket, and they still chose to charge it by plugging it into the cockpit. Your solution, in this situation, already existed and people still plugged phones into the cockpit. Why would they NOT do this, under your system? If I can plug my phone in right where I am, in the cockpit, or somewhere less convenient for me, why would I not just do it where I am, in the cockpit? There are no penalties for it, so why wouldn't I do it?
lmm 11y ago
Following the what, 11 different plug standards commonly in use for power internationally? Or provide a USB port that every phone in the world can use, and is smaller and more efficient to boot. I know which I'd pick.
tyingq 11y ago
Anything installed in an aircraft is subject to a regulatory avalanche of paperwork, testing, and approvals.

TillE 11y ago

The next sentence pretty much confirms my impression that this claim is almost certainly bullshit: > Because the plane runs a different operating system, nothing would befall it. But it would pass the virus on to other devices that plugged into the charger. That's just...not how computers work.

elcapitan 11y ago
It's true that that scenario is not relevant, but the fact that there is a direct connection between the usb ports for charging stuff and the planes' computer is obviously a point of intrusion for attacks like Stuxnet.
- jessriedel 11y ago
  Might be the case that the USB ports are for interacting with the plane's computers, and the charging being done by the pilots is against the rules.
MichaelBurge 11y ago
I could maybe understand it if it was a USB hub, and the phones all had a defect that meant rogue USB signals could infect them. So if 2 people plugged into the same hub at the same time, it could spread. But if the claim is that the virus lie 'dormant' in the uninfectable plane OS, then I can't understand that.
- nitrogen 11y ago
  USB devices cannot contact each other, only the master can communicate with the devices on the bus. It is a tree with one device at the root.
SonicSoul 11y ago
nice catch. can't help but think of Independence Day when Jeff Goldblum and Will Smith infect alien mothership with a mac virus from a 3.5 floppy which specifically disabled its protective shield. "will give it a cold" Edit: corrected it's its

SixSigma 11y ago

Callback to 2008 : Boeing's new 787 Dreamliner passenger jet may have a serious security vulnerability in its onboard computer networks that could allow passengers to access the plane's control systems, according to the U.S. Federal Aviation Administration. The computer network in the Dreamliner's passenger compartment, designed to give passengers in-flight internet access, is connected to the plane's control, navigation and communication systems, an FAA report reveals. Boeing spokeswoman Lori Gunter wouldn't go into detail about how Boeing is tackling the issue but says it is employing a combination of solutions that involves some physical separation of the networks, known as "air gaps," and software firewalls. Gunter also mentioned other technical solutions, which she said are proprietary and didn't want to discuss in public. "There are places where the networks are not touching, and there are places where they are," she said. http://www.wired.com/2008/01/dreamliner-security/ http://www.wired.com/2008/01/dreamliner-security/ http://cryptome.info/faa010208.htm http://cryptome.info/faa010208.htm

madaxe_again 11y ago

It'll be EADS - I've experienced their infosec first hand. Heavy on process and inquisatorial panels - yet they do stuff like emailing parts lists and schematics over the Internet, no protection.

cm3 11y ago

Yeah, it's sad that so many people actually use USB ports at airports to charge their devices, without knowing what they are connecting their devices to. I don't expect them to know better, but all their data could be copied, stuff could be modified. Isn't there an adapter which limits the active lines to just what's needed to pass power, no data, or is charging without some data exchange impossible?

gpvos 11y ago
The data lines are used for signalling which charging speed the device supports. You can cut them, but then you get the lowest denominator charging specs, which is quite slow.
hga 11y ago
https://www.crowdsupply.com/xipiter/usbcondom https://www.crowdsupply.com/xipiter/usbcondom
05 11y ago
Not a problem if you use iOS9: https://labsblog.f-secure.com/2015/09/09/apple-ios-9-security-features/ https://labsblog.f-secure.com/2015/09/09/apple-ios-9-securit... For Android, you can root it and disable USB host functions when locked.