Chris Roberts Is the Least Important Part of the Airplane Hacking Story

chicksdaddy writes: Now that the news media is in full freak-out mode about whether or not security researcher Chris Roberts did or did not hack into the engine of a plane, in flight and cause it to "fly sideways," security experts say its time to take a step back from the crazy and ask what is the real import of the plane hacking. The answer: definitely not Chris Roberts. The real story that media outlets should be chasing isn't what Roberts did or didn't do on board a United flight in April, but whether there is any truth to longtime assurances from airplane makers like Boeing and Airbus that critical avionics systems aboard their aircraft are unreachable from systems accessible to passengers, the Christian Science Monitor writes. And, on that issue, Roberts' statements and the FBI's actions raise as many questions as they answer. For one: why is the FBI suddenly focused on years-old research that has long been part of the public record.

"This has been a known issue for four or five years, where a bunch of us have been stood up and pounding our chest and saying, 'This has to be fixed,' " Roberts noted. "Is there a credible threat? Is something happening? If so, they're not going to tell us," he said. Roberts isn't the only one confused by the series of events surrounding his detention in April and the revelations about his interviews with federal agents. "I would like to see a transcript (of the interviews)," said one former federal computer crimes prosecutor, speaking on condition of anonymity. "If he did what he said he did, why is he not in jail? And if he didn't do it, why is the FBI saying he did?"

Comments

not the real question

[ganjadude]

the real question to be asking is that if what the FBI is claiming is true, why has the FAA not grounded all planes of the same make yet? they have grounded planes for less in the past, the FAA doesnt really mess around

Re:not the real question

[qeveren]

I doubt what the FBI is claiming is true, but you gotta market the fear somehow.

Re:not the real question

[damicatz]

The FBI isn't claiming anything. The affidavit simply states that Chris Roberts told the FBI agents he was able to hack the avionics of the plane.

Frankly, it's complete bullshit. The systems are completely, physically separate. There is no way to hack the thrust from the in-flight entertainment system because they are not connected to each other. The most he'd be able to do is turn on the fasten seatbelt sign.

Re:not the real question

[Penguinisto]

This, right here.

Seriously - entertainment and flight controls on subnets that are reachable from each other? What the hell was the engineering team drinking/snorting/smoking/shooting that day?

I'm thinking that due to the lack of an emergency TCTO* , and lack of any corroborating evidence (seriously, you'd think a pilot would notify *somebody* if his airplane did something way out of the ordinary like that, even if to report bad wind turbulence/shear/whatever as a warning to ATC and other pilots in the same path)?

Yeah... not so sure the FBI's assertion holds that much water. Awaiting more evidence and/or corroboration on that one.

* Time Compliance Technical Order - at least that's what the USAF used to call it. Dunno what they call it nowadays in the civilian world.

Re:not the real question

[Mr D from 63]

The FBI isn't claiming anything.

Exactly. They are just saying what they are investigating based on claims from Roberts himself. Roberts meanwhile has been anything but clear on what he's done.

Re:not the real question

[Anonymous Coward]

Are you SURE it's all complete BS? Did you read the part about the ports underneath the seats that were useable? I'd like to think it's BS.

Re:not the real question

[mcrbids]

It's only bullshit if Chris Roberts was actually lying. And validating it is pretty straightforward: Did the plane yaw, as was claimed? Can Chris' software cause it to happen again?

It's a pretty simple test. And as far as Chris' treatment, if he's been trying to tell people about this vulnerability and getting the cold shoulder, he's as innocent as they get and should be compensated for time served.

Re:not the real question

[nedlohs]

So if Roberts was telling the truth he should be charged for hacking the avionics. If he wasn't telling the truth then he should be charged with making false statements.

Though of course the FBI will want to dig up evidence either way before doing anything. Even though it's obvious the second is the case. If a plane he had caused a plane to climb the pilots would have reported that the plane initiated a climb all by itself and the FAA would be investigating and probably grounding planes or having them disable the entertainment systems.

Re:not the real question

[AK Marc]

The affidavit simply states that Chris Roberts told the FBI agents he was able to hack the avionics of the plane.

It's not illegal to be "able" to hack something. A crime is an illegal act, done at a specific time and place. You can't charge someone with having killed "someone" unless you name that someone. You can't even charge them if you have a name of the murdered, unless you have a time and place named.

You can get a warrant for someone "able" to do it, and they did. If they arrested him, the charge should specify what he did that was illegal, and when and where it happened. I haven't seen a pic of the actual arrest paperwork, but the media stated it was for hacking a specific flight. This means that the media reports are that he was arrested for actually having caused a flight-path diversion mid-flight by controlling (at least part of) the flight control systems from his passenger seat.

Re:not the real question

[FlyHelicopters]

* Time Compliance Technical Order - at least that's what the USAF used to call it. Dunno what they call it nowadays in the civilian world.

The FAA calls them ADs, or Airworthiness Directives... You must comply with them for the aircraft's Airworthiness Certificate to remain valid.

An Emergency AD can be issued that takes effect right away, which is how the FAA often will "ground planes until they are fixed".

Re:not the real question

[ganjadude]

he made it clear that he did so in a simulator, not on a real plane in the sky. the FBI is taking it out of context to scare people and the media is complicit in this as well for not doing basic journalist research

Re:not the real question

[wonkey_monkey]

Frankly, it's complete bullshit. The systems are completely, physically separate. There is no way to hack the thrust from the in-flight entertainment system because they are not connected to each other.

What are your qualifications to be able to say so?

The systems should be separate. There should be no way to hack into avionics. That doesn't necessarily make it so.

If you really do know, then great, I am more informed than I was previously was.

Re:not the real question

[Anonymous Coward]

It's not about "the same make". They basically would have to ground EVERY fly-by-wire plane. In the first Certification for die Airbus 380 the FAA complained that the Flight control systems and the inflight entertainment system where not **sufficiently** firewalled from each other.

Remember the chaos 9/11 with a nationwide grounding for a few days caused? Now think that on an international level, for a year. Not gonna happen, no matter if the FAA doesnt mess around.

Re:not the real question

[wonkey_monkey]

You can't charge someone with having killed "someone" unless you name that someone.

Eh, I'm pretty sure you can. Here's one such case

You can't even charge them if you have a name of the murdered, unless you have a time and place named.

Again, that seems pretty unlikely.

Re:not the real question

[john.r.strohm]

The corresponding FAA term is "Airworthiness Directive" (AD). An AD is a very big deal.

The in-flight entertainment (IFE) systems receive navigation data from the flight deck computers so they can display the moving maps and other stuff on the entertainment displays, for those passengers who want to know "where am I", "are we there yet", "is it time to reset my watch because we've crossed a time zone and I'm trying to adjust my body clock".

I would be shocked to learn that Boeing allowed the IFE to put ANY kind of data into the flight deck computers. I'd actually expect Boeing to use a one-way interface, one that transmits but does not receive: think RS-232 with one of the pins removed. I'd be almost as shocked to learn that Airbus did something like that. However, Airbus's comment about "firewalls" does not exactly inspire me to confidence in their airplanes.

There's something else. If Mr. Roberts did in fact do what the FBI claimed he said he did, I would have expected the air up in the cockpit to have turned very blue, as the pilots said (screamed, actually) something along the lines of what the Apollo 8 crew said (screamed, actually) when their CSM did an uncommanded thruster burn. I would further expected them to take manual control immediately, get on the radio immediately, declare an emergency because of the uncommanded engine power setting change, and land at the nearest airstrip that could handle the airplane. I would further expect maintenance crews to pull the flight data recorders to find out WTF just happened.

Re:not the real question

[Livius]

if what the FBI is claiming is true

It's not. They stopped bothering to pretend.

Re:not the real question

[grimmjeeper]

The systems are completely, physically separate.

Considering that both the Avionics systems and the in flight entertainment systems are both able to reach the SATCOM radios, I'm not sure this assertion is true.

I've spent a great deal of my career working on avionics systems and did work on early Ethernet implementations in the late 90's, well before ARINC came up with AFDX/664 standards. Back then we restricted Ethernet to single point to single point dedicated channels with no switching or routing of any kind. The first vague ideas of having an in-flight entertainment network were starting to form. But at the time, it was just high level R&D.

From what I've been able to piece together is that Chris Roberts bought an under-seat device and hooked up something in his basement for proof-of-concept attacks into the avionics network. But without all of the rest of the equipment, he had to build up his system with commercial grade equipment. And that's where his "hacking the engine controls" story falls apart. Sure, he may have been able to get a specifically formatted packet through the IFE network and send it out the port that connects to the rest of the plane. And with his generic Ethernet switches, he may have been able to get that packet through to where he thought the engine control computer was. But his model is flawed.

AFDX/ARINC 664 is an entire structure built on top of the physical layer of Ethernet. While it may use Ethernet frames to pass the data, there's a ton of bandwidth management and strict routing management built on top of it. Assuming for the sake of argument that the avionics network was indeed set up correctly, there's no way an engine control packet coming from the IFE network would be routed. The filters would see that the IFE port isn't authorized to send that data and it would be dropped, perhaps with an error log of some kind. The only thing the IFE network should be able to talk to is the SATCOM radio and only within very specific parameters. There's no way a properly set up avionics network is vulnerable to an attack like this.

Of course, that begs the question. Did they set up their avionics network correctly? It's highly likely that they did, but I'm not going to say with 100% certainty that there are absolutely zero vulnerabilities. Suffice it to say, I'm extremely skeptical of Roberts' claims. But I will stop short of saying that he is, without question, full of it.

Re:not the real question

[g0bshiTe]

Name 1 reason an active port under an uncontrollable passengers seat needs to have access to avionics or any critical system?

Re:not the real question

[g0bshiTe]

Planes typically yaw in flight all the time, it's called dog tailing. There is a number of reasons why, the main is thrust typically every aircraft dog tails, the second is a change in wind direction, could cause the yaw to change. It's possible he is misinterpreting flight dynamics with something he was attempting to do.

Re:not the real question

[Archangel Michael]

For Troubleshooting (Semi sarcastic)

Re:not the real question

[Archangel Michael]

scare people

Best Motivation ever. Slightly ahead of Procreation.

Re:not the real question

[R3d M3rcury]

And I assume there are a couple of pilots on the flight who could easily verify if this was the case.

Re:not the real question

[bickerdyke]

Frankly, it's complete bullshit. The systems are completely, physically separate. There is no way to hack the thrust from the in-flight entertainment system because they are not connected to each other. The most he'd be able to do is turn on the fasten seatbelt sign.

Is the in-flight entertainmeny system able to show that world map with the cute little plane that indicates the planes position?

I doubt they have someone copying the updeted position from the avionics system to a USB-stick, unplug it from there and plug it into the entertainment system to update position data every few seconds...

There goes your "completly, physically seperate".

Heck yeah, it's trivial to make such a connection reliably one-way only, but even then, "physically seperate" would be an outright lie.

Re:not the real question

[SpankiMonki]

Name 1 reason an active port under an uncontrollable passengers seat needs to have access to avionics or any critical system?

History. As was pointed our to me in an earlier discussion on this topic, bean counters might have played a role in consolidating ALL electronic systems in an aircraft, thus tying its avionics with its in-flight entertainment systems.

Re:not the real question

[Anonymous Coward]

According to Bruce Schneier they're not physically separated: "Newer planes such as the Boeing 787 Dreamliner and the Airbus A350 and A380 have a single network that is used both by pilots to fly the plane and passengers for their Wi-Fi connections."

See also Figure 4 of this GAO report: http://www.gao.gov/assets/670/669627.pdf. There's a firewall protecting the command-and-control avionics from the passenger's network. Both the avionics systems and the passenger network utilize the same egress to the ground. Per the report: "Firewalls protect avionics systems located in the cockpit from intrusion by cabin system users, such as passengers who use in-flight entertainment services onboard."

Older planes had physically separate networks. Newer ones, not so much. Of course, maybe the security is bullet-proof. Doubtless there are access controls at the ethernet layer much more sophisticated than your standard network. And it'd be very surprised if Chris Roberts wasn't lying or grossly exaggerating. But regardless the systems are _not_ physically separate.

Re:not the real question

[Dunbal]

and the media is complicit in this as well for not doing basic journalist research

Nothing new here, lol. Status quo for the past couple decades or more. But hey remember that journalists are really HISTORIANS...

Re:not the real question

[phantomfive]

That's a great post, thanks

Re:not the real question

[phantomfive]

All you need for that is a separate GPS unit.

Re:not the real question

[dcollins117]

Planes typically yaw in flight all the time, it's called dog tailing.

You mean there is a plausible explanation that doesn't involve elite hackers controlling a plane fly-by-wire from the entertainment system? I wonder why the FBI never considered that.

Re:not the real question

[WaffleMonster]

The FBI isn't claiming anything. The affidavit simply states that Chris Roberts told the FBI agents he was able to hack the avionics of the plane.

This is the part I'm most interested in. Did Chris really say these things or did the FBI want to hear a specific narrative and perhaps twist or misunderstand his remarks about what he believes is possible into "something he did"?

Chris isn't talking and I'm disinclined to accept FBI statements at face value. I will be very interested in hearing Chris's account of what he actually said to the FBI.

Re:not the real question

[Anonymous Coward]

I've been to Roberts' lectures. There is a piece of information that he talks about but is left out his slide deck and other documentation that is missing in the media reports. That piece is the actual vulnerability itself.

Re:not the real question

[Anonymous Coward]

Great post.

From the WIKI page on afdx, it appears that AFDX expects all systems are physically connected together, but logically separated by routing tables in the switches. The logical separation seems fairly simple, so maybe it is not hackable. But 'maybe' is not a good word to have to use for this sort of thing. Without more info, it seems impossible to say. This really makes Airbus saying 'naturally' we don't discuss this stuff counterproductive.

The question is, from where he was able to connect, can he send packets to a box that in turn has the ability to send stuff to the flight control stuff (or the box controlling the routing)?

Perhaps he setup a test system in his basement with normal Ethernet switches and was able to do something interesting that would not have worked in the air with real AFDX switches?

Re:not the real question

[grimmjeeper]

Perhaps he setup a test system in his basement with normal Ethernet switches and was able to do something interesting that would not have worked in the air with real AFDX switches?

That's where the uncertainty comes in. Near as I can tell, it's "very unlikely" that what he built could hack an actual plane. But I can't say with 100% certainty that he hasn't found a weakness that can be exploited. I doubt he has. But it is theoretically possible.

Re:not the real question

[msauve]

Please tell, where can one find one of these things which accurately simulates in flight entertainment systems, flight control systems and the interconnection between them? I mean, apart from being an airline or aircraft manufacturer employee.

Re:not the real question

[AK Marc]

Nope. She was named, as Jane Doe.

Again, that seems pretty unlikely.

Sure, it seems pretty unlikely, but that's how it works. That was one of the delays with Hans Reiser. They "knew" he did it, but if they named a time, and they were wrong and he could alibi our for it, they'd never get a conviction. That's why they took so long, so they could narrow down the crime so they charged him with the right one the first time, or a murder could walk.

Re:not the real question

[Frobnicator]

The in-flight entertainment (IFE) systems receive navigation data from the flight deck computers so they can display the moving maps and other stuff on the entertainment displays, for those passengers who want to know "where am I", "are we there yet", "is it time to reset my watch because we've crossed a time zone and I'm trying to adjust my body clock".

I would be shocked to learn that Boeing allowed the IFE to put ANY kind of data into the flight deck computers. I'd actually expect Boeing to use a one-way interface, one that transmits but does not receive: think RS-232 with one of the pins removed. I'd be almost as shocked to learn that Airbus did something like that. However, Airbus's comment about "firewalls" does not exactly inspire me to confidence in their airplanes.

That is the concerning part.

Are the systems accessible in the cabin physically and electrically isolated from all other systems from the plane? I don't think so. I think they are connected. And I think they are more connected that the companies prefer to admit.

First, are the systems physically connected? My money is on 'yes', because of the very reasons you listed. The IFEs are able to get data from SOMEWHERE, the question is where that is coming from. In computer hardware it is extremely rare to make a unidirectional connection. If nothing else you want to acknowledge receipt. They get data about the flight, they have connections for the phones for those who pay for it, they have connections for the expensive wifi connections. Do the companies really provide two duplicate sets of radios, one for the passenger data, a second duplicate set for operations data? Seems the opposite of every business I've worked with that wants to save cost.

Assuming they are connected, how are they connected? Since companies want commodity and standard equipment, I would not be shocked to see Ethernet. And if it was Ethernet, the comment that the seat boxes use a "modified Ethernet cable" is not too surprising, since the RJ45-style jacks are easily damaged. There are many more standardized sockets and jacks available, including plain old pin and head units.

That is the question whose answer I don't trust: considering how IFE systems get data about the flight, and how they like share external communication systems, it seems almost certain the systems are attached, even if it is "behind firewalls". If data can flow somehow, there is a way to communicate.

Re:not the real question

[sjames]

The FBI got an actual warrant. mere capability isn't enough to get one of those. They have to allege that an actual crime has actually happened or is in planning. That crime (naturally) has to be possible. Further, they must show good reason to believe that the subject of the search is involved.

Pie in the sky hypotheticals don't cut it.

That doesn't mean it is actually possible, but it means either the FBI sincerely believes it is or that they are knowingly abusing their authority harassing an innocent citizen for their own amusement.

Re:not the real question

[sjames]

The best way to do that is using an opto-isolator connecting an RS-232 Tx from the avionics to an Rx on the entertainment system and push data across with no return path.

Re:not the real question

[Anonymous Coward]

Because a plausible explanation doesn't increase the count in the convicted felon column along the associated budget increase for catching 'criminals'.

Re:not the real question

[bluescrn]

That seems like a bad idea... Even if you can't communicate with critical systems, there could be the possibility of denial-of-service type attacks? And if the system can resist software-based attacks, what about a malicious user killing the network by somehow feeding a high voltage into a passenger-accessible network port?...

Re:not the real question

[Anonymous Coward]

That certainly used to be the way that it was done.

However, with increasing integration between systems - e.g. engine management systems wanting access to communications systems for remote monitoring and diagnostics, there was always pressure to integrate as much as possible onto either a unified network or separated networks with a multipurpose bridge.

The manufacturers seem to have gone for the latter option.

Re:not the real question

[Anonymous Coward]

You haven't met the FAA's bean counters. They don't care about dollars, as seen by their destruction of the middle class's ability to fly private airplanes. What they do care about is that every line of code, every rivet, every doodle in every engineering drawing is directly traceable to the next higher requirements document and that each line of each requirements document is traceable down to rivets and doodles and lines of code. Yes, fucking tracing literally to each line of code (DO-178C). So, the port is there because it has a reason, and the requirements include input validation on every piece of avionics (Inflight entertainment not an avionics, but still must comply with much of those rules).

Re:not the real question

[blindseer]

You can't charge someone with having killed "someone" unless you name that someone.

Also, would not that someone have to be proven to be dead? The FBI claims that Roberts caused a plane to move in a manner that resulted from his actions. If someone can show the movement was in fact because of pilot action, or from wind, then there is no crime. Right?

Re: not the real question

[Anonymous Coward]

It was not Apollo 8, it was Gemini with the uncommanded thruster burn. It was Neil Armstrong who didn't scream and brought the mission calmly to earth. That's why he is a real hero. Unlike you.

Re:not the real question

[Anonymous Coward]

You need to remember that avionics doesn't use the latest and greatest technology for critical data (i.e. it can make the pilot lose control of the aircraft) like Ethernet-based AFDX (ARINC 664). Critical data is still sent using ARINC 429, which is a twisted pair 100K bits per second serial bus with one transmitter and one or more receivers. You would have to get into the flight deck and physical disconnect the transmitter to spoof one of the receivers. The story is bullshit. I've written and deployed the software on business jets that taps a Flight Management System (FMS) ARINC 429 output bus to provide the moving map image of the little airplane on the cabin entertainment system. We were only receiving the data. No hacking of the avionics is possible from that interface. The FMS is used because it also contains the flight plan data showing where you came from and where you are going. You wouldn't want to use a dedicated GPS because it only provide present position, plus the aircraft manufacturer wouldn't want to install yet another antenna.

Re:not the real question

[AK Marc]

The article claims that the actual lice hack was done with default usernames and passwords. If that's true, the CEO of the airline should be in jail for 10M counts of criminal negligence.

Re:not the real question

[AK Marc]

Yes. If you are charged with the murder of Bob, by shooting him, and you can prove that he was dead from a heart attack, the most they can charge you with is desecrating a corpse, which wouldn't stick if you could prove that he was alive when you shot, and dead when it hit.

Hacking doesn't have to have an effect, though. It's not a crime to make a plane divert. It's illegal to try, whether or not you succeed. So that's different.

Re:not the real question

[ganjadude]

he is a security researcher, I would assume that he has access to that kind of thing

Re:not the real question

[msauve]

Well then, I'll just assume you're wrong.

Re:not the real question

[sjames]

But surely at a major demarcation like critical network and barely secured passenger entertainment, that measure is still warranted. There is simply no reason the engine controller will ever be interested in how many people are reading buzzfeed or what the in-flight movie is.

Re:not the real question

[Anonymous Coward]

"Frankly, it's complete bullshit. The systems are completely, physically separate. There is no way to hack the thrust from the in-flight entertainment system because they are not connected to each other."

There are a few aircraft where this is not the case. Sadly. The GAO published a report that covers many vulnerabilities in the new ATC system in which we're expected to operate and for the B787 and A350, those aircraft are specifically called out as vulnerable. That is, their systems are not designed as you and I would think they should be.

The report doesn't get too much into details, but my thought is that the systems may only be as separate as say two computers in your house using the same switch. I've had to eat crow on this one because I, too believed this was absolutely UNPOSSIBLE!!!!11!1!

Now, I'm just glad I'm not in command of any of these modern machines for the time being. My trusy steed, made in the 1950s, still has cables, pulleys, and a good amount of automation left up to the meatsacks in the front seats. You can't do anything from the back except bitch about the ride. ;-)

Re:not the real question

[Anonymous Coward]

TYpical Slashdot...if you'd bother to read the article and summaries from earlier you'd have found out he'd built his simulation from 'public available information' as well as from sniffy networks on planes via access to the SEB port (or so he claims)...all Roberts is NOT claiming is that he didn't cause an actual plane to move in any direction, send commands to the plane etc.

Re:not the real question

[Anonymous Coward]

That's all you would need. That's not what happens, though. The plane's position is usually read from the #1 FMS (for the aircraft I fly). For others, it may be #2 or #3 if so equipped. FMS isn't a GPS, it's simply an aggregator for position information. It constantly tunes the nearest VORs and checks distance, triangulates, and reads GPS position from the (usually there's at least two) GPS unit, and any INS or IRS installed. Everything is crosschecked and the most accurate position is used.

Re:not the real question

[aaarrrgggh]

Maybe a stupid question, but can't you modify the port driver/settings to broadcast data on the RX pin for most systems?

Re:not the real question

[Anonymous Coward]

If they were concerned about maintaining an air gap and cutting costs, it'd be simpler to just load the flight plan and plot the cute little plane where it's supposed to be at a specific time into the flight.

Next to the cute little plane is usually other information like airspeed, altitude, and air temperature, so it's likely coming from a flight computer. You can still airgap that to an extent with a unidirectional serial link.

Re:not the real question

[Anonymous Coward]

Which the media will gladly follow, and the general populace be satiated with the current moment of fabricated fear.

It's almost like you can spot this crap coming years ahead. Does most of the public have the memory length of a goldfish? Positively stupifying...

Re:not the real question

[Anonymous Coward]

The affidavit simply states that Chris Roberts told the FBI agents he was able to hack the avionics of the plane.

It's not illegal to be "able" to hack something. A crime is an illegal act, done at a specific time and place. You can't charge someone with having killed "someone" unless you name that someone. You can't even charge them if you have a name of the murdered, unless you have a time and place named.
 

There are various conspiracy charges though: https://en.wikipedia.org/wiki/Conspiracy_(criminal)

Re:not the real question

[JeffOwl]

If he did this on an actual aircraft in flight (he didn't, it's BS) then he put the lives of everyone on that plane in danger. They don't let flight control software on a plane without a well understood pedigree for a reason and he was mucking with that. If he did this on an actual plane in flight (he didn't) he belongs in jail. If he didn't do it (he didn't) then he is basically confessing to a crime that wasn't committed, and perhaps he should be committed himself, that or the FBI is full of shit and it wouldn't be the first time for that. If the entertainment system actually has a way to send data to the critical flight control systems then a bunch of engineers and executives belong in jail right beside him, and throw in some FAA folks for good measure.

Re:not the real question

[Anonymous Coward]

The FBI have been staging terrorist events to "keep the fear alive" for a long time, I wouldn't be surprised if they are laying the ground work for an upcoming event.

Re:not the real question

[ganjadude]

if you did your research you would see my assumption was correct.... the info was available for a while now

Re: not the real question

[cunina]

But that doesn't make any sense, either. Even if the flight just happened to dogtail when he sent the alleged "CLB" command, what did he send that command to? It's well known that the avionics only has one-way communications with the IFE system. It's as if he plugged his laptop into the box under the seat, opened Xterm, typed "CLB" and expected something to happen.

Re:not the real question

[stephanruby]

Frankly, it's complete bullshit. The systems are completely, physically separate. There is no way to hack the thrust from the in-flight entertainment system because they are not connected to each other.

Let's go to the actual claim he made which was recorded by the tech media, long before he was arrested for his tweet.

He claims he was able to hack the simulator of a plane to access the thrust (not a real plane mind you, the simulator of a plane). Is the simulator as good and as realistic as he claims it to be? or not?

Since you seem to be an expert yourself on this subject, please tell us. Are the electronics of the simulator he used a good replica of the electronics found on an actual plane? Or did the guy just play Microsoft SimFlight and found a way to hack Windows XP?
 

Re:not the real question

[Anonymous Coward]

"AFDX expects all systems are physically connected together, but logically separated by routing tables in the switches" ...aaaand game over. Separation which relies on software configuration of switches can be subverted by changing the configurations. VLANs do not firewall zones make. Physically separate units do.

Re:not the real question

[citizenr]

I doubt what the FBI is claiming is true

of course its true, they found hair evidence and everything!

Re:not the real question

[Anonymous Coward]

I basically agree, but I wonder what is the additional risk implied by having no return path - no acks, no status? Everyone else has them, because otherwise things go wrong - so they aren't worthless.

And one day, what if the engine controller hasn't seen this movie, and it's bored? "Hello, Engine Controller? Are you with me?"

Re:not the real question

[Anonymous Coward]

Posting anonymous for a good reason; But let me tell you that this is possible and has been for quite a while. You just need to press triangle, triangle, circle, square, cross, triangle during the loading screen of In Flight Tetris. Whenever a long block shows up, you can use the regular controls to make it fly sideways, rotate and quick drop the airplane.

Re:not the real question

[wonkey_monkey]

Nope. She was named, as Jane Doe.

Which is not her name. Well, it might be, but it almost certainly isn't.

Re:not the real question

[Anonymous Coward]

Name 1 reason an active port under an uncontrollable passengers seat needs to have access to avionics or any critical system?

History. As was pointed our to me in an earlier discussion on this topic, bean counters might have played a role in consolidating ALL electronic systems in an aircraft, thus tying its avionics with its in-flight entertainment systems.

There's no way any designer would mix a Safety Critical System with a Non-Safety Critical System, no matter what the cost "benefits" might appear to be...

DO-254 requires an astronomical (ha!) amount of verification and hence effort/cost. The physical segregation of Safety Critical Systems from Non-Safety Critical Systems is essential to reduce complexity, improve predictability and decrease verification costs. Keep in mind that the verification of these systems costs 100x what it does to design and implement them (if not more).

In saying that, you can run a black channel (safety critical information mixed with non-safety critical information), but as per IEC-61784, these must be categorically protected against masquerade (as well as the usual sources of error). So even if our chump of a hacker could gain access to the network, they would be unable to influence any Safety Critical Systems.

Bean counters don't sit at this table.

Re:not the real question

[Anonymous Coward]

"Seriously - entertainment and flight controls on subnets that are reachable from each other? What the hell was the engineering team drinking/snorting/smoking/shooting that day?"

You see this stuff a lot in control networks. eg:
- SCADA
- Automotive CAN bus, etc
- etc

These systems were designed with reliability and fault tolerance as the number one priority. They frequently fail to consider an intentionally malicious user.

Re:not the real question

[bickerdyke]

Giving the benefit of doubt, that has probably been done here. But then, "connected by a opto-isolator" is NOT "physically seperate". Claims like these cross the line from "dumbed down to wrong" to "obvious BS" when they go like "practically physically seperate"

Re:not the real question

[msauve]

So, he created a simulator by adding a second subnet to his DD-WRT router. Sorry, but it's bullshit, or he or you could easily point to these publicly available documents which perfectly describe the security hole. No need to build a simulator or sniff a real network, because it's already documented.

"all Roberts is NOT claiming is that he didn't cause an actual plane to move in any direction, send commands to the plane etc."

Let's see. Parsing double negative, so "Roberts claiming he did cause an actual plane to move" is allowed to be true.

Re:not the real question

[Xiaran]

No. It is because when the generic olive skinned hijackers take over the aircraft the hero can hack into the system with the assistance of the plucky, attractive flight attendant and save the presidents life. Duh.

Re:not the real question

[aaaaaaargh!]

If he wasn't telling the truth then he should be charged with making false statements.

You're so right. But why stop there? Not only he should be charged for making false statements, everyone who writes something false on the Internet should be charged!

Re:not the real question

[sjames]

The risk would be that the little airplane icon and the ETA on the passenger monitors might be wrong. That seems like a small risk to be assured that the critical systems are safe from hacking.

Re:not the real question

[Anonymous Coward]

if he's been trying to tell people about this vulnerability and getting the cold shoulder, he's as innocent as they get

Not if (and it's a big if) he did this on a plane in flight, with passengers on, he's not.

Re:not the real question

[Anonymous Coward]

"consolidating ALL electronic systems" does NOT save money. Changes to the system require design changes, reviews, testing, certification changes. That would easily result in $100M of upfront costs before a single plane was sold. Furthermore, avionics are supplied by other vendors; you're not going to get 10 different equipment suppliers to agree on one All-Electronic-System. Furthermore, you lose fault tolerance; one All-Electronic-System doesn't have a backup.

Re:not the real question

[Anonymous Coward]

> It's not illegal to be "able" to hack something.

Very true. Otherwise all car drivers should be put in jail because they are "able" to run over someone and to kill her/him.

Only actually doing it is illegal, as it should.

(See? And I even have a car analogy!)

Re:not the real question

[AK Marc]

I never said the person murdered must be identified, but that they must be named. The law handles it by naming unknown people. Note, the law doesn't require the name be real, or correct. Jane Doe identifies the dead body he's accused of murdering.

Re:not the real question

[dbIII]

Frankly, it's complete bullshit. The systems are completely, physically separate

That's the sane thing, but then again the sane thing would be to not have a single Automatic Teller Machine connected to the internet.
Are you certain that the systems are on networks with an air gap? Are you certain that stupid shortcuts (such as I've seen in POS machines and other stuff that should never be so vunerable as they are) have not been taken? While it should be the case that the systems are completely, physically separate I don't think we can be so confident that it is actually the case considering the very large number of networked systems in these planes, requirements to keep weight down and a desire to minimize costs.
It would be nice if you are correct, but I don't think access is as unlikely as you suggest.

Re:not the real question

[dbIII]

I'm not sure if that would be a problem due to the sort of redundancy where bits of an exploded engine can cut a lot of cables (A380) and there's still enough of a network to tell most of the systems on the plane what to do.

Re:not the real question

[Anonymous Coward]

The FBI does not claim anything. Roberts claims he did that, and the FBI is investigating whether that is true or not.

Re:not the real question

[nedlohs]

Because writing something on he internet is not talking with government agents and hence does not fall under https://www.law.cornell.edu/us...

Re:not the real question

[Jason Levine]

No. It's the hero's geeky friend who hacks into the system which buys time for the well muscled hero to overpower the generic olive skinned hijackers (who are armed with machine guns that they somehow smuggled on board) with his bare hands and whatever he finds lying around.

Re:not the real question

[deadweight]

I am a commercial pilot and the term "dog tailing" is a new one for me. Also I would *very much* notice an uncommanded change in engine power.

Re:not the real question

[cgfsd]

At DefCon last year there was seminar on plane hacking given by what I consider a definite expert. He was a commercial airline pilot and certified mechanic and a computer hacker to boot.
Other than the 777, the avionics of a plane do not use TCP/IP and therefore cannot communicate with a PC without a special adapter plugged directly into the avionics.
Awesome seminar, but the speaker did bring up the potential in the future if airplane builders were not careful.

Re:not the real question

[Hognoxious]

Really? Who was he working with? Nothing about it in TFA either.

Re: not the real question

[Anonymous Coward]

But just like you, right? lol

Re:not the real question

[deadweight]

The data connections on my boat use opto-isolators to keep any receiver of the GPS data from corrupting it or loading down the transmitter until the signal drops too low to be read. The LED-photo transistor pair is completely incapable of sending data two directions.

Re:not the real question

[Bill_the_Engineer]

Yep. He took off his sunglasses and said "The crook doesn't have a wing or a prayer" and music from The Who started playing from his iPhone.

Re:not the real question

[Coren22]

Would the pilots be able to tell the difference between a gust of wind yawing the aircraft and the engine thrust increasing/decreasing momentarily and causing the yaw instead? I doubt that they pay that close of attention to the engine readouts when there isn't an issue.

Also, if he did do what the FBI claims, wouldn't it be recorded on the black box that the engine RPM changed when the physical controls didn't move?

Re:not the real question

[cyberchondriac]

Even more than just seems like.. if actually true that these systems are not physically separated, that's careless design. It's naive and well, arrogant, no matter how good the firewall supposedly is, especially in this post 9-11 era. It'd be just another example of how broken and meaningless security theater is.

Re:not the real question

[Anonymous Coward]

The cabin systems are typically ethernet over copper - although some fiber might be used for backbone.

The avionics systems are never ethernet - instead, they use a specific aerospace grade networking system such as ARINC 644 or AFDX. These systems share a layer 1 PHY with ethernet - so they can use RJ45 cable, or SFP/fiber, in order to keep costs down - but logically, these systems are greatly different at layer 2 - not least because they are designed to provide deterministic, fault tolerant, isochronous delivery of data. In addition, both ARINC and AFDX systems are logically a point-to-point system, as all port-to-port routes must be programmed into the switch; the switch does not automatically map out the network like an ethernet switch does.

There are bridge devices which go between the two networks which are called "network extension devices" or NEDs. These are effectively firewalls and data format converters, converting data from ARINC frames into IP datagrams/streams and vice versa.

The idea is that the NED would sit between the avionics network and a comms network - so that flight data could be exported to the IFE system, and also to communications systems (for transmission of diagnostic data to base, etc.) The cabin network would be connected to the comms network via a separate firewall.

Re:not the real question

[Anonymous Coward]

"But it is theoretically possible."

Right, and the leading line of theory is that he could enter the infotainment system using the default user/pass, then hack the s/w in that system, then the AFDX was set to allow that system access to the flight systems. The question remains, without changing the AFDX routing, but owning the infotainment computer, can he get to a flight control system, or to another box that can get to the flight control system, or to something that can adjust the ADFX routing? The fact that Airbus 'naturally' does not want to talk about it gives one pause.

In other words,
First plan would be to airgap the systems. This appears not the case.
Second plan would be to logically airgap the systems with nothing except the AFDX routers straddling the gap. This might be ok. The theory is that this is not the case.
Third plan, there is a box straddling the gap, and safety depends on the s/w in the box being bug free. The FAA should not allow this to happen.

Re:not the real question

[AeroMed45N]

Except that the planes he claimed to have hacked do not have AFDX networks on them. He claimed United 737-NG and A320s. Those are older ARINC 429 aircraft. I can't imagine the IFE has an ARINC 429 transmitter connecting it to the thrust management unit.

Re:not the real question

[grimmjeeper]

You really don't know much about how AFDX partitions the network, do you?

Re:not the real question

[SvnLyrBrto]

The last time I flew, the little map w/ the airplane icon gave only a very rough approximation of where were actually were. Just from looking out the window, it was apparent that it was tens of miles off... almost 50 at times. (It was showing that we were way down by Moffat Field, when we were *landing* at SFO.

So, on Virgin America's A320s at least, I highly doubt that the passenger entertainment map data comes from any FMS. The thing would be useless to the pilot if it was that far off.

Re:not the real question

[Anonymous Coward]

Actually, the systems do share the data bus (network). I have ALWAYS thought it was a really STUPID idea to do this. It was done to save weight and simplify installation (less stuff to install) all of which saves time and money during construction and money during operations.

Re:not the real question

[Anonymous Coward]

I am sure there is a way, you just don't know what it is or how to exploit it yet.

Re:not the real question

[Anonymous Coward]

The hero's girlfriend hacks the system to blink the lights (it's night) while the hero fights. A feminine scream is heard! The lights return. The last olive has taken the girlfriend hostage! It's about to shoot, when a giant shark jumps up from the ocean and eats the plane! Hero uses the distraction to kill the olive, and the shark vomits the plane on Vegas strip (Vegas is a harbor city, right?).(make some reference to Jonah so we can market this to religious fringe). Hero wins it big in casino, orders olive sandwidch, makes an olive/olive skin joke, eats it. The End.

You can send royalties to bitcoin:1DcDuGdWvrDkALgEG6Y1r8X646pVi1DD37.

Re:not the real question

[grimmjeeper]

If that's the case, I'd assert that it's even less likely he was able to hack in.

I've written more than my share of ARINC 429 drivers and code that uses them. Hacking into a box at one end of a 429 connection so you can pass the data you want is significantly harder, especially in older aircraft which use more primitive operating systems (if they use an operating system at all). It's not like they're running off-the-shelf Linux with everything enabled. If they have a full operating system it will be something like VxWorks or Green Hills Integrity. Beyond that, you're not using the full RTOS, you're using the ARINC 653 compliant subset that has some pretty robust partitioning. And when you set them up for your system, you take out the parts you aren't planning on using so you have less to certify. There are no service ports left open on the IP stack. There are no terminals or file transfer services to hack into. Hell, many (most?) of those types of systems don't even have a file system at all. And if you're trying to hack a pre-RTOS era box, you have an IP stack that was customized specifically for the box to provide only the services required for that box and every other port will be closed. They were pretty adamant that the ports we were going to use were the only ones you could use when I had to run my IP stack through the testing gauntlet in the pre-RTOS days, not to mention that every single packet had to be screened for validity before it was accepted. They did quite a bit of testing to make sure we didn't have any "undefined behavior" resulting from corrupted or incorrectly formatted packets.

If you manage to get hacked packets to the box, you still have to find your way through the very custom software to get anything specific out of the 429 port at the other side. Which in most cases is virtually impossible because it's specifically designed to pass only the data it expects to pass. Then you have to deal with how to get the data you want through the 429 network. That's a network which has very specific message handling built into it and each computer using it configures their software to route the 32 bit packets very specifically. Keep in mind that 8 bits out of those 32 bits is the routing label that determines what the packet is used for. If the receiver isn't expecting a specific label, it will drop the packet. Beyond that, 429 is a single point to single point connection. The protocol has no provision for routing packets past that. You have to specifically design a computer to forward the data between two connections. And when you do that, you only route just the very specific data you want to route. You don't design it to accept any data from anywhere and pass it on to everywhere else. That's a huge safety hazard. Engine control data coming from the GPS interface simply doesn't get passed through the data concentrator because that's not where it's designed to come from.

If that weren't enough, you have to add in the fact that out of the 32 bit packet, you really only have 21 bits for payload, broken up in a couple of different ways depending on what you're sending. Every given routing label identifies what data is being sent. And for a lot of it, they only ever send one packet on a periodic basis for status update. It's a lot less common to send multi-word packet sequences. Even then, they're very specifically formatted and there's heavy range checking and so forth on expected vs received values for safety reasons. So it's not like there's a lot of room to pack in anything to hack with.

The more I read about this the less I believe he could actually hack a real plane.

Re:not the real question

[Anonymous Coward]

I think if you try to shoot someone and don't succeed it's called assault and still illegal.

If you attempt to rob a bank and are caught that's probably illegal too.

Re:not the real question

[Anonymous Coward]

Yes, there's a main core network: but the switches do the policing. For each LRU (line replaceable unit) that plugs in to the physical ports on the switch, the ethernet ports (virtual links) on which it communicates on are predefined and open, everything else is shut off and dropped by the switches as default. If you're not plugged into the right port physically, you won't see or be able to send messages that you shouldn't and to prevent DDOS with known messages there are BAG (bandwidth allocation gap) limits. You would have to modify the switch config before it would work.

Not saying it's impossible, but it's harder than it sounds.

Re:not the real question

[Anonymous Coward]

The FAA messes around ALL the time. They didn't ground DC10s with the failing cargo door. They didn't put out "airworthiness directives" against 747 with the cargo door. They didn't ground 737's with the potential for the rudder hard-over condition. They have the dual, often incompatible, missions of ensuring flight safety and promoting the airline industry.

Re:not the real question

[Anonymous Coward]

i imagine a brief look at the N1, N2, and RPM settings would establish altered engine performance, and any airline pilot that missed those indication would/should be frigging grounded...

Re:not the real question

[AK Marc]

If you attempt to rob a bank by burning down an abandoned farm, but your charges won't be for attempted robbery.

Same as if you attempt to "murder" a dead man isn't "assault". It may be a crime, but not the one he was charged with.

Re:not the real question

[Anonymous Coward]

When does the plucky, attractive female flight attendant fall down in front of the scary monster as she flees and then start to scream?

or is that a different movie?

Re:not the real question

[MidSpeck]

As others have pointed out, the systems are NOT physically separate. Just logically separated. That's my only nit with your comment. See also this comment from a previous article: http://tech.slashdot.org/comme...

Re:not the real question

[MidSpeck]

You are correct. The systems are NOT physically separated. Just logically separate. See also: http://tech.slashdot.org/comme...

Re:not the real question

[StikyPad]

Zoom in. Enhance.

Re:not the real question

[Anonymous Coward]

Cross reference 2 unrelated computer systems, neither one of which we have access to!

Re: not the real question

[Anonymous Coward]

"The systems are completely, physically separate."

How in the hell do you know this? Do you really know they are 'completely' and 'physically' separately; or are you assuming they are?

Re:not the real question

[kaizendojo]

Can you point out your source for saying this? I haven't seen a single article that mentions anything other than live flights. He was asked by the FBI to create a simulator to test security but that isn't where he claimed he got into the seat box from the OES to avionics. If I misesd something, I like to be able to be informed. If I didn't, then it would appear that your assertion is incorrect. I'm just looking for facts, not saying you're wrong.

Re: not the real question

[Anonymous Coward]

Given how long Roberts had been relatively unsuccessful at demonstrating any risk associated with in flight entertainment systems, I'd say he was making a flailing attempt at grandstanding and making false claims.

The data he got was probably part of the flight data feed that goes into making the little moving airplane you can watch on the map. I'd imagine that this would be a stateless UDP or similar system that simply transmits but can not recover data from the flight infotainment systems.

His level of sophistication in probably using something like wireshark to sniff some data from a live flight was illegal, stupid, and something any 12yr old equipped with Google could accomplish.

Re:not the real question

[Anonymous Coward]

If he did this on an actual aircraft in flight (he didn't, it's BS) then he put the lives of everyone on that plane in danger. They don't let flight control software on a plane without a well understood pedigree for a reason and he was mucking with that. If he did this on an actual plane in flight (he didn't) he belongs in jail. If he didn't do it (he didn't) then he is basically confessing to a crime that wasn't committed, and perhaps he should be committed himself, that or the FBI is full of shit and it wouldn't be the first time for that. If the entertainment system actually has a way to send data to the critical flight control systems then a bunch of engineers and executives belong in jail right beside him, and throw in some FAA folks for good measure.

jail everyone?

Let my peoples goes!

[countSudoku()]

I demand the immediate release of the good security guy Dread Pirate Chris Roberts!

Re:Let my peoples goes!

[TechyImmigrant]

I demand the immediate release of the good security guy Dread Pirate Chris Roberts!

He's not that good. He let himself get caught.

Re:Let my peoples goes!

[Dunbal]

Yeah they need to throw that other Chris Roberts in jail instead. Maybe at the next stretch goal.

Time to blame the messenger

[Anonymous Coward]

...when he uses the lives of others just to get attention for the FUD factory of which he is a part.

Federal Equivelent...

[sycodon]

It's the Federal equivalent of, "I smell marijuana, I need to search your car."

Re:Federal Equivelent...

[Dunbal]

Federal Officer: "I smell marijuana, I need to search your car". Smartass: First let me search your nose officer. Hey come on I was joking put the gun dow BANG BANG BANG...

Does anyone else see the similarity?

[Anonymous Coward]

Chris Roberts is the wwwyzzerdd!! http://www.yzzerdd.com/

Hmmm...

[fuzzyfuzzyfungus]

It's almost as though the FBI is being hamfisted and incompetent again; but that couldn't be right...

Re:Hmmm...

[tomhath]

More like an attention whore tried a little too hard to get attention.

Re:Hmmm...

[Anonymous Coward]

He'll get roasted and this will turn into another Aaron.

For some reason when computers get involved we all lose our brains and go on witch hunts. It's pretty much impossible to be a white-hat these days because just having the skill to perform penetration testing on a network is indistinguishable from necromancy. Heck, ping and tracert are practically Pagan rituals as far as society is concerned.

The FBI is harnessing this fear into a case which may or may not have a basis. Regardless, people in general are going to react with fear and we'll pursue a better-safe-than-sorry policy...which means he'll most likely go to jail for a long time. They'll make an example of him somehow.

Re:Hmmm...

[Maritz]

If he tried this on a real plane (which doesn't look to be the case) then I imagine he'll go down. In other instances, I think it would be hard for them to argue malice on his part.

Its hearsay

[Anonymous Coward]

At the moment, no one has verified if he really did change the planes course. As a pilot, I can tell you that if the auto pilot suddenly changed course for no reason and the throttles changed.. You sure as hell would have reported it to the engineers and there would be a a big stink about it. But we haven't heard that.

As a developer, I can't imagine that you would over write throttle control code while in the same fucking airplane! Not to mention if he did, did he undo the code change to give control back? Did the pilots simply disable the auto pilot? Does the auto pilot even still work in that airplane without a firmware reset? All those make me highly suspicious of this guys claims. Until the airline comes out and says "yes, our pilots had to disable the auto pilot and fly manually for the rest of the trip and the airplane is at Boeing getting the auto pilot fixed.." I don't believe it.

I wonder how this will affect SC?

[chris200x9]

I wonder how this will affect the development of Star Citizen?

Re:I wonder how this will affect SC?

[Dunbal]

Send more money and find out. Seems to be the thing to do.

What's this

[Anonymous Coward]

And if he didn't do it, why is the FBI saying he did?

Wait, a "former federal computer crimes prosecutor" is arguing that knowing how to commit a crime isn't itself, a crime? How can the war on terror subjugate ^H^H^H protect Americans, if US prosecutors are so lenient?

Boeing Engineers...

[mbone]

I have talked to Boeing Engineers about this in the past. They say that (both with present systems and new all IP based systems) there is a total physical and logical separation between the three types of networks on a plane (basically, pilot command and control, airplane maintenance networking, and passenger facing networking). They were pretty firm on this separation being inviolable, due to the obvious safety aspects. Either Chris Roberts is blowing smoke, or some pretty smart people made some pretty basic mistakes.

Re:Boeing Engineers...

[grimmjeeper]

Logical? Yes. Physical? No.

Speaking as someone who worked for a Boeing subcontractor who designed their on board computers, I can tell you that there is a physical connection. There's only one set of SATCOM radios on board. The avionics systems use it for some of their communications and have for a long time. The airlines wanted to monetize the extra bandwidth by selling access to the passengers for a price. I am told they didn't add a second set of radios to provide bandwidth to the passengers.

So at the very least, there is a switch that connects the avionics network, the in flight entertainment network, and the SATCOM radios. And while this is a physical connection, there is a fair amount of confidence that it's still a logical separation. The AFDX/ARINC 664 standard is pretty extensive and allows for very strict connection management. While Roberts may have been able to get a packet out of the IFE network and have it look like an engine control message, there's very little chance that packet would make it anywhere close to the engine control computer. Of course, that assumes that the avionics network was set up correctly. And that's a pretty good assumption given the safety requirements in place for avionics design. Still, there's that one in a million shot that there is an exploitable flaw. It's probably less chance than that, but it's not guaranteed to be zero.

Re:Boeing Engineers...

[PPH]

Except that Boeing asked the FAA for a Special Condition to allow just such an interconnection.

Re:Boeing Engineers...

[Anonymous Coward]

Correct. See figure 4 of this GAO report: http://www.gao.gov/assets/670/669627.pdf

Per the GAO report, page 18: "Firewalls protect avionics systems located in the cockpit from intrusion by cabin system users, such as passengers who use in-flight entertainment services onboard."

Re:Boeing Engineers...

[lgw]

I suspect the truth is the following: he was able to hack flight control from the passenger connection in the simulation, because the security wasn't there or wasn't setup the same in the simulation. He says he hacked a simulation, not a real plane, so this seems like the most likely explanation - though as you say, it's always possible there's an exploitable flaw.

Re:Boeing Engineers...

[Anonymous Coward]

Here's the problem though. Every company, every industry, every industrial sector, has more or less claimed that they had their computer security under control. And then the hackers and security researchers started testing and probing.

Guess what happened? It turned out that those confident assurances weren't worth a 15 stamp to mail them to the garbage dump. They all, repeat all turned out to have glaring, face slapping, mind blowingly bad implementations.

Oh, I get it. Aviation is a highly regulated industry. There are standards and inspections. However it is also well-known that most of those regs were created in response to crashes and tragedies. They were not created anticipating the problems they prevent. So why would aviation have bullet-proof computer security, exactly?

Let's map out a hypothetical scenario, one based in real-world dynamics. Weight in aviation is crucial, to the point of obsession. Plane designers will go to extreme lengths to save weight, to the point of specifying exotic, high strength alloys, custom machining, expensive casting processes, and all the rest. So they design a common communications bus, one that all on-board computer systems can share. This saves weight and space, and it's cheaper as a bonus.

For security they put in place "some security stuff" (VLANs, switches, packet routers, firewalls, whatever it takes). But there's a configuration or maintenance problem, and there's a hole in the logical defences. Oops! Now just try and tell me this can't happen. Or tell me that, in fact, this can happen quite easily.

You see there's precedent, and a lot of it. Ethernet didn't arise from nothing. There were a lot of other networking technologies in place at the time. Ethernet wound up displacing ALL of them, bit by bit. And it was for the same reasons: cheaper, faster, easier to maintain (though weight wasn't normally one of the reasons). And it was invariably on a single, converged Ethernet backbone.

In fact many legacy systems, with little or no security aside from physical access controls, wound up on those converged Ethernet networks. Sure, it was stupid. Many, many tech folks warned against doing it. In the end it made no difference for any of them. Universal, cheap networking won out against all objections, and that includes security.

So either proves those avionics systems are secure against real-world hacking attempts, or else I don't believe it.

Re:Boeing Engineers...

[pspahn]

Still, there's that one in a million shot that there is an exploitable flaw.

Of course, it's certainly much better odds than that if you're running a network simulation and have several ?'s on the topo for things running proprietary protocols you likely know not much about.

Is there a logical separation at the switch? Sounds likely. What about the switch, does it have an admin login/password? If that switch is crackable, then the logical separation of the network is hosed.

There's still the matter of crafting those packets so they are heard, and while I have little idea how to do it, it's not something that can't be done.

I don't think whatever hack Roberts came up with work work in the wild. In a simulation it works great because it's a damn simulation*.

Re:Boeing Engineers...

[grimmjeeper]

A switch on an avionics system won't be like a typical of the shelf commercial router. There's no need to have a programmable router on an airplane. Once it's configured, there's no need to log into it to change anything. It likely won't have any administrative access for configuration at all. It will be programmed at the factory with the only option to reconfigure being a complete system software load.

Re:Boeing Engineers...

[Anonymous Coward]

"Smart people making some pretty basic mistakes"...sounds like the monthly cycle of "critical" updates to every computer I own.

Re:Boeing Engineers...

[I'm not god any more]

Except that Boeing asked the FAA for a Special Condition to allow just such an interconnection.

Which was granted: http://www.gpo.gov/fdsys/granu...

Re:Boeing Engineers...

[cfsops]

From the conclusion at the end of the linked excerpt from the Federal Register:

The Special Conditions

Accordingly, pursuant to the authority delegated to me by the Administrator, the following special conditions are issued as part of the type certification basis for the Boeing Model 787-8 airplane.

The design shall prevent all inadvertent or malicious changes to, and all adverse impacts upon, all systems, networks, hardware, software, and data in the Aircraft Control Domain and in the Airline Information Domain from all points within the Passenger Information and Entertainment Domain.

Issued in Renton, Washington, on December 21, 2007. Ali Bahrami, Manager, Transport Airplane Directorate, Aircraft Certification Service.
[FR Doc. E7-25467 Filed 12-31-07; 8:45 am]

Re:Boeing Engineers...

[Anonymous Coward]

Specifically, I suspect he set up his basement simulator with a regular commercial ethernet router standing in for a real ARINC 664 / AFDX router. An ethernet router will route AFDX packets just fine, since they look the same, but it will also pass malformed packets, packets that are not in the ICD, and packets that are sent at the wrong time. A real AFDX router has a table of every packet that's allowed on the network, along with the specific times when these packets are to be sent, and it drops any noncompliant packets. This is done to eliminate any chance of frame collisions, but it's also makes a lot of traditional attacks very difficult.

Re:Boeing Engineers...

[Anonymous Coward]

I think they're using that new security feature. I believe it's call, MAGIC!

Re:Boeing Engineers...

[Anonymous Coward]

> A switch on an avionics system won't be like a typical of the shelf commercial router.

I would agree with you if you said "shouldn't" instead of "won't."

COTS stuff shows up all over the place for cost reasons. I have no reason to believe a COTS router was used/re-purposed for a dedicated avionics network ... but I wouldn't rule it out either because I am a cynic.

Re:Boeing Engineers...

[PPH]

They implemented filtering on the evil bit.

Re:Boeing Engineers...

[grimmjeeper]

I don't care if you believe me or not. They don't run down to Fry's and buy an off the shelf router to put in an airplane, regardless of what you see in the movies.

Sounds like a bad translation

[Ken_g6]

"Stop: Fly sideways!"

More to the point...

[wonkey_monkey]

"If he did what he said he did, why is he not in jail?

Because, contrary to some opinions, America is not yet a police state, and they still like to have silly things like trials.

And if he didn't do it, why is the FBI saying he did?"

A better question would be "why isn't he saying he didn't?"

Re:More to the point...

[rahvin112]

A better question would be "why isn't he saying he didn't?"

So you advocate for that police state where anyone arrested is obviously guilty unless they prove otherwise.

It doesn't matter why Roberts said what he said because he's not guilty of anything until he's convicted of it. He could be a blow hard, he could be a braggart, or quite simply the FBI could be taking statements out of context as Roberts has already claimed. None of it is relevant until he's charged and tried for the crime and I don't see him being tried. I see the FBI trying to strong arm him, something they are very very good at.

What I do see is a lot of people in the airline industry, the people in the know, rolling their eyes and saying he's a blowhard. And they are a people with the knowledge, not the FBI and not Roberts. From what I've seen of the description of events I also see a lot of strong arming by the FBI. According to Roberts they basically tried to force him to reveal his research to Boeing under threat of imprisonment. None of that is cool.

Re:More to the point...

[jvkjvk]

A better question would be "why isn't he saying he didn't?"

Because the best thing you can do after being arrested is to shut the fuck up and not say anything else.

There is absolutely no upside to saying *anything* else at that point.

Besides, what would be the point of releasing a statement saying "I didn't do it."? Unlikely to sway the FBI and if you elaborate they may find something else to tag you with.

Re:More to the point...

[wonkey_monkey]

So you advocate for that police state where anyone arrested is obviously guilty unless they prove otherwise.

No, I don't, and I've never said he's obviously guilty. I'm not in a court of law. I'm not going to be on the jury. I'm allowed to express my opinion that it's a little bit suspicious that he's taken the opportunity to state it's "out of context" without stating "I didn't do it."

And they are a people with the knowledge, not the FBI and not Roberts.

Blowhard or not, I'm pretty sure Roberts is the one who knows better than anyone else whether or not he did this.

Re:More to the point...

[Maritz]

Wouldn't he have to be *incredibly* stupid to mess with the avionics on a flight that he is actually on, for myriad reasons, not least of which his own continued breathing on this planet? For me, it doesn't pass the sniff test that this is something he would do.

Re:More to the point...

[Anonymous Coward]

Chris has said very clearly that he did not "hack" and certainly did not take control of the plane through the entertainment system. You can listen to an interview with him on Paul's Security Weekly here: http://wiki.securityweekly.com/wiki/index.php/Episode417 where he explains the "incident".

Pretty good article, couple of interesting tidbits

[Anonymous Coward]

Aircraft makers Boeing and Airbus have both publicly refuted claims that their planes can be hacked, but also refuse to discuss the details of the security features in place on airplanes.
“Airbus has robust systems and procedures in place for our aircraft and their operations to ensure security against potential cyber attacks,” the company said in a statement to Passcode. “We naturally do not discuss details on our security design and operations in public.”

Public review of security is often a good idea. The word 'naturally' reflects a lack of understanding of security. Not a good sign. Hopefully Airbus can clarify what they mean.

In an interview in April, he also claimed that FBI agents asked for his assistance reproducing the results of his vulnerability research and helping them set up a custom virtualized environment he used to test vulnerabilities in in-flight systems. Their reasons for doing so were not explained, and Roberts claims that he declined both requests, citing his work responsibilities and the FBI’s unwillingness to grant him immunity from prosecution should he assist them.

Citing 'work responsibilities' seems pretty lame on his part. Hopefully the FBI will call his bluff with some sort of immunity offer.

Cost vs Time vs Profit

[recharged95]

I would not be surprise that entertainment systems retrofitted onto older aircraft share subnets. Likely for battery BMS, fire safety, electrical shorts, etc.... Funny--it's actually the safety stuff!

Sure the designers would never (even a practical person wouldn't do it) tie avionics to entertainment networks, that's logical and likely easier to do to keep them separate when designing an aircraft.

But when you retro fit a 25-30yr old plane, it's possible nets cross lines due to time (i.e. competition w/newer aircraft), short cuts (accounting) and cost constraints (CEOs). We all want our movies & music nowadays. So the airlines are going to add it ASAP w/some subcontractor (not the aircraft manufacturers). It's a cheap retrofit in the end. That's one problem.

The 2nd problem is Chris Roberts and the media sensationalizing these cheap retrofits. No different from one putting a kids seat over a regular car seat (which had it's share of problems for years up until 2006). Heck anything that flies is sensationalized nowadays--it's sells eyeballs and ad money..

Indonesia AirAsia Flight 8501

[Anonymous Coward]

Right before the crash there are reports of the caption needing to do a hard reset of the autopilot system.

Re:Indonesia AirAsia Flight 8501

[Anonymous Coward]

In Soviet Russia autopilot subtitles you

I picked a bad week to give up heroin

[Anonymous Coward]

The engineering team picked a bad day/week/month to give up whatever it was that they're wanting to give up...

Two radios?

[MF4218]

If it's just for the cute little plane thing, why don't they just have a second radio for that and split the systems entirely?

Re:Two radios?

[grimmjeeper]

Because that adds weight and power consumption for no good reason. When it comes to that, the airlines and the manufacturers are pretty religious about reducing both. Every extra ounce reduces fuel efficiency. Every milliwatt consumed reduces efficiency. If you don't have to have two separate GPS units, you're not going to have them on the plane. The networking standards for avionics systems are capable of having the two networks connected together to share the data without letting one impact the other. So they do it that way rather than have two receivers on board.

Re:Two radios?

[bickerdyke]

Weight (still an issue), size and power.

And why should they? There are more dangerous things about flying than feeding a NMEA stream from one system into the other through, let's say, a serial connection that has Rx cut.

Re:Two radios?

[bluescrn]

A few grams of cheap consumer-grade GPS module to maintain an air gap for safety/security? Seems like a no-brainer? If the weight is a big deal, carry one less bag of peanuts on the drink/snack trolley...

Re:Two radios?

[Anonymous Coward]

Yep, a few grams.

Plus mountings. Plus placing it somewhere it can pick up a good signal (so it uses access port capacity), cabling, connectors. Plus - would we need to pilot to be able to shut it off if there was a possible problem in that area of the plane, eg fire? If so, more cables, maybe sensors. Plus it isn't just a cheap consumer-grade system because of signals and voltages and so there's some other controller on it, and that has power supply requirements, which introduce fire risk. Plus - what are the exterior temperature variations near the skin of an airliner?

I'm just imagining being in a room where someone has taken out all the parts exclusively required for the secondary cheap consumer GPS, and we might be looking at a pile of cables and fixings that cover a bench.

Re:Two radios?

[Jack Griffin]

If you don't have to have two separate GPS units, you're not going to have them on the plane.

You don't need four engines on a plane, and they weigh slightly more than a simple GPS receiver...

Re:Two radios?

[jeremyp]

You don't need four engines on a plane, and they weigh slightly more than a simple GPS receiver...

Which is why the current iteration of the Boeing 747 and the A380 may be the last four engined airliners.

Re:Two radios?

[grimmjeeper]

The reason they have multiple engines on a plane is to eliminate a single point failure that would make the plane have "premature contact with the ground". And on trans-pacific flights, having 3 or 4 engines gives you a significant safety margin for you to reach dry land. As engines have gotten better and more reliable, the requirement for 4 engines has been reduced to 2, starting with the Boeing 777 and going forward.

You can still make it to your destination after you lose your single GPS. Try making it to your destination after losing your single engine and let me know how it works out for you.

Re:Two radios?

[Jack Griffin]

You don't need two engines on a plane either...

Re:Two radios?

[Jack Griffin]

Yes I do know how planes work, you don't seem to understand that just like a second engine, a second pilot, and a second hostess, a second GPS is also useful sometimes. And the weight is less than the second pilot's belt buckle, it's hardly going to stress the airframe with it's inclusion.

Question

[Anonymous Coward]

To stop all this why don't Boeing or who ever put a plane on the tarmac and let him show them what can be done.
I would have thought this would have been a high priority for all parties. Chris, FAA, Boeing everyone.
If he can / cant do it then there is the answer. Of cause he does this with no risk the plane and him in the courts. Give him immunity for the hack.

               

Re:Question

[Anonymous Coward]

agree why hasn't this been done. Makes sense.
Chris can show it can be done or the Plane designers can say we did it right.

Re:Question

[rebootaus]

there is a point made here. What about giving this a go.

Re:Question

[Anonymous Coward]

To stop all this why don't Boeing or who ever put a plane on the tarmac and let him show them what can be done.
I would have thought this would have been a high priority for all parties. Chris, FAA, Boeing everyone.
If he can / cant do it then there is the answer. Of cause he does this with no risk the plane and him in the courts. Give him immunity for the hack.

             

An even better option (from a security POV, not necessarily cost since just hosting a contest means keeping a plane out of revenue service although you could get some PR value): Give not just him but other security experts as well a chance to hack it - if you succeed, you win the aircraft + crew + fuel for X days or whatever. Practically all important documentation should be available to the public already through regulations, airworthiness directives etc. so if you think you can figure out how to do it, you can prepare well enough not to need much time with the plane making a contest more feasible time-wise. The necessity of making safety issues known to all operators has made the aircraft manufacturing industry remarkably open so that competitors know each other's technical solutions very well. Thus no trade secrets that aren't secrets need to be disclosed. An example as a side note: The 787 battery problem and non-solution to it (just a box to contain any fire, no prevention since the cause is unknown) made Airbus change the A350XWB design long before the first deliveries, which benefit them a lot.

Proofreading

[Zanadou]

...take a step back from the crazy and ask what is the real import of the plane hacking.

I d'know... bears??

(In addition, that statement is actually a question.)

Re:Proofreading

[Anonymous Coward]

That's perfectly valid English; the word "import" has definitions which don't involve the trading of goods between jurisdictions.

What is his logic here..

[FryingLizard]

Step 1: Work on hacking (at the very least gathering extensive info about hacking) various militarily and safety-sensitive systems
Step 2: Boast about it, publish lots of findings and clues for others
Step 3: Piss off government of country where you are resident
Step 4: Get multiple private warnings from govt to keep your nose out
Step 5: Repeat steps 1 + 2
Step 6: Be surprised when govt gives you a slap.
Step 7: ...er.... Profit?

Re:What is his logic here..

[Anonymous Coward]

So you're suggesting that if someone follows their interests, they should be subject to government censorship, in the "land of the free," huh?

Never underestimate...

[Big_Oh]

Never underestimate the ability of non-security programmers and hardware people to overestimate their own security prowess.

1 hidden comment

[Anonymous Coward]

Rekt

good for the FBI

[paul mafinga]

15 April 2015 : Chris Roberts posted "a joke" on twitter about his ability to access aircraft control systems and alter the cabinet oxygen mixture while in flight.

That's more than enough to get interviewed by the FBI / TSA.

Now the fur is flying (ha, ha) over who said what, when, and the various interpretations of statements. Welcome to the legal industrial complex in a free country. His tweet started the whole mess.

Unforeseen consequences

[WD]

When doing security testing of any system, one must consider the possibility of unforeseen consequences. That is, while you think that your test may be harmless, you'll really never know this for sure until you perform the test. And even then, you might not know of all possible damage that was done to the system.

Just as system architects and developers make certain assumptions that may introduce vulnerabilities, a security tester may make assumptions about the consequences of their actions. The problems happen when these assumptions don't map up to reality 100%.

Yes, airplanes' computer systems should receive security testing. But to perform any sort of testing without authorization and when there are potential safety (human life) consequences is inconceivably irresponsible. Regardless of whether or not the tester suspects any damage will occur.

Re:Unforeseen consequences

[dbIII]

Hence doing it on a simulator. The next question is how good his simulator is and if the flaw exists on the real thing.

Chris Roberts?

[Anonymous Coward]

You mean the Wing Commander?

I'll be here all night

Lifetime ban from commercial flights

[peter303]

A steep price to pay. Hope his sacrifice makes air travel safer.

Anyone who knows avionics knows he's full of shit.

[thunderclap]

Obiligatory Xkcd http://xkcd.com/538/
If you see the explaination and think TL;DR read the xkcd it will explain too. But this below is why everyone is ignoring him.
Once again this is nothing more than fud. its FUD because there isn't a way for him to alter them.
He says he hacked into the actual flight controls via the onboard entertainment system. So I am going to explain how this is not on any plane outside a 787 or Airbus a-380 (both use an ethernet bus for the main connections between suites so a person with advanced knowledge who is an asshole enough to want to be banned for life from flying while committing several felonies [interfering with the flight crew for one is since 9/11] could.)
First the magic tweet states its a 737/800. This link is a pic the avionics bay of a 737/800.
http://farm4.staticflickr.com/...
They were introduced in1994. That's pre-internet. The IFE the In-flight entertainment system united uses was added in 2010. Its a redundant system not essential for flight or navigation so therefore its not connected directly to the rest of the avionics suite. But let me prove that.
https://www.redskyventures.org...
Actual boeing operations manual.
but lets go back to actual tweet "Find myself on a 737/800, lets see Box-IFE-ICE-SATCOM, ? Shall we start playing with EICAS messages? "PASS OXYGEN ON" Anyone ? :)" lets see he has a custom made hacking box, this where he knows it or not is a felony when he hooks it to the IFE. That's in the 14 CFR Part 91. What is 14 CFR Part 91? its the 1000+ page rule book that FAA details every aspect of flight in. From the size of the screws to what can actually be on board as a part of the plane. its in there. So back to the tweet. Chris hooks up an illegal hacking box to the IFE which is a redundant system separated from the navcom because requires an antenna to operate and there bandwidths can cause electrical issues with other systems (like aluminum foil in mircrowave issues).
Said box supposedly breaks firewall around IFE to get out. But to go where? He would be using command line and be seeing machine code at the core of a Boeing system.
So assumable he is seeing the maintenance list (unaware that the moment the firewall is breached in flight the in flight data recorder starts recording this) and he picks ICE?
ICE isn't ice its a function of the flight management system (FMS). IThe FMS will use ARINC 653 partitioned operating environment software, which allows multiple applications on the same processor. http://en.wikipedia.org/wiki/A...
What is ICE inside of FMS? Its to keep track of the ice buildup on the plane and to create solutions. But Ice can't drop oxygen masks nor can ice communicate with Satcom. And what is satcom?
SATCOM is satellite communications. Its an antenna on the fuselage of the plane. Its is not only for TV and wifi. It is a another way to communicate with Flight Ops, specifically with dispatch. It is just same as you use cellphone. If ARINC comm is not available, SATCOM comes to play, especially in remote areas and over polar regions. But here is the catch. IFE is directly connected to Satcom because thats Satcoms primary purpose on the 737/800. Satcom can't be used to change stuff internally because its not designed to. Its designed to be a communications channel for voice, internet and TV. sacom on 737 is wired through no 1 hf. so you can select hf or satcom.. Its manufactured by Thales UK The Thales TopFlight SATCOM is the first ARINC 781 SwiftBroadband-enabled SATCOM. However this wonderful device is connected to the rest of the suite via a Arinc 429 data bus.

Punishment

[Anonymous Coward]

Look. I generally don't believe in punishment.

But for this kind of crime (I'm talking about police/prosecutor overreach: inflating the charges into some fantasy monsters, like "destabilizing the country" for "ripping a CD", or "terrorist attack" for "wearing a blinkenlights badge in the airport"... you get the idea), we should re-introduce some medieval punishments.

I'd like to see a prosecutor publically whipped out in the main city square of a policeman ound naked to the village's water pump.

dem haxx0rz g0t pr0blemz

[Anonymous Coward]

As long as you keep saying "hacking" I can safely ignore anything you say because you won't be making sense.

Same goes for the FBI except that you'd better run because you're getting hit with overly vague laws that are oh so convenient to them but have nothing to do with justice whatsoever. Better run and stay out of their reach for the next twenty years or so.

"a step back from the crazy"

[Anonymous Coward]

Another stupid Americanism... please, God, don't let this start being part of common speech...

A step back from the crazy WHAT?

Re:Anyone who knows avionics knows he's full of sh

[dbIII]

He needs some serious time in jail

Just for talking about it after playing with some rig at home? That's a bit harsh.

Re:Anyone who knows avionics knows he's full of sh

[tao]

They were introduced in1994. That's pre-internet.

In what alternate history is 1994 pre-internet?!

Disapointing error

[sabbede]

I saw the name Chris Roberts and got all excited this was about the Wing Commander creator. What a let-down.

Re:Anyone who knows avionics knows he's full of sh

[cozytom]

The Avionic box was probably designed in 1984, using hardened chips of the day. Chances are, it uses a 80186 or something of equal power, but no Linux, or Windows. Certainly there was never an IP stack in the OS, and there were never any ethernet connectors on the box. There is an ARINC-422 connection, which is mostly GPIO pins, not much serial.

Yes, there could be updates to the box, but the certification process is very time consuming. There are paths for software updates, but the hardware has almost no changes over the last 30 years.

Yes, Chris Roberts is full of Sh** and is causing peoples heads to explode for no good reason.

Ladies and gentlemen

[Anonymous Coward]

"This is your hacker speaking."

Re:Anyone who knows avionics knows he's full of sh

[Anonymous Coward]

can't be used to change stuff internally because its not designed to.

That's what everybody says before equipment is used to do stuff it wasn't designed to.

Re:Anyone who knows avionics knows he's full of sh

[thunderclap]

So you are suggesting that dial up bulletin boards that required telephones to literally dial up a connection through Compuserve or Genie are comparable to the modern internet?
In 1994, Amazon, Yahoo! and Mosaic Communications (later Netscape) were in the beginning stages. Poynter reports Netscape Navigator was the first commercial web browser launched that year, two years before Microsoft Internet Explorer and 10 years before Mozilla Firefox.
Eternal September hadn't began. And it was a dream to download movies, music or TV. hell a single 1 mb porn image took hours.
E-commerce also launched in 1994. The first online transaction was allegedly for a pizza from Pizza Hut, while CNET reports a group of Swarthmore College students created the first secure "on-line" marketplace -- called NetMarket -- long before clicking to buy via eBay and other sites became the norm.
Wired claims it launched the very first banner ad ("Have you ever clicked your mouse right here? You will") in 1994. Graphics for AT&T and Zima, at just 468 pixels wide and 60 px tall began shortly thereafter. All of this after the shiny 737/800 was finished and sold. So I stand by my statement that the planes are and internally pre internet.

Re:Anyone who knows avionics knows he's full of sh

[thunderclap]

Can a $1 calculator download porn? No. But if you solider new chips into it and a new screen and a new os then yes. But is it a calculator now no it isnt. He's suggesting that insitu hacking of the plane which just his magic box. That's not possible. Now if someone has both computer hardware, programming and avionics skill sets and access to a plane on the ground could he? Yes. But it would require the same bastardization and the flight data recorder would know. That's what really did Roberts in. What he suggested would be recorded. And doing it is a felony.. And he wasn't playing with a rig at home. He tweeted while in flight that he should drop the passenger oxygen masks after taking over the system. If it wasn;t for Baltimore and Ferguson he would have vanish. He still needs to be charged with 'incitement' and willfully interfering with the duties of a flight crew'

Defense against Heros

[Anonymous Coward]

Shoot the glass?

Re: Defense against Heros

[Anonymous Coward]

Shoot the hostage.

Pwn2Own anyone?

[origin2k]

Park a plane on the tarmack, if a person can take control of the plane it's theirs. That should fix the security problems.

Re:Anyone who knows avionics knows he's full of sh

[tao]

You're confusing the World Wide Web with the Internet. A common mistake, but a mistake never the less.

Re:Anyone who knows avionics knows he's full of sh

[Anonymous Coward]

You have me there. Arpanet and NSFnet existed in the sixties and in 1982, the Internet Protocol Suite (TCP/IP) was standardized and the concept of a world-wide network of fully interconnected TCP/IP networks called the Internet was introduced.