5 ms·

If your software can't handle nmap it has no business being on any network anywhere ever. This mentality is where a lot of our current security problems come f

If your software can't handle nmap it has no business being on any network anywhere ever. This mentality is where a lot of our current security problems come from, from IoT to critical infrastructure to ATMs, etc. Developers can't imagine someone would ever do anything nefarious on their "closed" network, so they don't bother doing more than cursory security. Then the internet shames anyone who tries to demonstrate how bad things really are.

mulmen 9y ago
That doesn't justify putting other people's lives at risk. Testing on a live system without permission is still irresponsible.
- dkersten 9y ago
  "lives at risk" is a bit of a stretch. They might take down the IFE and people might be bored, but they won't take the plane down. The telemetry data is read-only (the hardware is physically isolated and transmission one way -- systems that need write access are isolated from the ones that only need read access, and have to go through a slew of certification processes). (I work on IFE and avionics)
  - fpoling 9y ago
    Is this still true with 787? [1] indicates that it uses virtual links that are not physically separated. [1] - https://en.m.wikipedia.org/wiki/ARINC_429 https://en.m.wikipedia.org/wiki/ARINC_429
    - bonzini 9y ago
      The protection lies between that bus and the TCP/IP stack of the IFE. Data can go one way, and several feet of certification documents are there to ensure that.
      - mulmen 9y ago
        A stack of paper on the ground is of little comfort to me in the sky. If there is a physical (TCP/IP!) connection between two systems there is a potential for communication between them. No amount of certification will ever make that as secure as an air gap.
        tscs37 9y ago
        There are hardware diodes. There is no physical way to write through those.
        bonzini 9y ago
        As parent said, communication on the avionics side happens on a specialized bus, to which the entertainment side has read access only, enforced either through hardware or through highly-certified software (Common Criteria EAL6 or even EAL7) on the secure side.

mulmen 9y ago

That doesn't justify putting other people's lives at risk. Testing on a live system without permission is still irresponsible.

dkersten 9y ago
"lives at risk" is a bit of a stretch. They might take down the IFE and people might be bored, but they won't take the plane down. The telemetry data is read-only (the hardware is physically isolated and transmission one way -- systems that need write access are isolated from the ones that only need read access, and have to go through a slew of certification processes). (I work on IFE and avionics)
- fpoling 9y ago
  Is this still true with 787? [1] indicates that it uses virtual links that are not physically separated. [1] - https://en.m.wikipedia.org/wiki/ARINC_429 https://en.m.wikipedia.org/wiki/ARINC_429
  - bonzini 9y ago
    The protection lies between that bus and the TCP/IP stack of the IFE. Data can go one way, and several feet of certification documents are there to ensure that.
    - mulmen 9y ago
      A stack of paper on the ground is of little comfort to me in the sky. If there is a physical (TCP/IP!) connection between two systems there is a potential for communication between them. No amount of certification will ever make that as secure as an air gap.
      - tscs37 9y ago
        There are hardware diodes. There is no physical way to write through those.
      - bonzini 9y ago
        As parent said, communication on the avionics side happens on a specialized bus, to which the entertainment side has read access only, enforced either through hardware or through highly-certified software (Common Criteria EAL6 or even EAL7) on the secure side.