Slashdot Mirror
Boeing 787 May Be Vulnerable to Hacker Attack
palegray.net writes "An article posted yesterday on Wired.com notes that 'Boeing's new 787 Dreamliner passenger jet may have a serious security vulnerability in its onboard computer networks that could allow passengers to access the plane's control systems, according to the U.S. Federal Aviation Administration.' They're already working on solutions to the problem - including placing more physical separation between aircraft networks and implementing more robust software-based firewalls."
No more playing MS Flight Sim.
Why aren't both networks physically completely seperated from each other?
... is one that's physically isolated. I can't think of one good reason why passengers should have any access whatsoever to command/control networks used by the airplane.
Note: IAAFMAT(I am a former military avionics technician) and I ask, "why the hell did that happen?" The flight control subsystems should share only a power bus with the non-critical subsystems(if even that). My tinfoil-hat theory is that the control system was made to be hackable so that the government could take control of a hijacked aircraft to prevent another 9/11 (or to cause another 9/11, depending on your point of view).
What kind of an idiot would put the flight control systems and the on-board entertainment/voip/net/pr0n on the same physical network? Were they trying to save weight/money by running only one cable through the plane?
I recall reading about MS stuffing their software into cars (that probably evolved into Ford's SYNC) and even there the MS crap and the engine management systems were completely separate.
There are a few million easier ways to bring down an aircraft (or kill thousands and cause panic if that's your thing). Yes this is idiocy in engineering, but considering all the other threats I don't think it's way up the list. Ultimately, we aren't dead yet because there just aren't that many intelligent people that want to kill us, cause it just isn't that hard to pull off.
- If the plane deviates from the flight plan, access to Google Maps may become handy to plan a new route
- While on autopilot, access to certain web sites may provide some entertainment to the captain, who usually is a lonely man
- Given the bad quality of many onboard speakers, announcements from the cockpit can be emailed or IM'ed to passengers
- Hacker intrusion may be a better excuse than malfunctioning engine as the reason for a plane crash
- No more planes grounded due to lack of pilot operating manual, as it could be easily downloaded from the Internet
I am sure there are many other good reasons to connect the navigation network to the Internet, so this list is not exhaustive.The flight control and avionics networks as well as the hardware are separate from the passenger network.
The concern is that a separate network of maintenance and some limited flight information data share the same up/down links as the passenger network. The FAA notice is to demonstrate to the FAA that there can be no interference between the maintenance and flight information data and the passenger network.
Even if the maintenance and flight information data were compromised, at worst this would mean that the operating history of the aircraft is not accurate. This is a big deal but not something that will lead to in flight failure.
An additional requirement of the FAA notice is to prohibit future passenger services without testing for interference and security.
Did you READ the report? I did. It doesn't say anything is unsafe. What it says is there are unique architectures in the systems that put them at odds with CFR 14 regulations compliance whether they present an actual or potential danger or not. Furthermore there's a comment in the report which states that Airbus objects to the regulatory findings on the basis that the 'standard' is too high level to offer any concrete value for implementation or compliance.
Like any other IT security audit - compliance doesn't mean security it means compliance. And in the cases where there are deviations from the standard, the system has to be able to speak to that deviation and address it or contest it.
Queue up 11,000 A/C posts about H4X0RZ Cr45h1n6 for REALZ Do0DEZ!.
This is not a "Windows vs Linux" thing. These are highly specialized data networks designed specifically for aircraft. The typical running life of a big jet is some 40 years or more - the idea of a consumer O/S such as Windows (or even Linux) being suitable for such a situation is simply stupid. Everything is coded in firmware, micro-processor based, with a likelyhood of actually crashing accidentally being somewhat less likely than getting struck by lightning on a sunny day while sitting in the cellar of your 4-story house.
Not bloody likely.
But, actual, malicious attack? Possible - and if there was *ANY* connection between the passenger data networks and the main control networks, that's an issue that must be addressed.
Most likely, the FAA found some part that was connected to both networks, that itself was not capable of actually transmitting data. But they're being car eful, as is their job, since lives are on the line.
Go FAA!
I have no problem with your religion until you decide it's reason to deprive others of the truth.