Slashdot Mirror
Chris Roberts Is the Least Important Part of the Airplane Hacking Story
chicksdaddy writes: Now that the news media is in full freak-out mode about whether or not security researcher Chris Roberts did or did not hack into the engine of a plane, in flight and cause it to "fly sideways," security experts say its time to take a step back from the crazy and ask what is the real import of the plane hacking. The answer: definitely not Chris Roberts. The real story that media outlets should be chasing isn't what Roberts did or didn't do on board a United flight in April, but whether there is any truth to longtime assurances from airplane makers like Boeing and Airbus that critical avionics systems aboard their aircraft are unreachable from systems accessible to passengers, the Christian Science Monitor writes. And, on that issue, Roberts' statements and the FBI's actions raise as many questions as they answer. For one: why is the FBI suddenly focused on years-old research that has long been part of the public record.
"This has been a known issue for four or five years, where a bunch of us have been stood up and pounding our chest and saying, 'This has to be fixed,' " Roberts noted. "Is there a credible threat? Is something happening? If so, they're not going to tell us," he said. Roberts isn't the only one confused by the series of events surrounding his detention in April and the revelations about his interviews with federal agents. "I would like to see a transcript (of the interviews)," said one former federal computer crimes prosecutor, speaking on condition of anonymity. "If he did what he said he did, why is he not in jail? And if he didn't do it, why is the FBI saying he did?"
"This has been a known issue for four or five years, where a bunch of us have been stood up and pounding our chest and saying, 'This has to be fixed,' " Roberts noted. "Is there a credible threat? Is something happening? If so, they're not going to tell us," he said. Roberts isn't the only one confused by the series of events surrounding his detention in April and the revelations about his interviews with federal agents. "I would like to see a transcript (of the interviews)," said one former federal computer crimes prosecutor, speaking on condition of anonymity. "If he did what he said he did, why is he not in jail? And if he didn't do it, why is the FBI saying he did?"
the real question to be asking is that if what the FBI is claiming is true, why has the FAA not grounded all planes of the same make yet? they have grounded planes for less in the past, the FAA doesnt really mess around
have you seen my sig? there are many others like it but none that are the same
It's almost as though the FBI is being hamfisted and incompetent again; but that couldn't be right...
I wonder how this will affect the development of Star Citizen?
I have talked to Boeing Engineers about this in the past. They say that (both with present systems and new all IP based systems) there is a total physical and logical separation between the three types of networks on a plane (basically, pilot command and control, airplane maintenance networking, and passenger facing networking). They were pretty firm on this separation being inviolable, due to the obvious safety aspects. Either Chris Roberts is blowing smoke, or some pretty smart people made some pretty basic mistakes.
"Stop: Fly sideways!"
(T>t && O(n)--) == sqrt(666)
Because that adds weight and power consumption for no good reason. When it comes to that, the airlines and the manufacturers are pretty religious about reducing both. Every extra ounce reduces fuel efficiency. Every milliwatt consumed reduces efficiency. If you don't have to have two separate GPS units, you're not going to have them on the plane. The networking standards for avionics systems are capable of having the two networks connected together to share the data without letting one impact the other. So they do it that way rather than have two receivers on board.
Never underestimate the ability of non-security programmers and hardware people to overestimate their own security prowess.
When doing security testing of any system, one must consider the possibility of unforeseen consequences. That is, while you think that your test may be harmless, you'll really never know this for sure until you perform the test. And even then, you might not know of all possible damage that was done to the system.
Just as system architects and developers make certain assumptions that may introduce vulnerabilities, a security tester may make assumptions about the consequences of their actions. The problems happen when these assumptions don't map up to reality 100%.
Yes, airplanes' computer systems should receive security testing. But to perform any sort of testing without authorization and when there are potential safety (human life) consequences is inconceivably irresponsible. Regardless of whether or not the tester suspects any damage will occur.
The Avionic box was probably designed in 1984, using hardened chips of the day. Chances are, it uses a 80186 or something of equal power, but no Linux, or Windows. Certainly there was never an IP stack in the OS, and there were never any ethernet connectors on the box. There is an ARINC-422 connection, which is mostly GPIO pins, not much serial.
Yes, there could be updates to the box, but the certification process is very time consuming. There are paths for software updates, but the hardware has almost no changes over the last 30 years.
Yes, Chris Roberts is full of Sh** and is causing peoples heads to explode for no good reason.