8 ms·

> But Boeing counters that it has both "additional protection mechanisms" in the CIS/MS that would prevent its bugs from being exploited from the ODN, and anoth

> But Boeing counters that it has both "additional protection mechanisms" in the CIS/MS that would prevent its bugs from being exploited from the ODN, and another hardware device between the semi-sensitive IDN—where the CIS/MS is located—and the highly sensitive CDN. That second barrier, the company argues, allows only data to pass from one part of the network to the other, rather than the executable commands that would be necessary to affect the plane's critical systems. Well geez, it's a good thing that there's no class of bugs in which a certain amount of data, maybe more than the receiver was expecting, or terminated in an odd way, overwhelms the receiver in such a way as to cause the data to then be interpreted as commands which are run in place of the receiver's code...

madeofpalk 7y ago
https://en.wikipedia.org/wiki/Qantas_Flight_72#Final_report https://en.wikipedia.org/wiki/Qantas_Flight_72#Final_report
- tyingq 7y ago
  Interesting that they never found the root cause. I assume they fixed it by detecting symptoms since the cause is unknown.
  - blackflame7000 7y ago
    Air Disasters did an episode on this flight with interviews from the people that diagnosed the problem. https://www.smithsonianchannel.com/shows/air-disasters/free-fall/802/3467449 https://www.smithsonianchannel.com/shows/air-disasters/free-...
    - tyingq 7y ago
      Searched a bit more, and found this from 2018: "Experts are still not sure of the root cause of the malfunction in the data unit, but subsequent software changes by Airbus mean any similar error in the future won’t lead to another terrifying nosedive." https://www.news.com.au/travel/travel-updates/incidents/terror-on-flight-qf72-im-not-in-control-of-this-plane/news-story/1de13e8591fa845045f52ff4387cf98b https://www.news.com.au/travel/travel-updates/incidents/terr... Sounds like I guessed right.
      - taneq 7y ago
        Wow, "we don't know what went wrong but we're certain we fixed it!" That's nice and convincing...
        teddyuk 7y ago
        and almost always turns out to be false :)
        AstralStorm 7y ago
        Nah. It's more like "we've added a permanent workaround".
        madeofpalk 7y ago
        Well I mean, there was two problems with that flight: 1) There was erroneous data 2) The erroneous data caused the plane to suddenly nosedive 2 was fixed - it's known why it dived and they fixed that from happening again. They still don't know what caused 1.
DC-3 7y ago
So you're saying.... rewrite it in Rust?
- samuell 7y ago
  Or, Ada, no? :)
  - kevin_thibedeau 7y ago
    Shhh. Let the new kids enjoy their smug.
    - DoofusOfDeath 7y ago
      > Shhh. Let the new kids enjoy their smug. Agreed. They need to discover on their own that critical software requires coq. </kidding> ... </i-think>
      - quickthrower2 7y ago
        Coq is great. Now the problem is developers having the sharpest, greatest tools but not understanding the spec, or working to a stupid spec and not calling it out.
    - fdhfqbu 7y ago
      I've done security auditing of ADA and C avionics code. (including for DAL-A components). As a language, I'd take Rust any day (in terms of security/robustness properties). However, the rust/LLVM compiler pipeline is nowhere near mature enough for use in high-criticality environments.
      - deleted 7y ago
        [deleted]
      - winter_blue 7y ago
        > However, the rust/LLVM compiler pipeline is nowhere near mature enough for use in high-criticality environments. I don't know about Rust, but LLVM isn't mature? Nearly ever program running in the Apple ecosystem was compiled using LLVM. Swift is compiled using LLVM. Since Xcode 4.2, Clang is the default compiler. So iOS and macOS apps are built with LLVM. I'd also wager a guess that Apple uses Clang to compile key system code (Darwin, macOS, and iOS, etc) as well.
AmericanChopper 7y ago
Every exploit payload is comprised entirely of data, so I think you’re even giving them too much credit there... The thing that triggered me the most was that they got the engineers who wrote the code to test it, and report back that their own code was fine. From the sound of it they didn’t even test the vulnerability, they just did an external test, without specifically testing the segmentation controls or the components in question.
- mark-r 7y ago
  They probably rely on network segmentation to keep the various components separated. If they consider the segmentation to be 100% effective, there'd be no need to do the kind of in-depth testing you advocate. I don't think it's justifiable to assume that segmentation doesn't have its own bugs that could be exploited.
  - AmericanChopper 7y ago
    Yeah, that seems to be what their attitude is. I have a couple of major issues with that though. 1. Relying on segmentation to protect vulnerable components is not a reasonable standard operating procedure. Segmentation is supposed to be an additional layer of protection, you’re also supposed to secure individual components. 2. It seems as though the researcher believed there may have been a way to bypass some of the segmentation (the segmentation between the medium-sensitive network and the highly-sensitive network). The article kinda implies that they didn’t test that layer of segmentation, that they only tested the most external layer (the segmentation between the non-sensitive network and the medium-sensitive network). The whole response comes across as dismissive spin, that they hope will be consumed by people who don’t have a particularly sophisticated understanding of network/application security.
- dreamcompiler 7y ago
  Yeah, this is ridiculous. A real red team does not involve engineers testing their own code. The fact that they couldn't break it means nothing.
alltakendamned 7y ago
Data diodes. Call me when you bypass them, I have a job for you.
- icebraining 7y ago
  Data dioses don't prevent malicious data that exploits vulnerabilities and takes over from being transmitted, they only prevent the malware from communicating back.
  - upofadown 7y ago
    But if you are on the side that receives... Which would be the case here, wouldn't it?
  - alltakendamned 7y ago
    No that’s exactly what it does, it enforces one way communication from your high privileged domain to your less privileged domain. And your IFE or crew system is in the less privileged one.
  - snovv_crash 7y ago
    It turns a black box into black hole, making it basically impossible to hack unless you have prior knowledge of what is on the other side.
    - lordlimecat 7y ago
      Security through obscurity! And I'm sure it will thwart nation state actors with potential access to the system in question.
  - kakwa_ 7y ago
    Yes and no. Data diode can be put either ways, with different results: * case 1, you allow traffic to only go out: This way, nothing can come inside the system, but the system can export data. Here basically, confidentiality is of secondary importance, but integrity is crucial. It is the Biba model. It can be seen on Command and Control systems for critical industrial installation for example. For example, with power plants C&C system must avoid to be hacked, but exporting to other systems data such as their power output and operational condition is generally required. * case 2, you allow traffic to only go in: This way, the system can ingest data from the outside, but nothing goes out. Here basically, confidentiality is primordial, integrity a bit less. It's the Bell-LaPadula model. It can be seen in Military intelligence systems for example. Here you collect pieces of information and you make decisions on them, and all that must be kept confidential. To summarize: * One way: you enforce integrity * The other: you enforce confidentiality As an ending note, data diodes are generally pretty simple: basically you take a fiber with TX and RX link, and you cut one. There are a few more tricks (UDP only, sending multiple times because you don't have ACKs, static ARP tables, tricking the NIC into thinking it's up without signal), but that's the core of it.
panarky 7y ago
Boeingspeak: "IOActive's scenarios cannot affect any critical or essential airplane system and do not describe a way for remote attackers to access important 787 systems like the avionics system." English: "This random guy on the internet discovered real vulnerabilities and we're scrambling like hell to fix them. We hope this carefully worded statement written by lawyers will keep the public and the FAA off our back until we can fix the problems."
- lagadu 7y ago
  This is Boeing we're talking about here, the English version would be more to the tune of "We're not fixing this until multiple planes crash and even then we'll try to weasel our way out of it."

madeofpalk 7y ago

https://en.wikipedia.org/wiki/Qantas_Flight_72#Final_report https://en.wikipedia.org/wiki/Qantas_Flight_72#Final_report

tyingq 7y ago
Interesting that they never found the root cause. I assume they fixed it by detecting symptoms since the cause is unknown.
- blackflame7000 7y ago
  Air Disasters did an episode on this flight with interviews from the people that diagnosed the problem. https://www.smithsonianchannel.com/shows/air-disasters/free-fall/802/3467449 https://www.smithsonianchannel.com/shows/air-disasters/free-...
  - tyingq 7y ago
    Searched a bit more, and found this from 2018: "Experts are still not sure of the root cause of the malfunction in the data unit, but subsequent software changes by Airbus mean any similar error in the future won’t lead to another terrifying nosedive." https://www.news.com.au/travel/travel-updates/incidents/terror-on-flight-qf72-im-not-in-control-of-this-plane/news-story/1de13e8591fa845045f52ff4387cf98b https://www.news.com.au/travel/travel-updates/incidents/terr... Sounds like I guessed right.
    - taneq 7y ago
      Wow, "we don't know what went wrong but we're certain we fixed it!" That's nice and convincing...
      - teddyuk 7y ago
        and almost always turns out to be false :)
      - AstralStorm 7y ago
        Nah. It's more like "we've added a permanent workaround".
      - madeofpalk 7y ago
        Well I mean, there was two problems with that flight: 1) There was erroneous data 2) The erroneous data caused the plane to suddenly nosedive 2 was fixed - it's known why it dived and they fixed that from happening again. They still don't know what caused 1.

DC-3 7y ago

So you're saying.... rewrite it in Rust?

samuell 7y ago
Or, Ada, no? :)
- kevin_thibedeau 7y ago
  Shhh. Let the new kids enjoy their smug.
  - DoofusOfDeath 7y ago
    > Shhh. Let the new kids enjoy their smug. Agreed. They need to discover on their own that critical software requires coq. </kidding> ... </i-think>
    - quickthrower2 7y ago
      Coq is great. Now the problem is developers having the sharpest, greatest tools but not understanding the spec, or working to a stupid spec and not calling it out.
  - fdhfqbu 7y ago
    I've done security auditing of ADA and C avionics code. (including for DAL-A components). As a language, I'd take Rust any day (in terms of security/robustness properties). However, the rust/LLVM compiler pipeline is nowhere near mature enough for use in high-criticality environments.
    - deleted 7y ago
      [deleted]
    - winter_blue 7y ago
      > However, the rust/LLVM compiler pipeline is nowhere near mature enough for use in high-criticality environments. I don't know about Rust, but LLVM isn't mature? Nearly ever program running in the Apple ecosystem was compiled using LLVM. Swift is compiled using LLVM. Since Xcode 4.2, Clang is the default compiler. So iOS and macOS apps are built with LLVM. I'd also wager a guess that Apple uses Clang to compile key system code (Darwin, macOS, and iOS, etc) as well.

AmericanChopper 7y ago

Every exploit payload is comprised entirely of data, so I think you’re even giving them too much credit there... The thing that triggered me the most was that they got the engineers who wrote the code to test it, and report back that their own code was fine. From the sound of it they didn’t even test the vulnerability, they just did an external test, without specifically testing the segmentation controls or the components in question.

mark-r 7y ago
They probably rely on network segmentation to keep the various components separated. If they consider the segmentation to be 100% effective, there'd be no need to do the kind of in-depth testing you advocate. I don't think it's justifiable to assume that segmentation doesn't have its own bugs that could be exploited.
- AmericanChopper 7y ago
  Yeah, that seems to be what their attitude is. I have a couple of major issues with that though. 1. Relying on segmentation to protect vulnerable components is not a reasonable standard operating procedure. Segmentation is supposed to be an additional layer of protection, you’re also supposed to secure individual components. 2. It seems as though the researcher believed there may have been a way to bypass some of the segmentation (the segmentation between the medium-sensitive network and the highly-sensitive network). The article kinda implies that they didn’t test that layer of segmentation, that they only tested the most external layer (the segmentation between the non-sensitive network and the medium-sensitive network). The whole response comes across as dismissive spin, that they hope will be consumed by people who don’t have a particularly sophisticated understanding of network/application security.
dreamcompiler 7y ago
Yeah, this is ridiculous. A real red team does not involve engineers testing their own code. The fact that they couldn't break it means nothing.

alltakendamned 7y ago

Data diodes. Call me when you bypass them, I have a job for you.

icebraining 7y ago
Data dioses don't prevent malicious data that exploits vulnerabilities and takes over from being transmitted, they only prevent the malware from communicating back.
- upofadown 7y ago
  But if you are on the side that receives... Which would be the case here, wouldn't it?
- alltakendamned 7y ago
  No that’s exactly what it does, it enforces one way communication from your high privileged domain to your less privileged domain. And your IFE or crew system is in the less privileged one.
- snovv_crash 7y ago
  It turns a black box into black hole, making it basically impossible to hack unless you have prior knowledge of what is on the other side.
  - lordlimecat 7y ago
    Security through obscurity! And I'm sure it will thwart nation state actors with potential access to the system in question.
- kakwa_ 7y ago
  Yes and no. Data diode can be put either ways, with different results: * case 1, you allow traffic to only go out: This way, nothing can come inside the system, but the system can export data. Here basically, confidentiality is of secondary importance, but integrity is crucial. It is the Biba model. It can be seen on Command and Control systems for critical industrial installation for example. For example, with power plants C&C system must avoid to be hacked, but exporting to other systems data such as their power output and operational condition is generally required. * case 2, you allow traffic to only go in: This way, the system can ingest data from the outside, but nothing goes out. Here basically, confidentiality is primordial, integrity a bit less. It's the Bell-LaPadula model. It can be seen in Military intelligence systems for example. Here you collect pieces of information and you make decisions on them, and all that must be kept confidential. To summarize: * One way: you enforce integrity * The other: you enforce confidentiality As an ending note, data diodes are generally pretty simple: basically you take a fiber with TX and RX link, and you cut one. There are a few more tricks (UDP only, sending multiple times because you don't have ACKs, static ARP tables, tricking the NIC into thinking it's up without signal), but that's the core of it.

panarky 7y ago

Boeingspeak: "IOActive's scenarios cannot affect any critical or essential airplane system and do not describe a way for remote attackers to access important 787 systems like the avionics system." English: "This random guy on the internet discovered real vulnerabilities and we're scrambling like hell to fix them. We hope this carefully worded statement written by lawyers will keep the public and the FAA off our back until we can fix the problems."

lagadu 7y ago
This is Boeing we're talking about here, the English version would be more to the tune of "We're not fixing this until multiple planes crash and even then we'll try to weasel our way out of it."