Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

wired.com

Post reply on HN
Print view View original

111–120 of 277 posts

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#111

Post by p_l »

blunte wrote: post #92
stefan_ wrote: post #39

Earlier quoted context omitted.

Most Boeing planes (though not the 787 discussed here) don't use fly-by-wire, so you could argue that the most essential control plane is perfectly isolated by virtue of not having any sort of network at all, just hydraulics into the cabin.

But wasn't the 737-max issue that a software system was forcing an elevator change to pitch the nose down? That sounds pretty fly-by-wire (even if hydraulics are involved).

You could say that the problem was lack of fly-by-wire - if 737-MAX had FBW, the necessary corrections would be bundled as part of flight envelope protection, and that tends to work pretty well and the required checks on FBW systems would catch stuff like "only one AoA sensor used".

Instead we got MCAS which was messing with autotrim signals and escaped scrutiny.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#112

Post by quickthrower2 »

DoofusOfDeath wrote: post #106
kevin_thibedeau wrote: post #66

Earlier quoted context omitted.

Shhh. Let the new kids enjoy their smug.

> Shhh. Let the new kids enjoy their smug. Agreed. They need to discover on their own that critical software requires coq . ...

Coq is great. Now the problem is developers having the sharpest, greatest tools but not understanding the spec, or working to a stupid spec and not calling it out.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#114

Post by kjaftaedi »

std_throwaway wrote: post #16
sushisource wrote: post #3

It seems insane that all this code isn't just open source by default. No one's going to be able to rip off airlines by stealing it, you still need to have a company that, you know, sells planes. Keeping it closed seems like a full admission that "there are probably a bunch of bugs in here and we don't want people to see them"

It's kind of the same reasoning why voting machines are closed source and can only be audited by authorized personnel.

Personally I think if voting software is doing much more than basic addition, someone messed up.

If you write code that takes an input and increments a number, and you're worried that someone might exploit your code, someone else should have wrote the software.

Attach a printer that shows the voter a paper receipt before the receipt goes in a box, and it should be able to prevent against most any electronic attack.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#115

Post by icebraining »

alltakendamned wrote: post #93
msbarnett wrote: post #23

> But Boeing counters that it has both "additional protection mechanisms" in the CIS/MS that would prevent its bugs from being exploited from the ODN, and another hardware device between the semi-sensitive IDN—where the CIS/MS is located—and the highly sensitive CDN. That second barrier, the company argues, allows only data to pass from one part of the network to the other, rather than the executable commands that wo…

Data diodes. Call me when you bypass them, I have a job for you.

Data dioses don't prevent malicious data that exploits vulnerabilities and takes over from being transmitted, they only prevent the malware from communicating back.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#116

Post by qekbg »

solotronics wrote: post #107

Would planes be more or less safe if all the code was required to be put in the public domain? I would think more.

I think the obvious answer is "less safe at first, safer in the long term". Only that a plane is not something you want to ever be less safe, so it's a risk that might not be worth taking

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#117

Post by jsjohnst »

sagebird wrote: post #19

If I owned a 787, would I be likely to have the rights to lend it to security researchers to test the exploits, or would it be prohibited through a contract that Boeing requires customers to agree to? Is there a reason that an individual would own a 787 for personal use— eg - is it a plane that people change the interior layout for use as a private jet, or are these planes all tied up in commercial use? If I owned on…

> Is there a reason that an individual would own a 787 for personal use— eg - is it a plane that people change the interior layout for use as a private jet, or are these planes all tied up in commercial use?

There’s the BBJ (Boeing Business Jet) edition of both the 787-8 and 787-9. There’s over a dozen of them that’s been built and delivered.

Links:

https://www.boeing.com/commercial/bbj

https://corporatejetinvestor.com/articles/boeing-bbj787-buye...

https://www.geekwire.com/2017/deer-jet-vvip-787-dreamliner/

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#118

Post by jacquesm »

airstrike wrote: post #105
jacquesm wrote: post #78

Earlier quoted context omitted.

Are you seriously suggesting that Airbus would rip off Boeings code? There is such a thing as copyright.

We're talking about open sourcing, not ripping off copyrighted code. Would depend on licensing but in any event, once you start showing how the sausage is made others can find inspiration to develop their own code, at which point you can start getting into a costly legal battle over whose idea it originally was, whether certain algorithms are protected, etc... My point is simply that there's no upside for Boeing to o…

You've got that backwards. There is no downside. Software does not an airplane make, even though there are now attempts to use software to fix airplane design issues.

You wrote 'Airbus' as though Boeings R&D in their software would somehow magically translate into an advantage for Airbus. But Airbus should also open source their code, and for exactly the same reason. In fact Airplane certification institutions such as the FAA and counterparts could easily mandate the open sourcing of every last bit of software to create a level playing field.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#119

Post by dclowd9901 »

sushisource wrote: post #3

It seems insane that all this code isn't just open source by default. No one's going to be able to rip off airlines by stealing it, you still need to have a company that, you know, sells planes. Keeping it closed seems like a full admission that "there are probably a bunch of bugs in here and we don't want people to see them"

Question: why would making the software open source make it any more safe? Do we really anticipate droves of engineers combing through Boeing's code helping them eliminate bugs (without some sort of bounty program)?

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#120

Post by netsharc »

PedroBatista wrote: post #48

The level of not giving a shit from Boeing and the FAA is astonishing.

But... it's a researcher making claims and assumptions but no working code... just because the target is Boeing doesn't mean the researcher might not be full of shit.
Post reply on HN