16 ms·

A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

391 points by samuell 7y ago

kps 7y ago
Who thought that having any communication path from the passenger entertainment system to flight control was a good idea?
- tjr 7y ago
  Connecting entertainment systems to flight control sounds very wrong. Connecting entertainment systems to flight management would be common; it should be one-way communication (entertainment can only read FMS data, not send any), for the purpose of driving the moving map displays for passengers.
  - toomuchtodo 7y ago
    > it should be one-way communication (entertainment can only read FMS data, not send any), for the purpose of driving the moving map displays for passengers. Would you agree that this logical boundary should be physically enforced? Such as an opto-isolator?
    - amluto 7y ago
      No fancy circuitry is needed. Just use one fiber. I suspect that 100BASE-T can pull this off with one pair and some hackery. RS232 should work work only one direction connected.
      - deleted 7y ago
        [deleted]
    - debatem1 7y ago
      Used to be done with a literal diode.
      - kps 7y ago
        Well, an optoisolator is a literal diode plus a literal transistor. I'm okay with that much hi tech.
      - basilgohar 7y ago
        The funny thing is that LEDs (granted, not all types of diodes) can be used to read data as well as transmit it. Videos of such interfaces can be found on YouTube. So, they are not as one-way as some folks may think. https://youtu.be/aLP-OF4nesY https://youtu.be/aLP-OF4nesY
        temac 7y ago
        Well it can not only be a LED that is supposed to be one-way, but the whole circuitry driving it. Likewise for the receptor. With some appropriate review of the physical design, you can have a reasonable expectation that the comm will be limited to one-way, with no way for arbitrary SW to modify the direction.
        debatem1 7y ago
        Usually wasn't an LED. Just a normal diode.
    - henryfjordan 7y ago
      > Boeing maintains that other security barriers in the 787's network architecture would make that progression impossible. They probably do something to that effect
      - toomuchtodo 7y ago
        The longer I'm alive the more firmly I commit to never assume anything. I have seen things. Terrible things.
        p_l 7y ago
        Connectivity between zones is something FAA actually caught in 787 when it was still being built and forced a redesign.
      - snickerbockers 7y ago
        "security barrier" is a vague, meaningless phrase that they don't define. There shouldn't be any connection at all between flight systems and the in-flight entertainment.
    - tjr 7y ago
      Yes.
    - mjevans 7y ago
      There should actually be three distinct "air-gaped" networks (or at least classifications of network). Secure: The network that connects and controls the airplane. Absolutely only essential things allowed on, and if possible isolated using mathematically proven secure vlan/isolation techniques. "Employee": pilots, crew, etc. This is more just a distinct network for corporate operations security. "Customer": Still try to keep this one secure so that virus and just don't spread, but this is the 'DMZ' area. Communication from the secure network should be outbound only, and might best be done over a fixed rate serial data connection of some sort. The modern version might be to configure a point to point network link on a CDMA based system and just disconnect the secure side's RX path entirely. Then you just export the data blind via UDP with like 10X redundancy.
      - stefan_ 7y ago
        Most Boeing planes (though not the 787 discussed here) don't use fly-by-wire, so you could argue that the most essential control plane is perfectly isolated by virtue of not having any sort of network at all, just hydraulics into the cabin.
        blunte 7y ago
        But wasn't the 737-max issue that a software system was forcing an elevator change to pitch the nose down? That sounds pretty fly-by-wire (even if hydraulics are involved).
        p_l 7y ago
        You could say that the problem was lack of fly-by-wire - if 737-MAX had FBW, the necessary corrections would be bundled as part of flight envelope protection, and that tends to work pretty well and the required checks on FBW systems would catch stuff like "only one AoA sensor used". Instead we got MCAS which was messing with autotrim signals and escaped scrutiny.
    - yc-kraln 7y ago
      This sounds like a good idea, until you realize that the head unit is typically the thing in the car with the most computing power (think AI workloads as well as a GPU and multiple ARM cores) and the thing in the car with the network connection. A trivial use case which requires write access to the CAN bus is the navigation system informing cruise control of an upcoming hill. Equally trivial would be the seat position memory or profiles being applied through the main touchscreen. (I work for a company that is developing infotainment systmes)
  - usrusr 7y ago
    The moving map could easily be fed from a separated consumer grade GPS. Same for all other metrics that the median passenger would care about (height, speed over ground), except for the ever-impressive outside temperature.
    - tjr 7y ago
      Outside temperature is pretty impressive indeed. The map also shows projected flight plan and ETA, which would not come purely from GPS.
      - rootusrootus 7y ago
        Most/all international flights I've been on are really terrible at providing an accurate flight plan or ETA to the passengers via the entertainment system. I would not be surprised if it is already a manual update done when convenient by a member of the flight crew.
        tjr 7y ago
        Could be! I can safely say that not all such entertainment systems work that way, but I reckon it's possible that some do.
        dx034 7y ago
        They tend to use what's programmed in the FMS. Pilots will have the cleared route in there, even if they already know that they'll probably get several short cuts along the way.
      - goodcanadian 7y ago
        I have never seen one that showed a flight plan. They only had a straight-line (well, a great circle route) to the destination. ETA was pretty clearly straight-line distance divided by (average?) speed.
    - p_l 7y ago
      Data diodes are things that exist
- neom 7y ago
  Article feels like it's focused on breaching the critical systems rather than just trying to kernel panic/overflow/etc them. My concern would be that if you could mess with the ODN such that it could crash or disrupt the data flow of either the other two systems I suppose you might brick the plane (because they refer to a "bridge")? Who know though, maybe there are redundant systems that can handle multiple critical failures, article is so light on details.
- tlb 7y ago
  You want communications from the flight controls to the maintenance system. And you want communications from the entertainment system to the maintenance system, so technicians have a single list of everything that needs fixing. It's hard to implement strict one-way communications -- usually you at least need some kind of ACK for reliable transmission. Put all those together with a vulnerability in the middle, and you have an attack.
  - p_l 7y ago
    AFDX used by 787 has one way only communications, no ACKs are used or allowed (it actually uses UDP plus network proven to not lose packets)
  - vokep 7y ago
    But for things like an entertainment system, that's fine. If it fails, oh well.
- SilasX 7y ago
  Or to driving control! But, engineers keep making this mistake. Hackers were able to take over Jeeps via the entertainment system: https://www.bbc.com/news/technology-33650491 https://www.bbc.com/news/technology-33650491 HN discussion: https://news.ycombinator.com/item?id=9942647 https://news.ycombinator.com/item?id=9942647
  - jjtheblunt 7y ago
    Take over as in turn off, not steer, right?
    - SilasX 7y ago
      The article says “control” but doesn’t have a lot of specifics. In any case, for bad dudes that are pursuing you when people aren’t around, being able to shut down your car is just as bad as being able to control it.
      - blunte 7y ago
        Considering that cars are becoming more drive-by-wire, it's only a matter of time before a hacker will be able to actually steer a car or activate (or prevent activation of!) the brakes.
        userbinator 7y ago
        it's only a matter of time before a hacker will be able to actually steer a car or activate (or prevent activation of!) the brakes. A Tesla is the perfect example. The fact that it has self-driving---I mean, "assisted cruise control"---naturally means a computer can take over the controls entirely.
        blunte 7y ago
        I forget which car it was, but I watched a car review video recently where the presenter fussed about taking the (otherwise great) car to a track. Some of the assists couldn't be disabled, so going around the track he would occasionally have to fight the steering wheel when it would try to turn him a certain way to stay within a "lane".
- gumby 7y ago
  When you're trying to cut the BOM and weight, sharing a network can seem like a good idea. Also industries have cultures, and dunning-kruger often applies outside their core domains. For example: I did some work with Mercedes (no insult to them -- I've happily owned several of their cars). They were "real" engineers; the "schnook" of the door when it shut. The brake-by-wire folks modeled everything in Matlab, developed multiple implementations, But the entertainment system? It's not "real" engineering, so is typically subbed out to a canonical or cheapest bidder based on a powerpoint bullet list. The result: really really safe vehicle, but the user's actual experience (outside the driving) is not encouraging. Same issue with a BMW I had: ECU always kept the pollution within spec; the car always started instantly when I turned the key no matter the temperature or environment, but the seats and windows would move randomly. And we all suffer from this: when I worked on power plants I was (and remain) horrified by the shitshow that is SCADA and the HMI infrastructure many of the other "absurd" things I saw, well, some patient people would show me what an idiot I was and that there were very good reasons for doing things that looked to an outsider like headstands.
  - yc-kraln 7y ago
    Some of us are working to change that... :)
- alltakendamned 7y ago
  There’s no path, the guy is making invalid assumptions
- smileysteve 7y ago
  My thoughts when I realized I had a usb c phone and they had just implemented usb b; or when a device OR a whole row went out. An alcatel tablet and a mount is cheap; these are easily replaceable, etc. Also, makes upgrades to new processors and better displays easier. Honestly, with an OLED screen, if there was a good mount on the back of the headrest, I'd rather watch movies on my screen.
sushisource 7y ago
It seems insane that all this code isn't just open source by default. No one's going to be able to rip off airlines by stealing it, you still need to have a company that, you know, sells planes. Keeping it closed seems like a full admission that "there are probably a bunch of bugs in here and we don't want people to see them"
- std_throwaway 7y ago
  It's kind of the same reasoning why voting machines are closed source and can only be audited by authorized personnel.
  - empath75 7y ago
    So people can steal elections in peace?
    - std_throwaway 7y ago
      The point is that we don't know and we cannot check.
      - kevin_thibedeau 7y ago
        We do know that the "auditors" are unqualified to protect us.
  - mehrdadn 7y ago
    What is that reasoning?
    - basilgohar 7y ago
      It's less hassle than having your shoddy and/or backdoored code plainly visible to the whole world.
    - std_throwaway 7y ago
      Trade secret. Sorry, can't say any more.
MegaButts 7y ago
I feel like this is the kind of thing that would've been completely ignored by everybody except for a handful of concerned hackers had it not been for the recent media outrage against Boeing (and in my opinion absolutely deserved). I guess the question is how bad is it (from the article it's hard to tell exactly, but it sure doesn't sound great)? And another question is how many of our systems that we rely on, from bridges to airplanes to traffic lights, are just actually very insecure but either nobody notices or nobody exploits them? That said, Boeing's abysmal PR and completely blanket "it's not our fault" statements make me assume the worst here. I have no idea how that company will ever earn back my trust. But maybe they have enough regulatory capture, much like Equifax, that they just don't care.
- jquery 7y ago
  >I have no idea how that company will ever earn back my trust Millions of ongoing safe flights? I dunno. I feel like they're getting savaged (which they deserve... to a point... but we will cross that point I am pretty sure, if we haven't already...) The thousands (tens of thousands?) of safe flights per day don't make the news. Boeing has been a pioneer in the safest form of transportation in existence. Mentour Pilot (an active 737 pilot on YouTube) goes into detail about why he's not concerned about Boeing (any more than he's concerned about Airbus). I can also share a story from my (late) father who worked at Boeing from 30 years (and was working at Boeing during the MAX crashes). I asked him why Boeing let the 737-MAX debacle happen. These were a dying man's words (paraphrased): "Boeing wanted to ground the plane after the first 737-MAX crash but the FAA refused until after the second crash. Boeing did not have the authority to unilaterally ground the planes." Take that for what it's worth.
  - tempguy9999 7y ago
    If that quote is so[x], that casts a very deep shadow over the FAA. They've gone from handing off their responsibility for validation to outright rejecting the safety advice of the maker of the aircraft. [x] and I don't mean that to doubt you but I hope you understand I can't be absolute on this without verification
throw7 7y ago
...an FAA spokesperson wrote in a statement to WIRED that it's "satisfied with the manufacturer’s assessment of the issue." Can't help but read this as: "We don't have a clue and depend on the manufacturer to tell us everything is 5 by 5."
- magduf 7y ago
  The FAA was satisfied with Boeing's design for the 737MAX. Sorry, but I now have zero trust in the FAA.
  - blunte 7y ago
    Given in the US that corporations are allowed to contribute to political campaigns, and that one party has a very strong sense of "regulation is bad", there is intense pressure to deregulate as much as possible. And with the current administration and its choice to not staff many positions while cutting budgets (and while enacting executive orders to eliminate some regulations), the FAA is really unable to do anything. https://www.forbes.com/sites/marisagarcia/2019/03/18/did-trump-executive-orders-further-weaken-faa-oversight/ https://www.forbes.com/sites/marisagarcia/2019/03/18/did-tru...
    - magduf 7y ago
      That's not true, because they just did something: they said they were satisfied with Boeing here. They could have been honest and said "we're not competent to properly evaluate Boeing's design decisions".
      - blunte 7y ago
        But the mandate is that because of budget cuts, the FAA must depend on the manufacturers themselves to be the SMEs. Thus, they are asking Boeing to judge Boeing's own systems. If B says, "It's all good", and B is the SME, then FAA must agree and pass.
- p_l 7y ago
  Separation of IFE and avionics networks is something FAA actually chastised Boeing over during 787 design, and forced them to fully separate networks not VLAN crap.
camgunz 7y ago
I would assume in-flight entertainment is Level E and wasn't ever subjected to verification. And yeah that requires physical separation from higher-level systems. So... surprisingly I think I'm on Boeing's side here?
- tjr 7y ago
  The subsystem that connects in-flight entertainment to anything on the flight deck (assuming an intended one-way, read-only connection) would probably be Level D. I would guess that that subsystem is in error here.
- Rediscover 7y ago
  Verification: Yes, but to a lesser extent.
sagebird 7y ago
If I owned a 787, would I be likely to have the rights to lend it to security researchers to test the exploits, or would it be prohibited through a contract that Boeing requires customers to agree to? Is there a reason that an individual would own a 787 for personal use— eg - is it a plane that people change the interior layout for use as a private jet, or are these planes all tied up in commercial use? If I owned one, I would lend it to the researcher as I would want to know the flaws and risks more clearly.
- EvanAnderson 7y ago
  I'd love to see the software licensing agreement that comes w/ an airliner. I can only imagine it contains the same kind of anti-reverse-engineering clauses that accompany virtually all commercial software.
- ken 7y ago
  Drake owns a 767 [1], and the founders of Google own one [2]. A couple members of the Saudi Arabian royal family are reported to own 777s [3]. It's not inconceivable that an individual could own a 787, though I can't find any reference to one yet. I think, though, that the sort of person who owns one doesn't tend to want to tinker with it. You just hire someone to fly it, and know that it's always available. The difference between owning and renting, at that level, is mostly financials. Besides, even if you own the aircraft, it's likely you don't own the engines [4], and they're kind of an important component of the overall system. Likewise, I don't know anyone who owns a car who has loaned it to a researcher to analyze it for design flaws. A couple people have done it [5], but for the vast majority of owners, you just use it normally, and if something breaks, you deal with the problem then. Airplanes are loaded with redundancies for critical systems so a lot of things have to go wrong for it to crash. [1]: https://www.cbsnews.com/news/inside-air-drake-rapper-unveils-new-massive-767-plane-which-could-cost-more-than-187-million/ https://www.cbsnews.com/news/inside-air-drake-rapper-unveils... [2]: https://searchengineland.com/your-guide-to-the-google-jet-12161 https://searchengineland.com/your-guide-to-the-google-jet-12... [3]: https://www.private-jet-fan.com/private-jet-owners-register.html https://www.private-jet-fan.com/private-jet-owners-register.... [4]: https://www.quora.com/Do-some-airlines-not-own-the-engines-on-their-aircraft https://www.quora.com/Do-some-airlines-not-own-the-engines-o... [5]: https://www.washingtonpost.com/news/morning-mix/wp/2015/07/22/car-hacking-just-got-real-hackers-disable-suv-on-busy-highway/ https://www.washingtonpost.com/news/morning-mix/wp/2015/07/2...
msbarnett 7y ago
> But Boeing counters that it has both "additional protection mechanisms" in the CIS/MS that would prevent its bugs from being exploited from the ODN, and another hardware device between the semi-sensitive IDN—where the CIS/MS is located—and the highly sensitive CDN. That second barrier, the company argues, allows only data to pass from one part of the network to the other, rather than the executable commands that would be necessary to affect the plane's critical systems. Well geez, it's a good thing that there's no class of bugs in which a certain amount of data, maybe more than the receiver was expecting, or terminated in an odd way, overwhelms the receiver in such a way as to cause the data to then be interpreted as commands which are run in place of the receiver's code...
- madeofpalk 7y ago
  https://en.wikipedia.org/wiki/Qantas_Flight_72#Final_report https://en.wikipedia.org/wiki/Qantas_Flight_72#Final_report
  - tyingq 7y ago
    Interesting that they never found the root cause. I assume they fixed it by detecting symptoms since the cause is unknown.
    - blackflame7000 7y ago
      Air Disasters did an episode on this flight with interviews from the people that diagnosed the problem. https://www.smithsonianchannel.com/shows/air-disasters/free-fall/802/3467449 https://www.smithsonianchannel.com/shows/air-disasters/free-...
      - tyingq 7y ago
        Searched a bit more, and found this from 2018: "Experts are still not sure of the root cause of the malfunction in the data unit, but subsequent software changes by Airbus mean any similar error in the future won’t lead to another terrifying nosedive." https://www.news.com.au/travel/travel-updates/incidents/terror-on-flight-qf72-im-not-in-control-of-this-plane/news-story/1de13e8591fa845045f52ff4387cf98b https://www.news.com.au/travel/travel-updates/incidents/terr... Sounds like I guessed right.
draugadrotten 7y ago
From the article: "He was surprised to discover a fully unprotected server on Boeing's network, seemingly full of code designed to run on the company's giant 737 and 787 passenger jets, left publicly accessible and open to anyone who found it. So he downloaded everything he could see." Is that even legal? Will he ever be allowed to cross the US border after admitting this?
- ramimac 7y ago
  I'm surprised that IOActive backed him up on this, seems like it's treading a line that businesses normally are very conservative around. I very much expected him to be unaffiliated with a large organization after reading that.
- FDSGSG 7y ago
  Probably depends entirely on how annoyed Boeing are.
- SkyBelow 7y ago
  >Is that even legal? Generally no. There is a difference between being unprotected and being open to the public. While in some cases a person can claim to not have known and proving mens rea for such a crime is much harder than if it was protected and the protection had to be bypassed, it isn't impossible. Such laws are selectively enforced, but being this is Boeing, you can expect it will be enforced on their behalf if they have any desire for it to be (given the current PR issues and the impact this might have, they might let this one go, at least for the time being).
- scandox 7y ago
  Isn't this in itself a big story? How the hell are they being so lax with their source code?
hacker_9 7y ago
So people hack planes now. Well this is just great.
rwmj 7y ago
I'm slightly astonished that the 3 networks mentioned aren't airgapped. I suppose the entertainment system needs to know where the plane is in order to display the flight map, but that should be provided by a dumb serial link with the RX wire cut.
- rootusrootus 7y ago
  Heck, just a simple standalone GPS receiver would be perfectly adequate. Doesn't need to be particularly fancy, either, because if it fails nothing bad happens but a non-functional map.
- Rediscover 7y ago
  Receive only to my box on the 787. (Not the IFE, but rather a data gathering LRU for maint. and owners)
neffy 7y ago
Legacy code... https://www.tripwire.com/state-of-security/featured/boeing-757-hacked/ https://www.tripwire.com/state-of-security/featured/boeing-7...
PedroBatista 7y ago
The level of not giving a shit from Boeing and the FAA is astonishing.
- p_l 7y ago
  FAA actually gave a shit and forced Boeing to redesign when they tried to put through a shared network idea, since then the networks are, in fact, gapped.
- netsharc 7y ago
  But... it's a researcher making claims and assumptions but no working code... just because the target is Boeing doesn't mean the researcher might not be full of shit.
starpilot 7y ago
> To be clear, neither Savage nor Koscher believe that, based on Santamarta's findings alone, a hacker could cause any immediate danger to an aircraft or its passengers. "This is a long way from an imminent safety threat. Based on what they have now, I think you could let the IOActive guys run amok on a 787 and I'd still be comfortable flying on it," Savage says. "But Boeing has work to do."
chovy 7y ago
Honestly, if the airline industry partakes in agile development I will not be flying anymore.
- taloft 7y ago
  Too late.
solotronics 7y ago
Would planes be more or less safe if all the code was required to be put in the public domain? I would think more.
- qekbg 7y ago
  I think the obvious answer is "less safe at first, safer in the long term". Only that a plane is not something you want to ever be less safe, so it's a risk that might not be worth taking
danek 7y ago
Boeing: “We investigated ourselves and determined there is no issue”
bsaul 7y ago
Don't people here think that if boeing ever get over the current set of investigation without collapsing they're going to create the safest plane ever designed ? With the amount of scrutiny they're encountering at the moment i have the feeling every single dark corner is going to be under the spotlight.. Or is the reason too deep, the whole corporate structure too rotten at the core, that there's no hope ?
- hbosch 7y ago
  Well, either that is true or the inherently flawed plane design that has been patched with software kills another 346 human beings. I would personally prefer to sit this experiment out for the rest of my life. Unfortunately, airlines don't make it easy for me to "opt out" of flying on specific airplanes.
- brokenmachine 7y ago
  The larger problem that the FAA doesn't have the capability to actually check Boeing's safety claims, so are forced to take their word for it. Funding hasn't dramatically changed for the FAA, so won't it just be more of the same? "We've fixed the AOA sensor problems (again). Trust us, our engineers have deemed it safe!"
drummyfish 7y ago
Nice to read an article that's covered in 20 billion ads, great experience.
- jmkni 7y ago
  uBlock Origin blocks 35 (26% of) requests on that page
BubRoss 7y ago
Almost seems like this source should be open.
cryptozeus 7y ago
I wondered how much part some kind of hack played into downing these planes.
jiggawatts 7y ago
My $0.02: I came across Boeing's documentation for their "Boeing Update" solution. (think Windows Update, but for 787s). It described in detail how the planes are updated with new firmware for the avionics, entertainment system, and the engines. I was shocked to learn that the 787 uses a lot of COTS kit internally, such as standard WiFi and Ethernet connections. There's an RJ-45 jack at the front landing gear accessible from the outside of the plane at any time! It was by far the best technical document I have ever read, of any type, ever by at least a factor of ten. It was so good I read it like a novel. Twice. The security design was amazing. The PKI was amazing. The patch management was amazing. The network design was amazing. The documentation was amazing. My estimate was the the document alone would have cost multiple millions of dollars to write, not including any of the engineering work that went into the solution itself. Boeing's engineers thought of everything. EVERYTHING. This scenario was catered for: - The plane is rented, not owned. - The IT department is outsourced. - Aircraft maintenance is outsourced. - The plane is currently on the ground in a country that is hostile. - A critical update has been released, without which the plane is unsafe to fly. This is one of the scenarios that is literally spelled out, in plain English, and you're left completely certain that the update will be safe and secure despite all of that. The security is just nuts. Everything uses explicit, hardcoded whitelists. TLS is bidirectional (clients are verified by the servers too). Patches must be quadruple signed by Boing, the parts manufacturer, the FAA, and the airline at a minimum to be acceptable. There are physical connection breakers and PIN codes on top of that. There are two nested VPNs on top of the already encrypted WiFi. It just goes on and on. No part of it left me thinking they could have done better. I've used that document as a template for my own work, and it's the better for it. Since then, I've insisted on flying 787s whenever possible, because I'm certain that the engineering effort that has gone into those things is about as good as humanly possible.
- profile53 7y ago
  That sounds like a fascinating read -- do you happen to have a link to the document (or even a title for it) if it's publicly available? A preliminary Google search turned up nothing
- heliodor 7y ago
  > "No part of it left me thinking they could have done better." Do you have the knowledge required in order to judge that? > I've insisted on flying 787s whenever possible, because I'm certain that the engineering effort that has gone into those things is about as good as humanly possible. Have you compared it to the other Boeing airplanes? To Airbus airplanes? Bombardier? Embraer? The new Mitsubishi airplane?
snowwindwaves 7y ago
The article says the 787 runs VxWorks which has just had a number of vulnerabilities identified in the tcp/ip stack.
neop1x 7y ago
I would be interested to know how today's internet-connected cars are prevented from remote exploitation. I wish they at least separated steering wheel servo controls from infotainment and remote access but I have no way to verify it...
jpgrace 7y ago
Is nobody going mention the irony that the source code was discovered because of a misconfiguration and Boeing is claiming that these vulnerabilities aren’t important because of their secure configuration?

391 points by samuell 7y ago

kps 7y ago

Who thought that having any communication path from the passenger entertainment system to flight control was a good idea?

tjr 7y ago
Connecting entertainment systems to flight control sounds very wrong. Connecting entertainment systems to flight management would be common; it should be one-way communication (entertainment can only read FMS data, not send any), for the purpose of driving the moving map displays for passengers.
- toomuchtodo 7y ago
  > it should be one-way communication (entertainment can only read FMS data, not send any), for the purpose of driving the moving map displays for passengers. Would you agree that this logical boundary should be physically enforced? Such as an opto-isolator?
  - amluto 7y ago
    No fancy circuitry is needed. Just use one fiber. I suspect that 100BASE-T can pull this off with one pair and some hackery. RS232 should work work only one direction connected.
    - deleted 7y ago
      [deleted]
  - debatem1 7y ago
    Used to be done with a literal diode.
    - kps 7y ago
      Well, an optoisolator is a literal diode plus a literal transistor. I'm okay with that much hi tech.
    - basilgohar 7y ago
      The funny thing is that LEDs (granted, not all types of diodes) can be used to read data as well as transmit it. Videos of such interfaces can be found on YouTube. So, they are not as one-way as some folks may think. https://youtu.be/aLP-OF4nesY https://youtu.be/aLP-OF4nesY
      - temac 7y ago
        Well it can not only be a LED that is supposed to be one-way, but the whole circuitry driving it. Likewise for the receptor. With some appropriate review of the physical design, you can have a reasonable expectation that the comm will be limited to one-way, with no way for arbitrary SW to modify the direction.
      - debatem1 7y ago
        Usually wasn't an LED. Just a normal diode.
  - henryfjordan 7y ago
    > Boeing maintains that other security barriers in the 787's network architecture would make that progression impossible. They probably do something to that effect
    - toomuchtodo 7y ago
      The longer I'm alive the more firmly I commit to never assume anything. I have seen things. Terrible things.
      - p_l 7y ago
        Connectivity between zones is something FAA actually caught in 787 when it was still being built and forced a redesign.
    - snickerbockers 7y ago
      "security barrier" is a vague, meaningless phrase that they don't define. There shouldn't be any connection at all between flight systems and the in-flight entertainment.
  - tjr 7y ago
    Yes.
  - mjevans 7y ago
    There should actually be three distinct "air-gaped" networks (or at least classifications of network). Secure: The network that connects and controls the airplane. Absolutely only essential things allowed on, and if possible isolated using mathematically proven secure vlan/isolation techniques. "Employee": pilots, crew, etc. This is more just a distinct network for corporate operations security. "Customer": Still try to keep this one secure so that virus and just don't spread, but this is the 'DMZ' area. Communication from the secure network should be outbound only, and might best be done over a fixed rate serial data connection of some sort. The modern version might be to configure a point to point network link on a CDMA based system and just disconnect the secure side's RX path entirely. Then you just export the data blind via UDP with like 10X redundancy.
    - stefan_ 7y ago
      Most Boeing planes (though not the 787 discussed here) don't use fly-by-wire, so you could argue that the most essential control plane is perfectly isolated by virtue of not having any sort of network at all, just hydraulics into the cabin.
      - blunte 7y ago
        But wasn't the 737-max issue that a software system was forcing an elevator change to pitch the nose down? That sounds pretty fly-by-wire (even if hydraulics are involved).
        p_l 7y ago
        You could say that the problem was lack of fly-by-wire - if 737-MAX had FBW, the necessary corrections would be bundled as part of flight envelope protection, and that tends to work pretty well and the required checks on FBW systems would catch stuff like "only one AoA sensor used". Instead we got MCAS which was messing with autotrim signals and escaped scrutiny.
  - yc-kraln 7y ago
    This sounds like a good idea, until you realize that the head unit is typically the thing in the car with the most computing power (think AI workloads as well as a GPU and multiple ARM cores) and the thing in the car with the network connection. A trivial use case which requires write access to the CAN bus is the navigation system informing cruise control of an upcoming hill. Equally trivial would be the seat position memory or profiles being applied through the main touchscreen. (I work for a company that is developing infotainment systmes)
- usrusr 7y ago
  The moving map could easily be fed from a separated consumer grade GPS. Same for all other metrics that the median passenger would care about (height, speed over ground), except for the ever-impressive outside temperature.
  - tjr 7y ago
    Outside temperature is pretty impressive indeed. The map also shows projected flight plan and ETA, which would not come purely from GPS.
    - rootusrootus 7y ago
      Most/all international flights I've been on are really terrible at providing an accurate flight plan or ETA to the passengers via the entertainment system. I would not be surprised if it is already a manual update done when convenient by a member of the flight crew.
      - tjr 7y ago
        Could be! I can safely say that not all such entertainment systems work that way, but I reckon it's possible that some do.
      - dx034 7y ago
        They tend to use what's programmed in the FMS. Pilots will have the cleared route in there, even if they already know that they'll probably get several short cuts along the way.
    - goodcanadian 7y ago
      I have never seen one that showed a flight plan. They only had a straight-line (well, a great circle route) to the destination. ETA was pretty clearly straight-line distance divided by (average?) speed.
  - p_l 7y ago
    Data diodes are things that exist
neom 7y ago
Article feels like it's focused on breaching the critical systems rather than just trying to kernel panic/overflow/etc them. My concern would be that if you could mess with the ODN such that it could crash or disrupt the data flow of either the other two systems I suppose you might brick the plane (because they refer to a "bridge")? Who know though, maybe there are redundant systems that can handle multiple critical failures, article is so light on details.
tlb 7y ago
You want communications from the flight controls to the maintenance system. And you want communications from the entertainment system to the maintenance system, so technicians have a single list of everything that needs fixing. It's hard to implement strict one-way communications -- usually you at least need some kind of ACK for reliable transmission. Put all those together with a vulnerability in the middle, and you have an attack.
- p_l 7y ago
  AFDX used by 787 has one way only communications, no ACKs are used or allowed (it actually uses UDP plus network proven to not lose packets)
- vokep 7y ago
  But for things like an entertainment system, that's fine. If it fails, oh well.
SilasX 7y ago
Or to driving control! But, engineers keep making this mistake. Hackers were able to take over Jeeps via the entertainment system: https://www.bbc.com/news/technology-33650491 https://www.bbc.com/news/technology-33650491 HN discussion: https://news.ycombinator.com/item?id=9942647 https://news.ycombinator.com/item?id=9942647
- jjtheblunt 7y ago
  Take over as in turn off, not steer, right?
  - SilasX 7y ago
    The article says “control” but doesn’t have a lot of specifics. In any case, for bad dudes that are pursuing you when people aren’t around, being able to shut down your car is just as bad as being able to control it.
    - blunte 7y ago
      Considering that cars are becoming more drive-by-wire, it's only a matter of time before a hacker will be able to actually steer a car or activate (or prevent activation of!) the brakes.
      - userbinator 7y ago
        it's only a matter of time before a hacker will be able to actually steer a car or activate (or prevent activation of!) the brakes. A Tesla is the perfect example. The fact that it has self-driving---I mean, "assisted cruise control"---naturally means a computer can take over the controls entirely.
        blunte 7y ago
        I forget which car it was, but I watched a car review video recently where the presenter fussed about taking the (otherwise great) car to a track. Some of the assists couldn't be disabled, so going around the track he would occasionally have to fight the steering wheel when it would try to turn him a certain way to stay within a "lane".
gumby 7y ago
When you're trying to cut the BOM and weight, sharing a network can seem like a good idea. Also industries have cultures, and dunning-kruger often applies outside their core domains. For example: I did some work with Mercedes (no insult to them -- I've happily owned several of their cars). They were "real" engineers; the "schnook" of the door when it shut. The brake-by-wire folks modeled everything in Matlab, developed multiple implementations, But the entertainment system? It's not "real" engineering, so is typically subbed out to a canonical or cheapest bidder based on a powerpoint bullet list. The result: really really safe vehicle, but the user's actual experience (outside the driving) is not encouraging. Same issue with a BMW I had: ECU always kept the pollution within spec; the car always started instantly when I turned the key no matter the temperature or environment, but the seats and windows would move randomly. And we all suffer from this: when I worked on power plants I was (and remain) horrified by the shitshow that is SCADA and the HMI infrastructure many of the other "absurd" things I saw, well, some patient people would show me what an idiot I was and that there were very good reasons for doing things that looked to an outsider like headstands.
- yc-kraln 7y ago
  Some of us are working to change that... :)
alltakendamned 7y ago
There’s no path, the guy is making invalid assumptions
smileysteve 7y ago
My thoughts when I realized I had a usb c phone and they had just implemented usb b; or when a device OR a whole row went out. An alcatel tablet and a mount is cheap; these are easily replaceable, etc. Also, makes upgrades to new processors and better displays easier. Honestly, with an OLED screen, if there was a good mount on the back of the headrest, I'd rather watch movies on my screen.

sushisource 7y ago

It seems insane that all this code isn't just open source by default. No one's going to be able to rip off airlines by stealing it, you still need to have a company that, you know, sells planes. Keeping it closed seems like a full admission that "there are probably a bunch of bugs in here and we don't want people to see them"

std_throwaway 7y ago
It's kind of the same reasoning why voting machines are closed source and can only be audited by authorized personnel.
- empath75 7y ago
  So people can steal elections in peace?
  - std_throwaway 7y ago
    The point is that we don't know and we cannot check.
    - kevin_thibedeau 7y ago
      We do know that the "auditors" are unqualified to protect us.
- mehrdadn 7y ago
  What is that reasoning?
  - basilgohar 7y ago
    It's less hassle than having your shoddy and/or backdoored code plainly visible to the whole world.
  - std_throwaway 7y ago
    Trade secret. Sorry, can't say any more.

MegaButts 7y ago

I feel like this is the kind of thing that would've been completely ignored by everybody except for a handful of concerned hackers had it not been for the recent media outrage against Boeing (and in my opinion absolutely deserved). I guess the question is how bad is it (from the article it's hard to tell exactly, but it sure doesn't sound great)? And another question is how many of our systems that we rely on, from bridges to airplanes to traffic lights, are just actually very insecure but either nobody notices or nobody exploits them? That said, Boeing's abysmal PR and completely blanket "it's not our fault" statements make me assume the worst here. I have no idea how that company will ever earn back my trust. But maybe they have enough regulatory capture, much like Equifax, that they just don't care.

jquery 7y ago
>I have no idea how that company will ever earn back my trust Millions of ongoing safe flights? I dunno. I feel like they're getting savaged (which they deserve... to a point... but we will cross that point I am pretty sure, if we haven't already...) The thousands (tens of thousands?) of safe flights per day don't make the news. Boeing has been a pioneer in the safest form of transportation in existence. Mentour Pilot (an active 737 pilot on YouTube) goes into detail about why he's not concerned about Boeing (any more than he's concerned about Airbus). I can also share a story from my (late) father who worked at Boeing from 30 years (and was working at Boeing during the MAX crashes). I asked him why Boeing let the 737-MAX debacle happen. These were a dying man's words (paraphrased): "Boeing wanted to ground the plane after the first 737-MAX crash but the FAA refused until after the second crash. Boeing did not have the authority to unilaterally ground the planes." Take that for what it's worth.
- tempguy9999 7y ago
  If that quote is so[x], that casts a very deep shadow over the FAA. They've gone from handing off their responsibility for validation to outright rejecting the safety advice of the maker of the aircraft. [x] and I don't mean that to doubt you but I hope you understand I can't be absolute on this without verification

throw7 7y ago

...an FAA spokesperson wrote in a statement to WIRED that it's "satisfied with the manufacturer’s assessment of the issue." Can't help but read this as: "We don't have a clue and depend on the manufacturer to tell us everything is 5 by 5."

magduf 7y ago
The FAA was satisfied with Boeing's design for the 737MAX. Sorry, but I now have zero trust in the FAA.
- blunte 7y ago
  Given in the US that corporations are allowed to contribute to political campaigns, and that one party has a very strong sense of "regulation is bad", there is intense pressure to deregulate as much as possible. And with the current administration and its choice to not staff many positions while cutting budgets (and while enacting executive orders to eliminate some regulations), the FAA is really unable to do anything. https://www.forbes.com/sites/marisagarcia/2019/03/18/did-trump-executive-orders-further-weaken-faa-oversight/ https://www.forbes.com/sites/marisagarcia/2019/03/18/did-tru...
  - magduf 7y ago
    That's not true, because they just did something: they said they were satisfied with Boeing here. They could have been honest and said "we're not competent to properly evaluate Boeing's design decisions".
    - blunte 7y ago
      But the mandate is that because of budget cuts, the FAA must depend on the manufacturers themselves to be the SMEs. Thus, they are asking Boeing to judge Boeing's own systems. If B says, "It's all good", and B is the SME, then FAA must agree and pass.
p_l 7y ago
Separation of IFE and avionics networks is something FAA actually chastised Boeing over during 787 design, and forced them to fully separate networks not VLAN crap.

camgunz 7y ago

I would assume in-flight entertainment is Level E and wasn't ever subjected to verification. And yeah that requires physical separation from higher-level systems. So... surprisingly I think I'm on Boeing's side here?

tjr 7y ago
The subsystem that connects in-flight entertainment to anything on the flight deck (assuming an intended one-way, read-only connection) would probably be Level D. I would guess that that subsystem is in error here.
Rediscover 7y ago
Verification: Yes, but to a lesser extent.

sagebird 7y ago

If I owned a 787, would I be likely to have the rights to lend it to security researchers to test the exploits, or would it be prohibited through a contract that Boeing requires customers to agree to? Is there a reason that an individual would own a 787 for personal use— eg - is it a plane that people change the interior layout for use as a private jet, or are these planes all tied up in commercial use? If I owned one, I would lend it to the researcher as I would want to know the flaws and risks more clearly.

EvanAnderson 7y ago
I'd love to see the software licensing agreement that comes w/ an airliner. I can only imagine it contains the same kind of anti-reverse-engineering clauses that accompany virtually all commercial software.
ken 7y ago
Drake owns a 767 [1], and the founders of Google own one [2]. A couple members of the Saudi Arabian royal family are reported to own 777s [3]. It's not inconceivable that an individual could own a 787, though I can't find any reference to one yet. I think, though, that the sort of person who owns one doesn't tend to want to tinker with it. You just hire someone to fly it, and know that it's always available. The difference between owning and renting, at that level, is mostly financials. Besides, even if you own the aircraft, it's likely you don't own the engines [4], and they're kind of an important component of the overall system. Likewise, I don't know anyone who owns a car who has loaned it to a researcher to analyze it for design flaws. A couple people have done it [5], but for the vast majority of owners, you just use it normally, and if something breaks, you deal with the problem then. Airplanes are loaded with redundancies for critical systems so a lot of things have to go wrong for it to crash. [1]: https://www.cbsnews.com/news/inside-air-drake-rapper-unveils-new-massive-767-plane-which-could-cost-more-than-187-million/ https://www.cbsnews.com/news/inside-air-drake-rapper-unveils... [2]: https://searchengineland.com/your-guide-to-the-google-jet-12161 https://searchengineland.com/your-guide-to-the-google-jet-12... [3]: https://www.private-jet-fan.com/private-jet-owners-register.html https://www.private-jet-fan.com/private-jet-owners-register.... [4]: https://www.quora.com/Do-some-airlines-not-own-the-engines-on-their-aircraft https://www.quora.com/Do-some-airlines-not-own-the-engines-o... [5]: https://www.washingtonpost.com/news/morning-mix/wp/2015/07/22/car-hacking-just-got-real-hackers-disable-suv-on-busy-highway/ https://www.washingtonpost.com/news/morning-mix/wp/2015/07/2...

msbarnett 7y ago

> But Boeing counters that it has both "additional protection mechanisms" in the CIS/MS that would prevent its bugs from being exploited from the ODN, and another hardware device between the semi-sensitive IDN—where the CIS/MS is located—and the highly sensitive CDN. That second barrier, the company argues, allows only data to pass from one part of the network to the other, rather than the executable commands that would be necessary to affect the plane's critical systems. Well geez, it's a good thing that there's no class of bugs in which a certain amount of data, maybe more than the receiver was expecting, or terminated in an odd way, overwhelms the receiver in such a way as to cause the data to then be interpreted as commands which are run in place of the receiver's code...

madeofpalk 7y ago
https://en.wikipedia.org/wiki/Qantas_Flight_72#Final_report https://en.wikipedia.org/wiki/Qantas_Flight_72#Final_report
- tyingq 7y ago
  Interesting that they never found the root cause. I assume they fixed it by detecting symptoms since the cause is unknown.
  - blackflame7000 7y ago
    Air Disasters did an episode on this flight with interviews from the people that diagnosed the problem. https://www.smithsonianchannel.com/shows/air-disasters/free-fall/802/3467449 https://www.smithsonianchannel.com/shows/air-disasters/free-...
    - tyingq 7y ago
      Searched a bit more, and found this from 2018: "Experts are still not sure of the root cause of the malfunction in the data unit, but subsequent software changes by Airbus mean any similar error in the future won’t lead to another terrifying nosedive." https://www.news.com.au/travel/travel-updates/incidents/terror-on-flight-qf72-im-not-in-control-of-this-plane/news-story/1de13e8591fa845045f52ff4387cf98b https://www.news.com.au/travel/travel-updates/incidents/terr... Sounds like I guessed right.

draugadrotten 7y ago

From the article: "He was surprised to discover a fully unprotected server on Boeing's network, seemingly full of code designed to run on the company's giant 737 and 787 passenger jets, left publicly accessible and open to anyone who found it. So he downloaded everything he could see." Is that even legal? Will he ever be allowed to cross the US border after admitting this?

ramimac 7y ago
I'm surprised that IOActive backed him up on this, seems like it's treading a line that businesses normally are very conservative around. I very much expected him to be unaffiliated with a large organization after reading that.
FDSGSG 7y ago
Probably depends entirely on how annoyed Boeing are.
SkyBelow 7y ago
>Is that even legal? Generally no. There is a difference between being unprotected and being open to the public. While in some cases a person can claim to not have known and proving mens rea for such a crime is much harder than if it was protected and the protection had to be bypassed, it isn't impossible. Such laws are selectively enforced, but being this is Boeing, you can expect it will be enforced on their behalf if they have any desire for it to be (given the current PR issues and the impact this might have, they might let this one go, at least for the time being).
scandox 7y ago
Isn't this in itself a big story? How the hell are they being so lax with their source code?

hacker_9 7y ago

So people hack planes now. Well this is just great.

rwmj 7y ago

I'm slightly astonished that the 3 networks mentioned aren't airgapped. I suppose the entertainment system needs to know where the plane is in order to display the flight map, but that should be provided by a dumb serial link with the RX wire cut.

rootusrootus 7y ago
Heck, just a simple standalone GPS receiver would be perfectly adequate. Doesn't need to be particularly fancy, either, because if it fails nothing bad happens but a non-functional map.
Rediscover 7y ago
Receive only to my box on the 787. (Not the IFE, but rather a data gathering LRU for maint. and owners)

neffy 7y ago

Legacy code... https://www.tripwire.com/state-of-security/featured/boeing-757-hacked/ https://www.tripwire.com/state-of-security/featured/boeing-7...

PedroBatista 7y ago

The level of not giving a shit from Boeing and the FAA is astonishing.

p_l 7y ago
FAA actually gave a shit and forced Boeing to redesign when they tried to put through a shared network idea, since then the networks are, in fact, gapped.
netsharc 7y ago
But... it's a researcher making claims and assumptions but no working code... just because the target is Boeing doesn't mean the researcher might not be full of shit.

starpilot 7y ago

> To be clear, neither Savage nor Koscher believe that, based on Santamarta's findings alone, a hacker could cause any immediate danger to an aircraft or its passengers. "This is a long way from an imminent safety threat. Based on what they have now, I think you could let the IOActive guys run amok on a 787 and I'd still be comfortable flying on it," Savage says. "But Boeing has work to do."

chovy 7y ago

Honestly, if the airline industry partakes in agile development I will not be flying anymore.

taloft 7y ago
Too late.

solotronics 7y ago

Would planes be more or less safe if all the code was required to be put in the public domain? I would think more.

qekbg 7y ago
I think the obvious answer is "less safe at first, safer in the long term". Only that a plane is not something you want to ever be less safe, so it's a risk that might not be worth taking

danek 7y ago

Boeing: “We investigated ourselves and determined there is no issue”

bsaul 7y ago

Don't people here think that if boeing ever get over the current set of investigation without collapsing they're going to create the safest plane ever designed ? With the amount of scrutiny they're encountering at the moment i have the feeling every single dark corner is going to be under the spotlight.. Or is the reason too deep, the whole corporate structure too rotten at the core, that there's no hope ?

hbosch 7y ago
Well, either that is true or the inherently flawed plane design that has been patched with software kills another 346 human beings. I would personally prefer to sit this experiment out for the rest of my life. Unfortunately, airlines don't make it easy for me to "opt out" of flying on specific airplanes.
brokenmachine 7y ago
The larger problem that the FAA doesn't have the capability to actually check Boeing's safety claims, so are forced to take their word for it. Funding hasn't dramatically changed for the FAA, so won't it just be more of the same? "We've fixed the AOA sensor problems (again). Trust us, our engineers have deemed it safe!"

drummyfish 7y ago

Nice to read an article that's covered in 20 billion ads, great experience.

jmkni 7y ago
uBlock Origin blocks 35 (26% of) requests on that page

BubRoss 7y ago

Almost seems like this source should be open.

cryptozeus 7y ago

I wondered how much part some kind of hack played into downing these planes.

jiggawatts 7y ago

My $0.02: I came across Boeing's documentation for their "Boeing Update" solution. (think Windows Update, but for 787s). It described in detail how the planes are updated with new firmware for the avionics, entertainment system, and the engines. I was shocked to learn that the 787 uses a lot of COTS kit internally, such as standard WiFi and Ethernet connections. There's an RJ-45 jack at the front landing gear accessible from the outside of the plane at any time! It was by far the best technical document I have ever read, of any type, ever by at least a factor of ten. It was so good I read it like a novel. Twice. The security design was amazing. The PKI was amazing. The patch management was amazing. The network design was amazing. The documentation was amazing. My estimate was the the document alone would have cost multiple millions of dollars to write, not including any of the engineering work that went into the solution itself. Boeing's engineers thought of everything. EVERYTHING. This scenario was catered for: - The plane is rented, not owned. - The IT department is outsourced. - Aircraft maintenance is outsourced. - The plane is currently on the ground in a country that is hostile. - A critical update has been released, without which the plane is unsafe to fly. This is one of the scenarios that is literally spelled out, in plain English, and you're left completely certain that the update will be safe and secure despite all of that. The security is just nuts. Everything uses explicit, hardcoded whitelists. TLS is bidirectional (clients are verified by the servers too). Patches must be quadruple signed by Boing, the parts manufacturer, the FAA, and the airline at a minimum to be acceptable. There are physical connection breakers and PIN codes on top of that. There are two nested VPNs on top of the already encrypted WiFi. It just goes on and on. No part of it left me thinking they could have done better. I've used that document as a template for my own work, and it's the better for it. Since then, I've insisted on flying 787s whenever possible, because I'm certain that the engineering effort that has gone into those things is about as good as humanly possible.

profile53 7y ago
That sounds like a fascinating read -- do you happen to have a link to the document (or even a title for it) if it's publicly available? A preliminary Google search turned up nothing
heliodor 7y ago
> "No part of it left me thinking they could have done better." Do you have the knowledge required in order to judge that? > I've insisted on flying 787s whenever possible, because I'm certain that the engineering effort that has gone into those things is about as good as humanly possible. Have you compared it to the other Boeing airplanes? To Airbus airplanes? Bombardier? Embraer? The new Mitsubishi airplane?

snowwindwaves 7y ago

The article says the 787 runs VxWorks which has just had a number of vulnerabilities identified in the tcp/ip stack.

neop1x 7y ago

I would be interested to know how today's internet-connected cars are prevented from remote exploitation. I wish they at least separated steering wheel servo controls from infotainment and remote access but I have no way to verify it...

jpgrace 7y ago

Is nobody going mention the irony that the source code was discovered because of a misconfiguration and Boeing is claiming that these vulnerabilities aren’t important because of their secure configuration?