3 ms·
This quote sounds strange to me: "As an example, Hypponen said he had recently spoken to a European aircraft maker that said it cleans the cockpits of its plan
by tjoff 8y ago
This quote sounds strange to me:
"As an example, Hypponen said he had recently spoken to a European aircraft maker that said it cleans the cockpits of its planes every week of malware designed for Android phones. The malware spread to the planes only because factory employees were charging their phones with the USB port in the cockpit.
Because the plane runs a different operating system, nothing would befall it. But it would pass the virus on to other devices that plugged into the charger."
What kind of malware would that be? Also obviously the OS is at risk since it also must have been infected to be able to pass the malware along (I'm guessing this might be the entertainment system or something and nothing critical).
- astonex 8y agoHas anyone told the employees that their phones have malware? Seems strange to let it be a weekly occurrence.
- ztjio 8y agoYou are thinking too conventionally. There are numerous ways to attack USB devices that don’t involve the OS. https://www.bleepingcomputer.com/news/security/heres-a-list-of-29-different-types-of-usb-attacks/ https://www.bleepingcomputer.com/news/security/heres-a-list-...
- robertAngst 8y agoHmm guess thats the disadvantage of allowing USB to do anything. Cant limit even what looks like a mouse to be a mouse only..
- tjoff 8y agoI guess that a regular app would not have the necessary low level access (that I assume is required) to do anything like that. So that (another guess) means that the android phone needs to be under complete control of the malware. Is that common or are my guesses/assumptions wrong?
- djsumdog 8y agoProbably some type of app that automatically copies a payload to any plugged in USB device? Makes me think of all those .eml files you'd find on network shares in the early 00s.
- cxcorp 8y agoProbably referring to the likes of BadUSB
- Nokinside 8y agoUSB connections in the cockpit are used for charging devices in electronic flight bag (tablets etc). I'm not sure if the USB controller is connected to anything else than power supply, but it might still be programmable allowing it to distribute malware.
- DanBC 8y agoWhy do they have data lines if they're only providing power?
- Nokinside 8y agoThat's a good question. I suspect that it might be cheaper to use the same USB components they use in passenger systems. Note: there are other USB or RJ-45 ports, or SD cards that are used to update avionics software or aeronautical databases. These are usually available only to maintenance and use digital signatures to verify the data.
- 4ad 8y agoBecause high-speed charging requires negotiating a protocol between the two devices.
- walshemj 8y agoThen why do they not have a strict "no personal devices inside the wire" and the same for air crew all phones must be locked in a secure box. Locking down the USB ports to authorised devices would also make sense.
- rurban 8y agoThat's java malware. They are compiling everything down to Java bytecode, even perl. The OS itself is not Android so they are not affected.