Slashdot Mirror
Chris Roberts Is the Least Important Part of the Airplane Hacking Story
chicksdaddy writes: Now that the news media is in full freak-out mode about whether or not security researcher Chris Roberts did or did not hack into the engine of a plane, in flight and cause it to "fly sideways," security experts say its time to take a step back from the crazy and ask what is the real import of the plane hacking. The answer: definitely not Chris Roberts. The real story that media outlets should be chasing isn't what Roberts did or didn't do on board a United flight in April, but whether there is any truth to longtime assurances from airplane makers like Boeing and Airbus that critical avionics systems aboard their aircraft are unreachable from systems accessible to passengers, the Christian Science Monitor writes. And, on that issue, Roberts' statements and the FBI's actions raise as many questions as they answer. For one: why is the FBI suddenly focused on years-old research that has long been part of the public record.
"This has been a known issue for four or five years, where a bunch of us have been stood up and pounding our chest and saying, 'This has to be fixed,' " Roberts noted. "Is there a credible threat? Is something happening? If so, they're not going to tell us," he said. Roberts isn't the only one confused by the series of events surrounding his detention in April and the revelations about his interviews with federal agents. "I would like to see a transcript (of the interviews)," said one former federal computer crimes prosecutor, speaking on condition of anonymity. "If he did what he said he did, why is he not in jail? And if he didn't do it, why is the FBI saying he did?"
"This has been a known issue for four or five years, where a bunch of us have been stood up and pounding our chest and saying, 'This has to be fixed,' " Roberts noted. "Is there a credible threat? Is something happening? If so, they're not going to tell us," he said. Roberts isn't the only one confused by the series of events surrounding his detention in April and the revelations about his interviews with federal agents. "I would like to see a transcript (of the interviews)," said one former federal computer crimes prosecutor, speaking on condition of anonymity. "If he did what he said he did, why is he not in jail? And if he didn't do it, why is the FBI saying he did?"
The FBI isn't claiming anything. The affidavit simply states that Chris Roberts told the FBI agents he was able to hack the avionics of the plane.
Frankly, it's complete bullshit. The systems are completely, physically separate. There is no way to hack the thrust from the in-flight entertainment system because they are not connected to each other. The most he'd be able to do is turn on the fasten seatbelt sign.
This, right here.
Seriously - entertainment and flight controls on subnets that are reachable from each other? What the hell was the engineering team drinking/snorting/smoking/shooting that day?
I'm thinking that due to the lack of an emergency TCTO* , and lack of any corroborating evidence (seriously, you'd think a pilot would notify *somebody* if his airplane did something way out of the ordinary like that, even if to report bad wind turbulence/shear/whatever as a warning to ATC and other pilots in the same path)?
Yeah... not so sure the FBI's assertion holds that much water. Awaiting more evidence and/or corroboration on that one.
* Time Compliance Technical Order - at least that's what the USAF used to call it. Dunno what they call it nowadays in the civilian world.
Quo usque tandem abutere, Nimbus, patientia nostra?
The FBI isn't claiming anything.
Exactly. They are just saying what they are investigating based on claims from Roberts himself. Roberts meanwhile has been anything but clear on what he's done.
The affidavit simply states that Chris Roberts told the FBI agents he was able to hack the avionics of the plane.
It's not illegal to be "able" to hack something. A crime is an illegal act, done at a specific time and place. You can't charge someone with having killed "someone" unless you name that someone. You can't even charge them if you have a name of the murdered, unless you have a time and place named.
You can get a warrant for someone "able" to do it, and they did. If they arrested him, the charge should specify what he did that was illegal, and when and where it happened. I haven't seen a pic of the actual arrest paperwork, but the media stated it was for hacking a specific flight. This means that the media reports are that he was arrested for actually having caused a flight-path diversion mid-flight by controlling (at least part of) the flight control systems from his passenger seat.
Learn to love Alaska
he made it clear that he did so in a simulator, not on a real plane in the sky. the FBI is taking it out of context to scare people and the media is complicit in this as well for not doing basic journalist research
have you seen my sig? there are many others like it but none that are the same
The corresponding FAA term is "Airworthiness Directive" (AD). An AD is a very big deal.
The in-flight entertainment (IFE) systems receive navigation data from the flight deck computers so they can display the moving maps and other stuff on the entertainment displays, for those passengers who want to know "where am I", "are we there yet", "is it time to reset my watch because we've crossed a time zone and I'm trying to adjust my body clock".
I would be shocked to learn that Boeing allowed the IFE to put ANY kind of data into the flight deck computers. I'd actually expect Boeing to use a one-way interface, one that transmits but does not receive: think RS-232 with one of the pins removed. I'd be almost as shocked to learn that Airbus did something like that. However, Airbus's comment about "firewalls" does not exactly inspire me to confidence in their airplanes.
There's something else. If Mr. Roberts did in fact do what the FBI claimed he said he did, I would have expected the air up in the cockpit to have turned very blue, as the pilots said (screamed, actually) something along the lines of what the Apollo 8 crew said (screamed, actually) when their CSM did an uncommanded thruster burn. I would further expected them to take manual control immediately, get on the radio immediately, declare an emergency because of the uncommanded engine power setting change, and land at the nearest airstrip that could handle the airplane. I would further expect maintenance crews to pull the flight data recorders to find out WTF just happened.
I have talked to Boeing Engineers about this in the past. They say that (both with present systems and new all IP based systems) there is a total physical and logical separation between the three types of networks on a plane (basically, pilot command and control, airplane maintenance networking, and passenger facing networking). They were pretty firm on this separation being inviolable, due to the obvious safety aspects. Either Chris Roberts is blowing smoke, or some pretty smart people made some pretty basic mistakes.
According to Bruce Schneier they're not physically separated: "Newer planes such as the Boeing 787 Dreamliner and the Airbus A350 and A380 have a single network that is used both by pilots to fly the plane and passengers for their Wi-Fi connections."
See also Figure 4 of this GAO report: http://www.gao.gov/assets/670/669627.pdf. There's a firewall protecting the command-and-control avionics from the passenger's network. Both the avionics systems and the passenger network utilize the same egress to the ground. Per the report: "Firewalls protect avionics systems located in the cockpit from intrusion by cabin system users, such as passengers who use in-flight entertainment services onboard."
Older planes had physically separate networks. Newer ones, not so much. Of course, maybe the security is bullet-proof. Doubtless there are access controls at the ethernet layer much more sophisticated than your standard network. And it'd be very surprised if Chris Roberts wasn't lying or grossly exaggerating. But regardless the systems are _not_ physically separate.
Because that adds weight and power consumption for no good reason. When it comes to that, the airlines and the manufacturers are pretty religious about reducing both. Every extra ounce reduces fuel efficiency. Every milliwatt consumed reduces efficiency. If you don't have to have two separate GPS units, you're not going to have them on the plane. The networking standards for avionics systems are capable of having the two networks connected together to share the data without letting one impact the other. So they do it that way rather than have two receivers on board.
I've been to Roberts' lectures. There is a piece of information that he talks about but is left out his slide deck and other documentation that is missing in the media reports. That piece is the actual vulnerability itself.
Name 1 reason an active port under an uncontrollable passengers seat needs to have access to avionics or any critical system?
History. As was pointed our to me in an earlier discussion on this topic, bean counters might have played a role in consolidating ALL electronic systems in an aircraft, thus tying its avionics with its in-flight entertainment systems.
There's no way any designer would mix a Safety Critical System with a Non-Safety Critical System, no matter what the cost "benefits" might appear to be...
DO-254 requires an astronomical (ha!) amount of verification and hence effort/cost. The physical segregation of Safety Critical Systems from Non-Safety Critical Systems is essential to reduce complexity, improve predictability and decrease verification costs. Keep in mind that the verification of these systems costs 100x what it does to design and implement them (if not more).
In saying that, you can run a black channel (safety critical information mixed with non-safety critical information), but as per IEC-61784, these must be categorically protected against masquerade (as well as the usual sources of error). So even if our chump of a hacker could gain access to the network, they would be unable to influence any Safety Critical Systems.
Bean counters don't sit at this table.
I am a commercial pilot and the term "dog tailing" is a new one for me. Also I would *very much* notice an uncommanded change in engine power.