Slashdot Mirror
Boeing 787 May Be Vulnerable to Hacker Attack
palegray.net writes "An article posted yesterday on Wired.com notes that 'Boeing's new 787 Dreamliner passenger jet may have a serious security vulnerability in its onboard computer networks that could allow passengers to access the plane's control systems, according to the U.S. Federal Aviation Administration.' They're already working on solutions to the problem - including placing more physical separation between aircraft networks and implementing more robust software-based firewalls."
Why aren't both networks physically completely seperated from each other?
There are dozens of landing patterns in America where a couple hundred feet to the right or left and you have another 9/11. I sure hope they get this fixed before this thing flies anywhere.
This is pretty much the exact type of situation they invented red/black networks for. I can't imagine how any design for a passenger accessible network wouldn't use completely segregated networks for a)passenger use, b)flight logistics and maintenance, and c)actual flight control operations. And given the giant nightmarish spiderweb that aircraft wiring harnesses tend to be I'm guessing it will be a non-trivial task to implement it now, even ignoring the software and systems redesigns that would be required.
There are a few million easier ways to bring down an aircraft (or kill thousands and cause panic if that's your thing). Yes this is idiocy in engineering, but considering all the other threats I don't think it's way up the list. Ultimately, we aren't dead yet because there just aren't that many intelligent people that want to kill us, cause it just isn't that hard to pull off.
I am not an avionics engineer, but I worked with electrical and electronic systems on nuclear power plants, and we had a pretty strict segregation between different types of systems--and with 0 connection between a critical system (power sensing, for example) and a non-critical system (Some water level management). That's not even COUNTING peripheral systems (computers on the local netowrk for email/ppt/xls).
My thought is that some asshole at boeing decided to save some money on cable runs and ginned up an explanation of how software segregation would serve as an adequate barrier between flight critical systems and passenger systems. They never learn.
The article doesn't specify how the networks are connected. It could be something fairly innocuous like sharing the same power source. I seriously doubt they put the passenger internet access on the same packet-switched network as flight control. But who knows...
If what TFA claims is really true, i.e. that the passenger network is physically connected to the control and navigation system, then someone should get fired for this.
The control and navigation system of an airplane is one of the most critical networks possible; the lives of hundreds of passengers (and potentially of thousands of people on the ground) depend on its correct functioning. There are not many more critical networks than that, except maybe control systems for weapons, nuclear plants and some factory control systems.
Even the worst sysadmin out there knows that you do not physically connect such a highly sensitive, highly critical network to something crappy like the in-flight passenger entertainment network.
Why should the two networks should be connected at all? To tell the passengers the current speed of the plane?
The XBox was hacked. The playstation was hacked. DVDs were hacked. HD-DVD was hacked. Pretty much anything out there was hacked if someone had an interest in it (and mostly the interest wasn't commercial, just "for fun"). Even if they do aren't "completely connected" as Boeing claims, the danger of it being hacked is very real. On one hand you are not allowed to use your mobile phone on a plane, and on the other you can play with a network which is attached to the navigation and control system? Come on.
I am a Military Avionics Technician and I must admit that I find this report confusing.
The only thing that is being suggested is that the passenger system could corrupt the flight systems which I find unlikely - it's chalk and cheese with regard to how these systems communicate. The only way I can see a problem is if one of the Avionic bus controllers is swamped by requests from one of the passenger systems.
I know this isn't a military design but surely the flight systems such as flight management and navigation are not on the same bus?
Disclaimer - Digital is new in my countries military ;-)
A thistle is a fat salad for an ass's mouth...
While I completely agree, designers are always under pressure to reduce the amount of wiring looms - they add a surptising amount of weight thereby decreasing fuel economy.
A thistle is a fat salad for an ass's mouth...
Right. I also posted a link later that showed that I was overestimating the seperation required between critical systems and non-critical systems and among critical systems. That being said, I don't feel that most of the decisions to skimp on safety measures are taken by engineers, they are taken by management over the protests of engineers. In my experience, engineers tend to overdo it. :)
Considering Boeing is the world's leader in passenger aircraft, how about we just give them the benefit of the doubt that they aren't retards?
"Sure, Boeing's spent a decade designing this plane with thousands of engineers, but I read a short Slashdot story summary and now I'm going to decree I know more than them!"
Comment of the year
The FAA document in question is basically saying that there needs to be some previously unneeded standards for certification for the 787 just to make sure that the electronics can't be used to do what the Wired artcle and the headline of this thread threatens.
Is buying a Harley Davidson as your first motorcycle since you were 16 at age 49 a midlife crisis issue?
Queue up 11,000 A/C posts about H4X0RZ Cr45h1n6 for REALZ Do0DEZ!.
This is not a "Windows vs Linux" thing. These are highly specialized data networks designed specifically for aircraft. The typical running life of a big jet is some 40 years or more - the idea of a consumer O/S such as Windows (or even Linux) being suitable for such a situation is simply stupid. Everything is coded in firmware, micro-processor based, with a likelyhood of actually crashing accidentally being somewhat less likely than getting struck by lightning on a sunny day while sitting in the cellar of your 4-story house.
Not bloody likely.
But, actual, malicious attack? Possible - and if there was *ANY* connection between the passenger data networks and the main control networks, that's an issue that must be addressed.
Most likely, the FAA found some part that was connected to both networks, that itself was not capable of actually transmitting data. But they're being car eful, as is their job, since lives are on the line.
Go FAA!
I have no problem with your religion until you decide it's reason to deprive others of the truth.
Well I'd assume at least those intending to make use of this would. That's like asking how many people have lock picks, when talking about securing doors.
I just read Slashdot for the articles.