Slashdot Mirror
GAO Warns FAA of Hacking Threat To Airliners
chicksdaddy writes: A report from the Government Accountability Office (GAO) warns that the U.S. Federal Aviation Administration may be failing to address cyber security vulnerabilities that could allow remote attacks on avionics systems needed to keep the plane airborne. In a report issued Tuesday (PDF), the GAO said, "significant security-control weaknesses remain that threaten the agency's ability to ensure the safe and uninterrupted operation of the national airspace system." Among those: a lack of clear certification for aircraft airworthy readiness that encompasses cyber security protections. That lapse could allow planes to fly with remotely exploitable vulnerabilities that could affect aircraft controls and guidance systems.
The GAO report did not provide details of any specific vulnerability affecting any specific aircraft. Rather, GAO cited FAA personnel and experts, saying that the possibility exists that "unauthorized individuals might access and compromise aircraft avionics systems," in part by moving between Internet-connected in-flight entertainment systems and critical avionics systems in the aircraft cabin.
Security researchers have long warned that hackers could jump from in-flight entertainment systems in the passenger cabin to cockpit avionics systems if airlines did not take proper precautions, such as so-called "air gapping" the networks. At last year's Black Hat Briefings, researcher Ruben Santamarta of IOActive demonstrated a method of hacking the satellite communications equipment on passenger jets through their WiFi and inflight entertainment systems.
The GAO report did not provide details of any specific vulnerability affecting any specific aircraft. Rather, GAO cited FAA personnel and experts, saying that the possibility exists that "unauthorized individuals might access and compromise aircraft avionics systems," in part by moving between Internet-connected in-flight entertainment systems and critical avionics systems in the aircraft cabin.
Security researchers have long warned that hackers could jump from in-flight entertainment systems in the passenger cabin to cockpit avionics systems if airlines did not take proper precautions, such as so-called "air gapping" the networks. At last year's Black Hat Briefings, researcher Ruben Santamarta of IOActive demonstrated a method of hacking the satellite communications equipment on passenger jets through their WiFi and inflight entertainment systems.
And they're not going to do anything about it until it actually happens, because that would cost money and some douchebag CEO wants a fat bonus this quarter. There could be a law if you could get Congress to cooperate. And if they weren't all old and actually understood anything about computers. You'd think as much as most of them fly, they'd be worried about that. I'd guess if you ask any given one, it wouldn't even be on their top 100 list of things to be worried about. Probably not even on their top 100 list of things to be worried about while flying.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Oh NO!
This is why the idea of remote overrides of pilot controls is a particularly BAD idea.
A trained, qualified pilot must always have last resort authority, over any automated system and preferably even over any "assisted" system, whether it be fly by wire, hydraulic, etc. If control can be taken out of his or her hands remotely, because someone (or something) on the ground doesn't agree with the pilot's judgement, I guarantee we'll see more disasters, not fewer.
The instances where intentional pilot misconduct or hijacking occur are few, but notorious. But the instances where human pilots in the cockpit handle minor emergencies that could easily have turned into deadly ones occur regularly and we seldom hear about most of them.
Case in point: Do you think an autopilot on the ground could have heard a stowaway baggage handler?
I can see the fnords!
http://www.sans.org/instructor... Mike Poor has been saying this for years
TLDR: The current systems are already very good, but it wouldn't be bad to look at it also from a malicious perspective.
TFS is misleading. The airworthiness criteria currently do not address "hacking" or "malicious data." However, airworthiness criteria do require input validation on all inputs to all flight safety avionics systems. They also require continuous internal consistency checks, to protect from code changes, and strict segregation between all software on a processos and continuous validation of the state of each module. Further, almost all of the software is required to be strictly deterministic, and as such, no dynamic memory allocation occurs in flight critical and safety critical systems. Between this and the design procedures in RTCA DO-178, and the testing requirements, most avionics software is extremely hard to exploit.
Oh, and by the way, the complete lack of all of these is why current UAVs are not airworthy (the large military ones are close) and should not be allowed to fly near or over people. The UAV revolution will implode when they're held to the standards required for digital fly by wire airplanes and start costing as much as real airplanes.
Dem haxxorz gittin' fly, bro.
Next to the "EXIT" sign.
How much air do we need to make something secure?!
that they're just not figuring out that computers can be hacked. That is how stupid these people are. It's sad that these stupid people rule the world and make our lives miserable. For non-Republicans, live is shit and not worth living. For most of us, we are literally better off dead. They hate us and want us to die. Ironically, they might be doing us a favor by killing us.
just override the cockpit door code and take it over from there.
Hello,
Here is some crushed FUD for thought:
- As long as pilots are in the cockpit, they can pull circuit breakers and then it's game over for Stuxnet worm or whatever e-threat. For example in the Airbus A-320 there are 3 or 4 (3 digital +1 analogue) flight control computers, depending on how old or new make the plane is. Their juice can be denied by breakers on the cockpit overhead panel, one-by-one. This is how the logic works:
- When all 3 digital flight computers run and agree about the situation, it is "normal law": pilot moves joystick, computers decide if it is both absolutely safe and comfortable to do so and when affirmative, execute the manouver.
- When only 2 computers run or 1 cpu has been voted out by the majority, it is "alternate law": pilot moves joystick, computers decide if it is reasonably safe to do so and if yes, execute the manouver (maximum pax comfort be damned and alpha floor stall protection is partially lost).
- When only 1 computer runs, it is "direct law": pilot moves joystick and the computer forwards the instruction to electro-hydraulic actuators, to execute the manouver in a brain-dead manner.
(Passanger comfort be damned and for safety, hope that the pilots are skilled and talented aviators who will keep the plane flying. That is not always a given for the younger generation, e.g. the button-pushers who crashed the AF flight 447. On the other hand, computer circuit breaker pulling, until reaching "direct law" was the very method which Lufthansa pilots followed for rescue when the speedometer of their A-320 froze up and confused computers wanted to send the plane into a never-ending descent under "normal law".)
- When 0 digital computers remain running (e.g. giant EMP from a nuke or nearby supernova) pilots would have somewhat limited tools remaining on the newer model year Airbus-320 planes, such as:
The foot pedals (rudder) are still mechanically connected with steel rope and pulley to the rudder sail in the tail, allowing turn to the left and right.
The trim-wheel is also mechanicall connected to the little adjustment tabs on the horizontal flying tail, allowing limited control of descent and climb.
Jet engines' power can also be controlled manually to allow for descend/climb and near-idle before landing (but without FADEC computerized help the pilots must be careful not to wreck the turbines with sudden moves on the thrust levers)
All this is a very tricky situation, therefore much drilled in flight simulator training!
- Unlike the Airbus A-320, the Boeing's B-737 is not fly-by-wire, as it is derived from an early 1960s design and big fleet customers, like Ryanair are outright banning Boeing from any innovation, not willing to spend a penny on pilot re-training!
This legacy-mania is how Helios airlines' B737 crashed: the pressurization to give breathable air at high altitude is completely under manual control on B-737 and activation is often forgotten. By the time the warning siren sounds at over 3000 meters altitude, pilots can be too mountain-sick to react properly in time and faint. A hungarian Malev airlines B-737 almost crashed under eerily similar circumstances a few years ago, so Helios was not a unique occurance. The landing gear is similarly full manual operation, that's how the polish wrecked a B-767 last year. Yet large fleet customers ban Boeing from improving ergonomy and foolproof-ness, not wanting to spend on any pilot re-training.
If it weren't for Airbus, Boeing would still be making airplanes with "swiss watch filled cockpit dashboards" because they carry a lot of legacy and the existing customer base / operators are very resistant to any change that would mandate personnel re-training. Glass cockpit (LCD screen) displays, electronic flight controls are all thanks to Airbus in the world of civilian aviation and Boeing is slowly following, due to the fuel economy benefits fly-by-wire and FADEC provide.
- The big problem is airlines no longer allow their pilots to fly general aviation (soa
Movie-Plot Threat Contest entries.
Best Slashdot Co
Are you saying the laws against "computer hacking"* were written by democrats?
* Without defining what that is, making for very convenient law for the prosecution.
Scorpion will stop the hackers.
In point of fact, some internal GovSec articles specifically point out that even an air gapped system can't prevent induction wires that run through an airframe within range of seats from being impacted.
Nice try, guys.
That said, paranoia won't help you. Nor will profiling African American citizens. Your real threats are Saudis, Bahrainis, Pakistani and Yemeni citizens and their British relatives you radicalized.
As your own internal NSA data tells you, but you keep ignoring it so that Americans will all live in Fear.
-- Tigger warning: This post may contain tiggers! --
Brad Haines had a really good presentation at blackhat on another aspect of the vulnerability of the new ATC system in 2012, too. https://www.youtube.com/watch?...
AFAIK, the GAO was originally supposed to "investigate, at the seat of government or elsewhere, all matters relating to the receipt, disbursement, and application of public funds". In this, they usually do a pretty decent job, and even remain reasonably apolitical. Of course, you can't build an empire while restricted to your original task.
Clearly, it's a logical extension: from accounting expertise to the evaluation of cyber-security in avionics computers. /sarc
Seriously, there really needs to be a mechanism to close down and reboot an agency from scratch every 10 or 20 years. Clear out the deadwood and refocus the agency on its actual mission.
Enjoy life! This is not a dress rehearsal.
Good-bye, Mr. Chips!
(Or, why that missing Malaysian Airlines MH370 is a really, really big deal --- besides the murder of 239 souls aboard.) Onboard flight MH370 were twenty employees of Freescale Semiconductor, a major microchip producer, owner of major fabrication facilities (referred to as foundries in the industry).
Back in 2012, some researchers at an institute connected with Cambridge University discovered a backdoor, at the hardware level, in the Actel/Microsemi chip used for military purposes, designed and manufactured by the Microsemi Corporation. What the authors didn’t mention in their highly technical paper was that these chips are also to be found in ARINC avionics (ACARS: Aircraft Communications and Addressing Reporting System, formerly known as ARINC Communications and Addressing Report System --- plus other avionics communications systems), transponders and the black boxes (flight data recorders, cockpit voice recorders, crash recorders, etc.).
Microsemi chips are produced at Freescale foundries, as well as Freescale chips are also to be found in ARINC avionics, transponders along with a wide range of other industry applications.
It is important to note that the owners of Freescale Semiconductors are the Blackstone Group, the major private equity/leveraged buyout (PE/LBO) firm, and the majority owner, and the Carlyle Group, another PE/LBO firm and a minority owner.
It is also important to note that ARINC (designer and manufacturer of major avionics systems (fly-by-wire) aboard Boeing and Airbus jets was until recently owned by the Carlyle Group, and a portion of ARINC still is, as they moved ARINC’s DoD division over to Booz Allen, the major government intelligence contractor (where Edward Snowden last worked in America), and also owned by the Carlyle Group.
Malaysian Airlines, which may have figured into it, was at that time partially owned by the hedge fund of Lord Jacob Rothschild, long an advisor to the aforementioned Blackstone Group.
The previously mentioned Microsemi Corporation, whose chips are backdoored, or compromised, is managed by James Peterson, CEO and board member. Peterson is one of the sons of Peter G. Peterson, founding member of the Blackstone Group.
Both the process of chipping (purposely introducing defects into chips for cryptographic penetration) and backdoors in chips, dates back to the late 1950s and 1960s.
When the U-2 spy plane was shot down over the Soviet Union, it contained chipped cryptographic communications gear, developed by the NSA at the instigation of the CIA, which the CIA hoped the Soviets would copy, allowing deep penetration by the NSA. Unfortunately, this was around the time of the real defection of two NSA employees (Martin and Mitchell), so after being given the coordinates of the U-2’s air route by previous “defector” Lee Oswald to allow the Soviets to shoot it down, they were now possibly savvy to the covert operation’s agenda.
The first major successful operation involving backdoored chips was supposed to have occurred in the 1980s, when an American industrial controls computer system (SCADA) was sold illegally through a Swiss firm to the Soviets, and resulted in a series of major explosions at their northern Baltic Sea naval installation (chips set to control maximum temperatures of fuels did the opposite).
When a group is seeking to compromise, and therefore control, both the Internet and a wide spectrum of computer hardware applications (communications, transportation, industrial, financial, etc.) the process of chip access is crucial, and to do that covertly it must be done at the chip fabrication point.
Hence the use of, and subsequent disposal (murder), of those Freescale Semiconductor engineers aboard flight MH370. Below is the youtube link to a video from a SAIConference (SAIC, is one of the two government intelligence contractors, the other being Booz Allen), the expert from University College Londo
Hey I can't wait for the giant "McAfee certified" stickers on the sides of planes. Watch out for the "My Clean 747" ones though...
-- You are in a maze of little, twisty passages, all different... --
Balint Seeber gave a talk at DEFCON in 2013 that showed everyone how much is out there to be sniffed using a twenty dollar SDR kit. www.spench.net
Also see DefCon 22's avionics preso from 2014:
https://www.defcon.org/images/...
Hey I can't wait for the giant "McAfee certified" stickers on the sides of planes. Watch out for the "My Clean 747" ones though...
Well, it wouldn't be the first time McAfee crashed something.
The GAO is Congress's research arm, they were asked to analyze the effectiveness of the FAA's role in assessing cybersecurity risks and they did as requested. This is a role the GAO has played for at least my entire lifetime (born in 1978). In fact this articles says that the research function started to expand in 1967 when Congress asked the GAO to research the effectiveness of the newly enacted anti-poverty programs.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
For a chilling documentary of airline hacking you need look no further than the first episode of this.* Watch, and be scared!**
* Hey, if they're going to claim "based on a true story" in the title credits, I'm going to call it a documentary!
** Oh, you'll be scared all right. Not to mention revolted and sickened. Just not necessarily at anything having to do with airline safety.
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.
The GAO is Congress's research arm,
Huh, I would have sworn that role belongs to the Congressional Research Service http://www.loc.gov/crsinfo/ since it is their entire damn name!
"the Government Accountability Office (GAO) warns that the U.S. Federal Aviation Administration may be failing to address cyber security vulnerabilities that could allow remote attacks on avionics systems needed to keep the plane airborne"
Have they tried not connecting their avionics systems to the Internet?
anon: "Unlike the Airbus A-320, the Boeing's B-737 is not fly-by-wire, as it is derived from an early 1960s design and big fleet customers, like Ryanair are outright banning Boeing from any innovation, not willing to spend a penny on pilot re-training!"
..
Do please expand, how exactly are Ryanair preventing Boeing innovating, provide references and citations
TCAS, ACAS and ADSB report aircraft positions, etc., and are easily faked. Air Traffic Control already depends upon these systems as radar gets fazed out (ask Australian ATCs what they thought of planes disappearing from their French-made "radar" screens in poor signal conditions or when the system didn't recognise transponder codes). I'm surprised there haven't been serious issues with this already but when we start seeing ATC remotely flying planes then these will be some of the easiest things to exploit.
General Accountability Office?
Weird how they have two completely different departments (the other one is the General ACCOUNTING Office), that do completely different things (one does accountability, the other accounting), using the same TLA (Three Letter Acronym). That's just freaky!
How hard can it be to have the Wifi network completely separated everything else? The only thing it shares, is electricity. How can anyone go form the WiFi to the plane's network in that case?