6 ms·

Collins Aerospace: Sending text messages to the cockpit with test:test

99 points by hacka22 1y ago

constantcrying 1y ago
Well, this is just standard Aerospace grade software. I would be surprised if you could find a single controller in an airplane without some trivial login credentials. Exposing software like that to the internet is of course a completely insane step.
- Jtsummers 1y ago
  > Well, this is just standard Aerospace grade software. This is a groundside problem, and perhaps it is insane to have it exposed to the open internet but it's not on the aircraft. It needs to be exposed to some network because the intent is that fleet controllers (airlines, or in this case Navy) use it to reach out to their aircraft wherever they may be. That said, it absolutely fits the quality I've come to expect from IT systems developed by aerospace and defense companies.
  - 2OEH8eoCRo0 1y ago
    It meets all requirements! /s
    - deleted 1y ago
      [deleted]
    - zppln 1y ago
      Aerospace have been dealing with /safety/ for a long time, /security/ is another matter...
- deepsun 1y ago
  Nowadays it's actually hard to not connect anything to internet. Better (and easier) to assume it's connected.
- sumnole 1y ago
  > Well, this is just standard Aerospace grade software Can't be further from the truth. DOD software is given huge budgets where it's not surprising to see 3 separate teams performing QA for one software milestone. It's one of the few sectors that still plan software upfront waterfall style and implement strict procedures for traceability, change management, etc. Who else is using formal methods or safety critical stacks like ADA/Spark?
  - Jtsummers 1y ago
    > Who else is using formal methods or safety critical stacks like ADA/Spark? This is not actually as common as many people seem to believe. The mandate died almost two decades ago. DOD aircraft fly on Fortran, JOVIAL, C, and C++ more than Ada. And DOD IT systems are a clusterfuck. > It's one of the few sectors that still plan software upfront waterfall style That's not the good thing you seem to think it is. Also, why do you call it ADA? It's not an acronym. Amusingly, SPARK is, or was, and you write it as "Spark". It originally stood for "SPADE Ada Kernel" and the language continues to be stylized as SPARK.
    - sumnole 1y ago
      Pedantics aside, not much reasoning against quality. Perhaps I've lucked out, but I've worked in many sectors and do not at all agree with sentiment here about DOD software quality. There is significant formal investment/research in DOD to improve operations, including taking the best of practices in commercial. In my experience, the worst of software is written by teams with little experience improvising under Agile and taking on tech debt with no time/resources to get things done the right way.
      - Jtsummers 1y ago
        Can you point to a successful Waterfall project? A multi-million or billion dollar, 3+ year software development effort where a team figured out all the requirements correctly before writing a single line of code. Where they wrote every line of code correctly before testing it. And where testing was so spectacularly successful that they didn't have to go back and renegotiate the project requirements or dates to get extensions or reduced project scope. If you can do this, then I might believe you about Waterfall being the best approach out there. Right now your counter example is "teams with little experience" which is not much of an argument. Teams with little experience fail all the time, because they are inexperienced. Give them a $100 million Waterfall project to plan and execute over 3+ years and their failure would be even more spectacular.
- downrightmike 1y ago
  root:root
cactacea 1y ago
Interesting choice of tail number and date... https://www.faa.gov/lessons_learned/transport_airplane/accidents/N200WQ https://www.faa.gov/lessons_learned/transport_airplane/accid...
- netsharc 1y ago
  Looks like the PDF is just to show what the messaging interface looks like, and what they've found as a publicly available screenshot is from the crash report involving that plane. If they logged in, took a screenshot, and published that (even if lots of things are blurred), there's probably more attack surface for some three-letter-agency to bust down their doors and disappear them...
  - psunavy03 1y ago
    I'll take "things that happen in movies a lot more than in real life" for $600 please.
- avs733 1y ago
  I would guess it limits their ability to be accused of anythign to pick a plane, flight, and time that meets at least three criteria: 1) no passengers on board - you can't be accussed of endangering passengers 2) long past - you can't be accused of anything that happened recently 3) the plan literally no longer exists - you can't be accussed of damaging a plane
tantalor 1y ago
> RTX did not respond to our vulnerability report I guess they mean you should sell the vulnerability to highest bidder instead of reporting? Weird choice.
- tjr 1y ago
  Unfortunately, RTX did not respond to our vulnerability report. The account was disabled. Some sort of acknowledgement of the report certainly would have been good here, but at least they did disable the account. I presume the reported vulnerability no longer exists.
  - noir_lord 1y ago
    > but at least they did disable the account. Probably added test2:test2. Not worked in aerospace only enterprise but sometimes I worry I'm too cynical and then I remember the things I've seen and think I'm not cynical enough. That said nothing I work on is aerospace level critical, could cost a lot of money if it's out but no one would ever have died.
- deepsun 1y ago
  They will respond after a year or two with a lawsuit and SWAT busting doors.
  - 0_____0 1y ago
    They're not in the US. I'm not familiar with German law enforcement practices but I wouldn't be surprised if they had a process that was a little less door-kicky.
    - stronglikedan 1y ago
      According to my German friends, it's worse over there.
    - BoredPositron 1y ago
      Cybercrime is pretty door-kicky in germany and they usually keep all your gear for two years even if you are found not guilty...
rwmj 1y ago
Collins Aerospace, the same company responsible days of outages at airport check-in kiosks https://www.bbc.co.uk/news/articles/c3drpgv33pxo https://www.bbc.co.uk/news/articles/c3drpgv33pxo
- kayfox 1y ago
  They were also involved in the Boeing MCAS thing as the company responsible for the computers and who presumably wrote the code.
Animats 1y ago
(2009)
- pierrec 1y ago
  No, this seems to be quite recent. At least the discovery, disclosure, and post are recent, as always, who knows how long the vulnerability has existed... I'll admit I was also confused because their "screenshots" is an old official document containing screenshots of the application in question, but it's just used to illustrate what the application is and does.
- deleted 1y ago
  [deleted]
throwaway1c3vw 1y ago
Security vulerability text or a report is the basis for a CV. Yes, Collins Aerospace is subsidiary of RTX, which is the distributor for a relational database for plane ticket credentials.

99 points by hacka22 1y ago

Well, this is just standard Aerospace grade software. I would be surprised if you could find a single controller in an airplane without some trivial login credentials. Exposing software like that to the internet is of course a completely insane step.

Jtsummers 1y ago
> Well, this is just standard Aerospace grade software. This is a groundside problem, and perhaps it is insane to have it exposed to the open internet but it's not on the aircraft. It needs to be exposed to some network because the intent is that fleet controllers (airlines, or in this case Navy) use it to reach out to their aircraft wherever they may be. That said, it absolutely fits the quality I've come to expect from IT systems developed by aerospace and defense companies.
- 2OEH8eoCRo0 1y ago
  It meets all requirements! /s
  - deleted 1y ago
    [deleted]
  - zppln 1y ago
    Aerospace have been dealing with /safety/ for a long time, /security/ is another matter...
deepsun 1y ago
Nowadays it's actually hard to not connect anything to internet. Better (and easier) to assume it's connected.
sumnole 1y ago
> Well, this is just standard Aerospace grade software Can't be further from the truth. DOD software is given huge budgets where it's not surprising to see 3 separate teams performing QA for one software milestone. It's one of the few sectors that still plan software upfront waterfall style and implement strict procedures for traceability, change management, etc. Who else is using formal methods or safety critical stacks like ADA/Spark?
- Jtsummers 1y ago
  > Who else is using formal methods or safety critical stacks like ADA/Spark? This is not actually as common as many people seem to believe. The mandate died almost two decades ago. DOD aircraft fly on Fortran, JOVIAL, C, and C++ more than Ada. And DOD IT systems are a clusterfuck. > It's one of the few sectors that still plan software upfront waterfall style That's not the good thing you seem to think it is. Also, why do you call it ADA? It's not an acronym. Amusingly, SPARK is, or was, and you write it as "Spark". It originally stood for "SPADE Ada Kernel" and the language continues to be stylized as SPARK.
  - sumnole 1y ago
    Pedantics aside, not much reasoning against quality. Perhaps I've lucked out, but I've worked in many sectors and do not at all agree with sentiment here about DOD software quality. There is significant formal investment/research in DOD to improve operations, including taking the best of practices in commercial. In my experience, the worst of software is written by teams with little experience improvising under Agile and taking on tech debt with no time/resources to get things done the right way.
    - Jtsummers 1y ago
      Can you point to a successful Waterfall project? A multi-million or billion dollar, 3+ year software development effort where a team figured out all the requirements correctly before writing a single line of code. Where they wrote every line of code correctly before testing it. And where testing was so spectacularly successful that they didn't have to go back and renegotiate the project requirements or dates to get extensions or reduced project scope. If you can do this, then I might believe you about Waterfall being the best approach out there. Right now your counter example is "teams with little experience" which is not much of an argument. Teams with little experience fail all the time, because they are inexperienced. Give them a $100 million Waterfall project to plan and execute over 3+ years and their failure would be even more spectacular.
downrightmike 1y ago
root:root

cactacea 1y ago

Interesting choice of tail number and date... https://www.faa.gov/lessons_learned/transport_airplane/accidents/N200WQ https://www.faa.gov/lessons_learned/transport_airplane/accid...

netsharc 1y ago
Looks like the PDF is just to show what the messaging interface looks like, and what they've found as a publicly available screenshot is from the crash report involving that plane. If they logged in, took a screenshot, and published that (even if lots of things are blurred), there's probably more attack surface for some three-letter-agency to bust down their doors and disappear them...
- psunavy03 1y ago
  I'll take "things that happen in movies a lot more than in real life" for $600 please.
avs733 1y ago
I would guess it limits their ability to be accused of anythign to pick a plane, flight, and time that meets at least three criteria: 1) no passengers on board - you can't be accussed of endangering passengers 2) long past - you can't be accused of anything that happened recently 3) the plan literally no longer exists - you can't be accussed of damaging a plane

tantalor 1y ago

> RTX did not respond to our vulnerability report I guess they mean you should sell the vulnerability to highest bidder instead of reporting? Weird choice.

tjr 1y ago
Unfortunately, RTX did not respond to our vulnerability report. The account was disabled. Some sort of acknowledgement of the report certainly would have been good here, but at least they did disable the account. I presume the reported vulnerability no longer exists.
- noir_lord 1y ago
  > but at least they did disable the account. Probably added test2:test2. Not worked in aerospace only enterprise but sometimes I worry I'm too cynical and then I remember the things I've seen and think I'm not cynical enough. That said nothing I work on is aerospace level critical, could cost a lot of money if it's out but no one would ever have died.
deepsun 1y ago
They will respond after a year or two with a lawsuit and SWAT busting doors.
- 0_____0 1y ago
  They're not in the US. I'm not familiar with German law enforcement practices but I wouldn't be surprised if they had a process that was a little less door-kicky.
  - stronglikedan 1y ago
    According to my German friends, it's worse over there.
  - BoredPositron 1y ago
    Cybercrime is pretty door-kicky in germany and they usually keep all your gear for two years even if you are found not guilty...

rwmj 1y ago

Collins Aerospace, the same company responsible days of outages at airport check-in kiosks https://www.bbc.co.uk/news/articles/c3drpgv33pxo https://www.bbc.co.uk/news/articles/c3drpgv33pxo

kayfox 1y ago
They were also involved in the Boeing MCAS thing as the company responsible for the computers and who presumably wrote the code.

Animats 1y ago

(2009)

pierrec 1y ago
No, this seems to be quite recent. At least the discovery, disclosure, and post are recent, as always, who knows how long the vulnerability has existed... I'll admit I was also confused because their "screenshots" is an old official document containing screenshots of the application in question, but it's just used to illustrate what the application is and does.
deleted 1y ago
[deleted]

throwaway1c3vw 1y ago

Security vulerability text or a report is the basis for a CV. Yes, Collins Aerospace is subsidiary of RTX, which is the distributor for a relational database for plane ticket credentials.