Live data from Hacker News

A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

wired.com

191–200 of 277 posts

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#191
post #43
post #37

Earlier quoted context omitted.

So you're saying.... rewrite it in Rust?

Or, Ada, no? :)

Isn't ADA required? I worked with Air Force C2 platforms for east European NATO programs and the systems I was working with (one was called ASOC) was, at it's core, ADA. We also had civilian ATC in our facility and a few of those devs played on our softball team all writing ADA as well. But, it was part of the design spec and non-negotiable per FAA, Air Force, etc as far as I remember.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#192

Earlier quoted context omitted.

MacOS and related don't run the airplane. Pilots have an iPad for some checklists and other things where "have you tried turning it off and on again" works as failure prcedure. If a failure, caused by a compiler bug leading to an overflow in a rare flight situation, happens on an airplane system a reboot is not really the option you want to depend on.

Ironically, I recall reading about a mid-flight incident where the procedure to bring things back involved turning the entire plane off and on again.

That might work in a stable situation - many (not all) planes are good gliders. (I.e. somewhere I read that the A380 is a quite good glider, among other reasons since the wings were designed for larger versions; an F-16 however won't really glide)

In a critical situation this is impossible, though.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#193

My $0.02: I came across Boeing's documentation for their "Boeing Update" solution. (think Windows Update, but for 787s). It described in detail how the planes are updated with new firmware for the avionics, entertainment system, and the engines. I was shocked to learn that the 787 uses a lot of COTS kit internally, such as standard WiFi and Ethernet connections. There's an RJ-45 jack at the front landing gear accessi…

> "No part of it left me thinking they could have done better."

Do you have the knowledge required in order to judge that?

> I've insisted on flying 787s whenever possible, because I'm certain that the engineering effort that has gone into those things is about as good as humanly possible.

Have you compared it to the other Boeing airplanes? To Airbus airplanes? Bombardier? Embraer? The new Mitsubishi airplane?

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#194
post #68
post #55

Earlier quoted context omitted.

Drake owns a 767 [1], and the founders of Google own one [2]. A couple members of the Saudi Arabian royal family are reported to own 777s [3]. It's not inconceivable that an individual could own a 787, though I can't find any reference to one yet. I think, though, that the sort of person who owns one doesn't tend to want to tinker with it. You just hire someone to fly it, and know that it's always available. The diff…

>Likewise, I don't know anyone who owns a car who has loaned it to a researcher to analyze it for design flaws Oh, tons of people! There's a whole industry around hacking cars, most of those people aren't the kind of researchers that do con talks though.

To be precise, in the culture itself it's usually called "modding" or "tuning"; but the newer parts of it, especially around modifying ECUs, does involve work closer to traditional computer hacking.

(I'm an automotive enthusiast myself, although I'm more into the "old school" non-computer-controlled stuff. Mostly because it's simpler and inherently resistant to remote hackers.)

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#195

My $0.02: I came across Boeing's documentation for their "Boeing Update" solution. (think Windows Update, but for 787s). It described in detail how the planes are updated with new firmware for the avionics, entertainment system, and the engines. I was shocked to learn that the 787 uses a lot of COTS kit internally, such as standard WiFi and Ethernet connections. There's an RJ-45 jack at the front landing gear accessi…

Reading that just makes me think about how "wild west" self-driving cars seem to be, and most people seem to think that's acceptable.

We have Teslas that don't have anywhere near this kind of security or redundancy "autopiloting" themselves right now on highways.

People seem to be ok with that because it's a car and not a plane. But the way I see it, there's thousands of those cars on the roads, and a software bug across the fleet could cause just as much damage as a plane crash.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#196
post #52

It seems insane that all this code isn't just open source by default. No one's going to be able to rip off airlines by stealing it, you still need to have a company that, you know, sells planes. Keeping it closed seems like a full admission that "there are probably a bunch of bugs in here and we don't want people to see them"

Given that airplanes haven’t been hacked yet, security by obscurity seems to have been working...

Survivorship bias? Only having just learned that term, it sure seems to apply...of all the planes that have returned and landed safely, none seem to have been hacked; but there is no proof that a hack couldn't have already brought down a plane

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#197

If I owned a 787, would I be likely to have the rights to lend it to security researchers to test the exploits, or would it be prohibited through a contract that Boeing requires customers to agree to? Is there a reason that an individual would own a 787 for personal use— eg - is it a plane that people change the interior layout for use as a private jet, or are these planes all tied up in commercial use? If I owned on…

It would require recertifications

Only if you want to be able to fly it. I suspect the FAA won't care if you bought a plane and chose to turn it into a house, take it apart and post videos on YouTube, or whatever else doesn't involve it flying.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#198

It seems insane that all this code isn't just open source by default. No one's going to be able to rip off airlines by stealing it, you still need to have a company that, you know, sells planes. Keeping it closed seems like a full admission that "there are probably a bunch of bugs in here and we don't want people to see them"

There is more than 1 company that sells planes and writes plane software.

and we'd be better off if x+1 planes had improved quality/security software than x.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#199

Earlier quoted context omitted.

A statement like that would also be corporate suicide. Imagine the lawsuits.

Would it really be worse than having a government agency forcibly ground your planes for safety reasons?

IANAL but I think Boeing exposes themselves to less liability with FAA making the decision to ground them to investigate.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#200

Earlier quoted context omitted.

All the traffic lights here in Australia are honking great big metal poles that you'd need some serious equipment to reposition. Swapping bulbs would be a big operation too. What country are you in that has rotatable traffic lights?

I'm in the USA. This particular incident happened in Washington, DC. I also saw a driver do this once in Palo Alto in Silicon Valley. Anyways, even if lights are too big to climb up you can put on a yellow vest and get a flashing light on your van and people wouldn't really think twice. Here's some photo evidence from Palo Alto, CA, USA: https://imgur.com/a/NxmphG6

Wow, yeah those are super flimsy. Looks like some DIY job with plumbing pipes!

Traffic lights here are nothing like that.

Post reply on HN