11–20 of 36 posts
Well, this is just standard Aerospace grade software. I would be surprised if you could find a single controller in an airplane without some trivial login credentials. Exposing software like that to the internet is of course a completely insane step.
Earlier quoted context omitted.
> Well, this is just standard Aerospace grade software. This is a groundside problem, and perhaps it is insane to have it exposed to the open internet but it's not on the aircraft. It needs to be exposed to some network because the intent is that fleet controllers (airlines, or in this case Navy) use it to reach out to their aircraft wherever they may be. That said, it absolutely fits the quality I've come to expect…
It meets all requirements! /s
> RTX did not respond to our vulnerability report I guess they mean you should sell the vulnerability to highest bidder instead of reporting? Weird choice.
They will respond after a year or two with a lawsuit and SWAT busting doors.
Interesting choice of tail number and date... https://www.faa.gov/lessons_learned/transport_airplane/accid...
Looks like the PDF is just to show what the messaging interface looks like, and what they've found as a publicly available screenshot is from the crash report involving that plane. If they logged in, took a screenshot, and published that (even if lots of things are blurred), there's probably more attack surface for some three-letter-agency to bust down their doors and disappear them...
Well, this is just standard Aerospace grade software. I would be surprised if you could find a single controller in an airplane without some trivial login credentials. Exposing software like that to the internet is of course a completely insane step.
Can't be further from the truth. DOD software is given huge budgets where it's not surprising to see 3 separate teams performing QA for one software milestone. It's one of the few sectors that still plan software upfront waterfall style and implement strict procedures for traceability, change management, etc. Who else is using formal methods or safety critical stacks like ADA/Spark?
Well, this is just standard Aerospace grade software. I would be surprised if you could find a single controller in an airplane without some trivial login credentials. Exposing software like that to the internet is of course a completely insane step.
> Well, this is just standard Aerospace grade software Can't be further from the truth. DOD software is given huge budgets where it's not surprising to see 3 separate teams performing QA for one software milestone. It's one of the few sectors that still plan software upfront waterfall style and implement strict procedures for traceability, change management, etc. Who else is using formal methods or safety critical st…
This is not actually as common as many people seem to believe. The mandate died almost two decades ago. DOD aircraft fly on Fortran, JOVIAL, C, and C++ more than Ada. And DOD IT systems are a clusterfuck.
> It's one of the few sectors that still plan software upfront waterfall style
That's not the good thing you seem to think it is.
Also, why do you call it ADA? It's not an acronym. Amusingly, SPARK is, or was, and you write it as "Spark". It originally stood for "SPADE Ada Kernel" and the language continues to be stylized as SPARK.
Well, this is just standard Aerospace grade software. I would be surprised if you could find a single controller in an airplane without some trivial login credentials. Exposing software like that to the internet is of course a completely insane step.
> Well, this is just standard Aerospace grade software Can't be further from the truth. DOD software is given huge budgets where it's not surprising to see 3 separate teams performing QA for one software milestone. It's one of the few sectors that still plan software upfront waterfall style and implement strict procedures for traceability, change management, etc. Who else is using formal methods or safety critical st…
I wrote DO-178 Software, literally every single project I ever worked on has trivial login credentials.
>DOD software is given huge budgets where it's not surprising to see 3 separate teams performing QA for one software milestone. It's one of the few sectors that still plan software upfront waterfall style and implement strict procedures for traceability, change management, etc. Who else is using formal methods or safety critical stacks like ADA/Spark?
None of this matters or contradicts what I said. You will be able to get into it with user:root password:root or some variation. In all likelihood you will even find a requirement for this, which is of course verified.
If you apply the methodology practiced to a web application, the OP is exactly what you will get.
Earlier quoted context omitted.
They will respond after a year or two with a lawsuit and SWAT busting doors.
They're not in the US. I'm not familiar with German law enforcement practices but I wouldn't be surprised if they had a process that was a little less door-kicky.
Earlier quoted context omitted.
> Well, this is just standard Aerospace grade software. This is a groundside problem, and perhaps it is insane to have it exposed to the open internet but it's not on the aircraft. It needs to be exposed to some network because the intent is that fleet controllers (airlines, or in this case Navy) use it to reach out to their aircraft wherever they may be. That said, it absolutely fits the quality I've come to expect…
It meets all requirements! /s
Earlier quoted context omitted.
They will respond after a year or two with a lawsuit and SWAT busting doors.
They're not in the US. I'm not familiar with German law enforcement practices but I wouldn't be surprised if they had a process that was a little less door-kicky.