Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

wired.com

Post reply on HN
Print view View original

131–140 of 277 posts

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#131

Post by tyingq »

blackflame7000 wrote: post #96
tyingq wrote: post #70

Earlier quoted context omitted.

Interesting that they never found the root cause. I assume they fixed it by detecting symptoms since the cause is unknown.

Air Disasters did an episode on this flight with interviews from the people that diagnosed the problem. https://www.smithsonianchannel.com/shows/air-disasters/free-...

Searched a bit more, and found this from 2018:

"Experts are still not sure of the root cause of the malfunction in the data unit, but subsequent software changes by Airbus mean any similar error in the future won’t lead to another terrifying nosedive."

https://www.news.com.au/travel/travel-updates/incidents/terr...

Sounds like I guessed right.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#132

Post by mentos »

sushisource wrote: post #3

It seems insane that all this code isn't just open source by default. No one's going to be able to rip off airlines by stealing it, you still need to have a company that, you know, sells planes. Keeping it closed seems like a full admission that "there are probably a bunch of bugs in here and we don't want people to see them"

Yea I wonder if they could partner with Microsoft Flight Sim and find bugs in their code from thousands of simulated player hours.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#133

Post by winter_blue »

fdhfqbu wrote: post #108
kevin_thibedeau wrote: post #66

Earlier quoted context omitted.

Shhh. Let the new kids enjoy their smug.

I've done security auditing of ADA and C avionics code. (including for DAL-A components). As a language, I'd take Rust any day (in terms of security/robustness properties). However, the rust/LLVM compiler pipeline is nowhere near mature enough for use in high-criticality environments.

> However, the rust/LLVM compiler pipeline is nowhere near mature enough for use in high-criticality environments.

I don't know about Rust, but LLVM isn't mature? Nearly ever program running in the Apple ecosystem was compiled using LLVM. Swift is compiled using LLVM. Since Xcode 4.2, Clang is the default compiler. So iOS and macOS apps are built with LLVM. I'd also wager a guess that Apple uses Clang to compile key system code (Darwin, macOS, and iOS, etc) as well.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#134

Post by jdavis703 »

MegaButts wrote: post #4

I feel like this is the kind of thing that would've been completely ignored by everybody except for a handful of concerned hackers had it not been for the recent media outrage against Boeing (and in my opinion absolutely deserved). I guess the question is how bad is it (from the article it's hard to tell exactly, but it sure doesn't sound great)? And another question is how many of our systems that we rely on, from b…

I can tell you traffic lights are extremely insecure. Last month there was a traffic light that was turned the wrong way, such that it was impossible to tell if the light was green. So I climbed the poll and turned it to the right direction. Another fellow pedastrian thanked me.

A bad actor could do anything from a DOS (positioning it the wrong direction) to tampering with the bulbs (for example swapping out all the greens with reds).

The reason most society doesn't collapse is because we assume most people are good actors. Unfortunately once your device is hooked up to the internet you vastly increase the odds of dealing with bad actors and have to spend more time and money securing against bad actors.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#135

Post by btown »

fdhfqbu wrote: post #108
kevin_thibedeau wrote: post #66

Earlier quoted context omitted.

Shhh. Let the new kids enjoy their smug.

I've done security auditing of ADA and C avionics code. (including for DAL-A components). As a language, I'd take Rust any day (in terms of security/robustness properties). However, the rust/LLVM compiler pipeline is nowhere near mature enough for use in high-criticality environments.

> However, the rust/LLVM compiler pipeline is nowhere near mature enough for use in high-criticality environments.

I love Rust, but I wouldn't want it to fly a plane I'm on. For instance, here's a bug in LLVM that Rust developers happened to discover - before they disabled their use of the buggy features, Rust/LLVM was producing _numerically incorrect_ code. https://github.com/rust-lang/rust/issues/54878#issuecomment-...

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#136

Post by munk-a »

thfuran wrote: post #84
MegaButts wrote: post #4

I feel like this is the kind of thing that would've been completely ignored by everybody except for a handful of concerned hackers had it not been for the recent media outrage against Boeing (and in my opinion absolutely deserved). I guess the question is how bad is it (from the article it's hard to tell exactly, but it sure doesn't sound great)? And another question is how many of our systems that we rely on, from b…

And another question is how many of our systems that we rely on, from bridges to airplanes to traffic lights, are just actually very insecure I'd guess virtually all of them.

How likely do you think it is that a company that manufactures traffic lights and incidentally builds the software to control them would cough up 40+/hr to have someone independent come in and vet the software that was written for 12/hr and seems to work just fine?

Part of this is just a poor understanding and pricing for software consultancy - along with some absolutely terrible actors in the HPC realm. Ideally your HPC will come in and spend a fraction of the time vetting software that the dev team built, but occasionally you get a fraud who works 8/5 for a month at 120/hr and delivers nothing but vapor in the end.

Maybe some security consultant industry group could set up a certification program, though all the times in memory I've seen software related certification it's been

1. Absolute BS in terms of skills evaluated.

2. A money grab by the certifier.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#137

Post by bsaul »

Don't people here think that if boeing ever get over the current set of investigation without collapsing they're going to create the safest plane ever designed ? With the amount of scrutiny they're encountering at the moment i have the feeling every single dark corner is going to be under the spotlight..

Or is the reason too deep, the whole corporate structure too rotten at the core, that there's no hope ?

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#139

Post by luminiferous »

jjtheblunt wrote: post #77
SilasX wrote: post #26

Earlier quoted context omitted.

Or to driving control! But, engineers keep making this mistake. Hackers were able to take over Jeeps via the entertainment system: https://www.bbc.com/news/technology-33650491 HN discussion: https://news.ycombinator.com/item?id=9942647

Take over as in turn off, not steer, right?

From the original 2015 article about the hack:

"Miller and Valasek’s full arsenal includes functions that at lower speeds fully kill the engine, abruptly engage the brakes, or disable them altogether. The most disturbing maneuver came when they cut the Jeep's brakes, leaving me frantically pumping the pedal as the 2-ton SUV slid uncontrollably into a ditch. The researchers say they're working on perfecting their steering control—for now they can only hijack the wheel when the Jeep is in reverse. Their hack enables surveillance too: They can track a targeted Jeep's GPS coordinates, measure its speed, and even drop pins on a map to trace its route."[1]

The wheel control only working in reverse kind of makes sense. They're probably using some kind of self-park feature to control the wheel, and some engineer (sensibly) put in some kind of interlock to prevent the wheel from moving on its own when travelling at speed.

The wording of the article implies that these particular attacks only work when the car is travelling at low speed, but earlier in the article they did mention that they could (and did!) throw the transmission into neutral while the Jeep was driving on the highway. The driver was unable to recover without turning the car off and back on again.

In a followup a year later, they showed that they were able to do these attacks at any speed, including turning the steering wheel.[2]

[1] https://www.wired.com/2015/07/hackers-remotely-kill-jeep-hig...

[2] https://www.wired.com/2016/08/jeep-hackers-return-high-speed...

Post reply on HN