7 ms·
> I did a port scan on the System Control Unit Is that still white hat? Did they also check to see if the cockpit door is locked?
by yread 9y ago
> I did a port scan on the System Control Unit
Is that still white hat? Did they also check to see if the cockpit door is locked?
- Cthulhu_ 9y agoScanning should be fine; trying to access them becomes dubious; bruteforcing the login could lead to arrest.
- davrosthedalek 9y agoI had a projector firmware freeze up hard on me during a port scan. There is some risk there.
- theWatcher37 9y agoSo what does that say about the wisdom of port scanning a machine your life is currently depending on?
- ocdtrekkie 9y agoHe probably should've done his port scan once the plane was on the ground. Though I'd be REALLY worried if there was even the slightest risk of network access to the IFE causing a flight control device of any kind to seize up, and would hope that someone at Boeing made sure that was not possible.
- throwawayjava 9y agoIf that plane ever plans to enter US or EU airspace, there is a literal air-gap between the IFE and the flight systems.
- WhitneyLand 9y agoThen how is it showing the flight metrics? I wouldn’t guess they would add double sensors for all that information. Or did you mean well protected, instead of literal air gap?
- KekDemaga 9y agoOne way connection of some kind? Its not an air gap but may functionally work the same way.
- fragmede 9y agoOptoisolators are a prolific and an extremely cheap electrical component that performs the "air-gap" functionality.
- eeZah7Ux 9y agoNo, that's not airgapping.
- SAI_Peregrinus 9y agoElectrical safety airgapping and information security airgapping are different, and entirely unrelated. If data can pass from one side to the other it's not airgapped (from an infosec perspective).
- bonzini 9y agoFiber needs transmitter and receiver transducers. If each side has only one of those, data can literally flow only in one direction. So it's still infosec-airgapped in the other.
- SAI_Peregrinus 9y agoNo, data diodes are a different (but related) concept. An airgap implies no information transfer, either in or out. Use an airgap when information leakage must be stopped (as well as remote attacks), use a data diode when information can be released but you need to stop remote attacks. Fiber optic connections aren't required, anything with separate transmit and receive lines can be turned into a data diode (as long as the protocols used permit it). RS232 null modem cables with the RX lines disconnected are a classic.
- evan_ 9y ago
- Neracked 9y agoThe Federal Aviation Administration has issued special conditions for the certification of the 787 to deal with the fact that there is no "literal airgap" in recent airliners even though that was initially mandated by the airworthiness standards: > These special conditions are issued for the Boeing Model 787-8 airplane. This airplane will have novel or unusual design features when compared to the state of technology envisioned in the airworthiness standards for transport category airplanes. The architecture of the Boeing Model 787-8 computer systems and networks may allow access to external systems and networks [1] https://www.federalregister.gov/documents/2007/12/28/E7-25075/special-conditions-boeing-model-787-8-airplane-systems-and-data-networks-security-protection-of https://www.federalregister.gov/documents/2007/12/28/E7-2507...
- kylegordon 9y agoDo you honestly believe your life depends on the stability of an in flight entertainment computer?
- mikeash 9y agoIf your fellow passengers found out who killed the movies in the middle of a long flight... in this particular case, yes, it might.
- dx034 9y agoIt would probably not harm the aircraft but would be bad enough if it freezes the entertainment system for all passengers. If the ~300 other people on board find out that you're the one responsible for their boredom on a 10 hour flight, you won't have a great time.
- alkonaut 9y agoHas anyone taken a 10h flight where the IFE was not rebooted due to some problem? Agree the IFE could crash, but can't see how there is even a remote risk to critical systems, or any risk to the IFE that isn't solved by (yet another) reboot of it.
- angrygoat 9y agoI used to work at a university, and would routinely (with authorisation) nmap the entire /16. I discovered this would freeze the TCP/IP stack on a bunch of VMS boxes on campus - luckily on VMS that was restartable without bouncing the box :-)
- t90fan 9y agoScanning can lead to arrest in some places. In the UK for example, the computer misuse act says that using any tool with the intent of accessing a system (without actually doing so, let alone doing so successfully) is an offence.
- blincoln 9y agoIt could easily be interpreted as a CFAA violation in the US as well. I'm a professional pen tester, and there's no chance I'd port-scan any system on an aircraft without permission.
- lordlimecat 9y agoIt's almost like theres a reason every computer security class and every scanning software written has a disclaimer saying "NEVER SCAN A SYSTEM WITHOUT AUTHORIZATION".
- Diederich 9y agoAt one of the companies I worked at, years ago, a service discovery system I wrote did a very light scan of every listening port bound on every system. One thing it did was an HTTP GET. One of the core apps had a control port that implemented HTTP. Unfortunately, my GET hit a route that didn't exist, and that caused a small memory leak every time. Nothing too bad happened; the leak was slow, and even though the app stayed up many months at a time, we did notice the leak and figured out what was causing it. As others have stated elsewhere, I've seen completely 'easy going' TCP connections to embedded devices cause immediate crashes.
- duxup 9y agoI wondered the same. Right or wrong some equipment does not respond well (lockup, reset...) to port scanning.
- tptacek 9y agoIt's borderline; if something bad happens (and bad things definitely can happen from portscanning, especially embedded systems), you'll be on the hook for it.
- duxup 9y ago"you'll be on the hook for it." Particularly if something goes terribly wrong and you're on the plane.
- tptacek 9y agoNothing you do to the IFE is going to take down the plane.
- willvarfar 9y agoIn theory the IFE and avionics are separated by firewalls. Some things like the PA system are often on the IFE side, and hacks for panasonic IFE have included impersonating the pilot announcements and stuff. In practice I wouldn't expect the firewalls to be particularly well tested or complete or configured correctly, and it may be possible for an attacker to DOS the firewall and impact the other systems, and possible for the attacker to penetrate the firewall and so on.
- jonathanstrange 9y agoI find this hard to believe. I always thought that IFE and avionics are on separate machines and run over different internal networks and wires. But I'm also not a Boeing engineer. Can someone confirm the above post?
- willvarfar 9y agoYou or I would have completely different sets of wires. Sadly, it seems they usually share wires and are separated by firewalls. There's been lots of CCC and defcon talks about hacking in-flight systems. Googling "panasonic ife hack" gets plenty of hits, as does "Chris Roberts" who is a hacker who has made some pretty big claims about actually really hacking planes in flight and other stupid things. And there are articles like this https://www.wired.com/2015/04/hackers-commandeer-new-planes-passenger-wi-fi/ https://www.wired.com/2015/04/hackers-commandeer-new-planes-... that talk about how the systems share wires.
- mdekkers 9y agoIs that still white hat? I think if you are not specifically asked to do it, it isn't white hat, and I think (but am not 100% sure) the law is like that. I don't know what hat it is, but white it isn't.
- zero_one_one 9y agoIrresponsibility is not solely the domain of Black Hats...