6 ms·

Software Vulnerabilities in the Boeing 787

90 points by hsnewman 7y ago

british_india 7y ago
https://www.youtube.com/watch?v=hC-JCvFyjlo https://www.youtube.com/watch?v=hC-JCvFyjlo The 787 Dreamliner is a nightmare. Bad code produced by offshore teams. International teams totally violating safety procedures.
sebazzz 7y ago
> That second barrier, the company argues, allows only data to pass from one part of the network to the other, rather than the executable commands that would be necessary to affect the plane's critical systems. Assuming planes don't use something like CAN-bus but regular TCP protocol, this can't really be true right? Perhaps they talk about which services are allowed to connect (listen for incoming connections).
- p_l 7y ago
  AFDX protocol stack is unidirectional with no ACKs or anything like that, which makes use of physical data diodes trivial.
  - Hunisgung 7y ago
    That is false. Apart from the hard-coded and restrictive network configuration, AFDX is basically UDP/IP. There are many uses of bidirectional application protocols (like TFTP).
    - p_l 7y ago
      unidirectional nature of the communication protocols means that AFDX-compatible application can be easily firewalled for cases such as reporting data to maintenance network, as I understood from Boeing's response. Electronic Flight Bag being part of maintenance network is not something good, though.
sleavey 7y ago
It seems to me as someone with no experience of designing aircraft control software, avionics or anything to do with planes, that the entertainment system should be on a physically separate network to anything safety critical. Like, different everything: power supplies, switches, cables, control panels, the works. There should be no entryway into the flight control network except from the cockpit.
- selectodude 7y ago
  The issue is that for every kilogram you need to get into the air, is another kilogram of fuel that you need to carry onboard. Airlines, and by association, Boeing are very conscious of weight over something like airgapping.
  - AceyMan 7y ago
    The rule of thumb is: You burn one lb (unit) of fuel for every three lbs (units) of fuel you carry. Me: FAA licensed dispatcher (Also, you'll see a 1:1 rule would imply adding fuel does not increase range, which is absurd.)
- p_l 7y ago
  There are three separate networks, with data diodes used for cases where information flows between them. HW separation was enforced by FAA back when 787 was in prototype stage.
  - jakeogh 7y ago
    Where can one read about the 787 data diodes?
    - Hunisgung 7y ago
      You can read about the fact that there are NO data diodes on the FAA website > The proposed architecture of the 787 allows connection to and access from external sources (the public Internet) and airline operator networks to the previously isolated Aircraft Control Domain and Airline Information Services Domain. > Capability is proposed for providing electronic transmission of field-loadable software applications and databases to the aircraft. These would subsequently be loaded into systems within the Aircraft Control Domain and Airline Information Services Domain. [1] http://rgl.faa.gov/Regulatory_and_Guidance_Library%5CrgSC.nsf/0/2FF392BE50BE5821862572C0004AEB68?OpenDocument http://rgl.faa.gov/Regulatory_and_Guidance_Library%5CrgSC.ns...
deleted 7y ago
[deleted]
jdsully 7y ago
Their "rebuttal" almost seems like a taunt to other security researchers to prove them wrong. Calling the researchers irresponsible and their tools rudimentary was a dick move.
amluto 7y ago
There is IMO exactly one valid way to get data from the flight systems to the entertainment network: use a literal one-way connection. Not “the only supported requests are data retrieval.” Not “the software folks only transmit.” A bona fide physical connection where one side has a transmitter, one side has a receiver, and there is no physical mechanism to send any information whatsoever the other way. These devices are often called “data diodes”. They are cheap. They cannot be hacked from the output side — at best a severely malfunctioning destination could send so much power the wrong way on the fiber or so much voltage the wrong way on the wire that the data diode fails. This would be surprising to say the least.
- rootusrootus 7y ago
  Aren't data diodes already a regulatory requirement for any connection between avionics and the IFE?
  - amluto 7y ago
    No clue, but Boeing’s weasel-worded statement sounds awfully like they’re trying to defend a software-only solution.
  - Hunisgung 7y ago
    I guess they are a regulatory requirement because all of the modern aircraft have to request special conditions form FAA and EASA to justify why they do not comply with these requirements. For example for the Airbus A350;: > The applicable airworthiness regulations do not contain adequate or appropriate safety standards for this design feature. These proposed special conditions contain the additional safety standards that the Administrator considers necessary to establish a level of safety equivalent to that established by the existing airworthiness standards. [1] https://www.federalregister.gov/documents/2013/12/17/2013-29985/special-conditions-airbus-model-a350-900-series-airplane-electronic-system-security-protection-from https://www.federalregister.gov/documents/2013/12/17/2013-29...
- deleted 7y ago
  [deleted]
0xDEFC0DE 7y ago
How exactly do you get a hold of firmware and set up a lab to test everything with stuff like this?
- generatorguy 7y ago
  you work for boeing or the FAA
  - Hunisgung 7y ago
    Or one of Boeing's many subcontractors.
    - rasz 7y ago
      or Huawei https://techbizweb.com/chinese-hackers-spy-on-u-s-law-firm-major-norwegian-msp/ https://techbizweb.com/chinese-hackers-spy-on-u-s-law-firm-m... https://www.wsj.com/articles/SB10485560675556000 https://www.wsj.com/articles/SB10485560675556000
service_bus 7y ago
Unlike the security researcher, I do have access to multiple 787s as I am one of many people responsible for maintaining them. I'm obviously not going to attempt to exploit the firmware on an aircraft for obvious reasons, but the security researcher's notion that you can "pivot" from the in flight entertainment to anything to do with aircraft operation is pure fantasy. These systems are entirely separate, including the electricity that controls the systems. This guy is preying on individuals' lack of knowledge about aircraft mechanics in order to promote himself.
- xemdetia 7y ago
  Would you say as someone who deals with these larger planes that at least the 787 current gen is closer to an older style chassis and body for cars? I have always imagined/assumed that 787's are not unique that they would be the same 'chassis' for a cargo plane or a passenger plane, and it really would have to do with how they fitted the plane for purpose? This is part of the reason why I agree with you, because I don't see why the 787 would be unique by mixing avionics/mechatronics with the passenger systems but I don't know enough to say it with confidence. They would have designed the passenger systems to be independent and replaceable (especially with the knowledge gained from the legacies and upgrades of other planes like the 737). Is there any public guides for 787 chassis and maintenance that you could point to as being reasonable things to read about this new style plane?
  - WalterBright 7y ago
    Not sure what you mean, but aircraft stopped being "chassis and body" some time in the 1930's. That was the switch to a monocoque design with stressed skin.
    - xemdetia 7y ago
      I couldn't find the right words to describe it, the other person who commented was a bit closer. At a certain point I would assume the Boeing 787 design would have interchangeable configurations that would not be dependent on the airframe and avionics. I wasn't sure if cabin, interior, model, or something else would best describe what I meant and chassis and body for a car was the best I could come up with that could describe these two changeable parts unlike the unibody chassis. It looks like configurations is the most appropriate word. I was hoping that the person I commented to could point us at some fun manuals to describe how these configurations worked at a technical level.
solotronics 7y ago
I was flying about a year ago and was messing with the in flight entertainment in a 787. It was pretty easy to figure out how to get to a boot menu in the in flight entertainment. I was thinking "huh, this seems like maybe a way in". Seeing how the in-flight displays navigational data it must be on the network as the flight systems. I'm sure there is some kind of segregation but its probably not ultimately secure.

90 points by hsnewman 7y ago

https://www.youtube.com/watch?v=hC-JCvFyjlo https://www.youtube.com/watch?v=hC-JCvFyjlo The 787 Dreamliner is a nightmare. Bad code produced by offshore teams. International teams totally violating safety procedures.

sebazzz 7y ago

> That second barrier, the company argues, allows only data to pass from one part of the network to the other, rather than the executable commands that would be necessary to affect the plane's critical systems. Assuming planes don't use something like CAN-bus but regular TCP protocol, this can't really be true right? Perhaps they talk about which services are allowed to connect (listen for incoming connections).

p_l 7y ago
AFDX protocol stack is unidirectional with no ACKs or anything like that, which makes use of physical data diodes trivial.
- Hunisgung 7y ago
  That is false. Apart from the hard-coded and restrictive network configuration, AFDX is basically UDP/IP. There are many uses of bidirectional application protocols (like TFTP).
  - p_l 7y ago
    unidirectional nature of the communication protocols means that AFDX-compatible application can be easily firewalled for cases such as reporting data to maintenance network, as I understood from Boeing's response. Electronic Flight Bag being part of maintenance network is not something good, though.

sleavey 7y ago

It seems to me as someone with no experience of designing aircraft control software, avionics or anything to do with planes, that the entertainment system should be on a physically separate network to anything safety critical. Like, different everything: power supplies, switches, cables, control panels, the works. There should be no entryway into the flight control network except from the cockpit.

selectodude 7y ago
The issue is that for every kilogram you need to get into the air, is another kilogram of fuel that you need to carry onboard. Airlines, and by association, Boeing are very conscious of weight over something like airgapping.
- AceyMan 7y ago
  The rule of thumb is: You burn one lb (unit) of fuel for every three lbs (units) of fuel you carry. Me: FAA licensed dispatcher (Also, you'll see a 1:1 rule would imply adding fuel does not increase range, which is absurd.)
p_l 7y ago
There are three separate networks, with data diodes used for cases where information flows between them. HW separation was enforced by FAA back when 787 was in prototype stage.
- jakeogh 7y ago
  Where can one read about the 787 data diodes?
  - Hunisgung 7y ago
    You can read about the fact that there are NO data diodes on the FAA website > The proposed architecture of the 787 allows connection to and access from external sources (the public Internet) and airline operator networks to the previously isolated Aircraft Control Domain and Airline Information Services Domain. > Capability is proposed for providing electronic transmission of field-loadable software applications and databases to the aircraft. These would subsequently be loaded into systems within the Aircraft Control Domain and Airline Information Services Domain. [1] http://rgl.faa.gov/Regulatory_and_Guidance_Library%5CrgSC.nsf/0/2FF392BE50BE5821862572C0004AEB68?OpenDocument http://rgl.faa.gov/Regulatory_and_Guidance_Library%5CrgSC.ns...

deleted 7y ago

[deleted]

jdsully 7y ago

Their "rebuttal" almost seems like a taunt to other security researchers to prove them wrong. Calling the researchers irresponsible and their tools rudimentary was a dick move.

amluto 7y ago

There is IMO exactly one valid way to get data from the flight systems to the entertainment network: use a literal one-way connection. Not “the only supported requests are data retrieval.” Not “the software folks only transmit.” A bona fide physical connection where one side has a transmitter, one side has a receiver, and there is no physical mechanism to send any information whatsoever the other way. These devices are often called “data diodes”. They are cheap. They cannot be hacked from the output side — at best a severely malfunctioning destination could send so much power the wrong way on the fiber or so much voltage the wrong way on the wire that the data diode fails. This would be surprising to say the least.

rootusrootus 7y ago
Aren't data diodes already a regulatory requirement for any connection between avionics and the IFE?
- amluto 7y ago
  No clue, but Boeing’s weasel-worded statement sounds awfully like they’re trying to defend a software-only solution.
- Hunisgung 7y ago
  I guess they are a regulatory requirement because all of the modern aircraft have to request special conditions form FAA and EASA to justify why they do not comply with these requirements. For example for the Airbus A350;: > The applicable airworthiness regulations do not contain adequate or appropriate safety standards for this design feature. These proposed special conditions contain the additional safety standards that the Administrator considers necessary to establish a level of safety equivalent to that established by the existing airworthiness standards. [1] https://www.federalregister.gov/documents/2013/12/17/2013-29985/special-conditions-airbus-model-a350-900-series-airplane-electronic-system-security-protection-from https://www.federalregister.gov/documents/2013/12/17/2013-29...
deleted 7y ago
[deleted]

0xDEFC0DE 7y ago

How exactly do you get a hold of firmware and set up a lab to test everything with stuff like this?

generatorguy 7y ago
you work for boeing or the FAA
- Hunisgung 7y ago
  Or one of Boeing's many subcontractors.
  - rasz 7y ago
    or Huawei https://techbizweb.com/chinese-hackers-spy-on-u-s-law-firm-major-norwegian-msp/ https://techbizweb.com/chinese-hackers-spy-on-u-s-law-firm-m... https://www.wsj.com/articles/SB10485560675556000 https://www.wsj.com/articles/SB10485560675556000

service_bus 7y ago

Unlike the security researcher, I do have access to multiple 787s as I am one of many people responsible for maintaining them. I'm obviously not going to attempt to exploit the firmware on an aircraft for obvious reasons, but the security researcher's notion that you can "pivot" from the in flight entertainment to anything to do with aircraft operation is pure fantasy. These systems are entirely separate, including the electricity that controls the systems. This guy is preying on individuals' lack of knowledge about aircraft mechanics in order to promote himself.

xemdetia 7y ago
Would you say as someone who deals with these larger planes that at least the 787 current gen is closer to an older style chassis and body for cars? I have always imagined/assumed that 787's are not unique that they would be the same 'chassis' for a cargo plane or a passenger plane, and it really would have to do with how they fitted the plane for purpose? This is part of the reason why I agree with you, because I don't see why the 787 would be unique by mixing avionics/mechatronics with the passenger systems but I don't know enough to say it with confidence. They would have designed the passenger systems to be independent and replaceable (especially with the knowledge gained from the legacies and upgrades of other planes like the 737). Is there any public guides for 787 chassis and maintenance that you could point to as being reasonable things to read about this new style plane?
- WalterBright 7y ago
  Not sure what you mean, but aircraft stopped being "chassis and body" some time in the 1930's. That was the switch to a monocoque design with stressed skin.
  - xemdetia 7y ago
    I couldn't find the right words to describe it, the other person who commented was a bit closer. At a certain point I would assume the Boeing 787 design would have interchangeable configurations that would not be dependent on the airframe and avionics. I wasn't sure if cabin, interior, model, or something else would best describe what I meant and chassis and body for a car was the best I could come up with that could describe these two changeable parts unlike the unibody chassis. It looks like configurations is the most appropriate word. I was hoping that the person I commented to could point us at some fun manuals to describe how these configurations worked at a technical level.

solotronics 7y ago

I was flying about a year ago and was messing with the in flight entertainment in a 787. It was pretty easy to figure out how to get to a boot menu in the in flight entertainment. I was thinking "huh, this seems like maybe a way in". Seeing how the in-flight displays navigational data it must be on the network as the flight systems. I'm sure there is some kind of segregation but its probably not ultimately secure.