Collins Aerospace, the same company responsible days of outages at airport check-in kiosks https://www.bbc.co.uk/news/articles/c3drpgv33pxo
Collins Aerospace: Sending text messages to the cockpit with test:test
21–30 of 36 posts
Re: Collins Aerospace: Sending text messages to the cockpit with test:test
#22Well, this is just standard Aerospace grade software. I would be surprised if you could find a single controller in an airplane without some trivial login credentials. Exposing software like that to the internet is of course a completely insane step.
root:root
Re: Collins Aerospace: Sending text messages to the cockpit with test:test
#23Well, this is just standard Aerospace grade software. I would be surprised if you could find a single controller in an airplane without some trivial login credentials. Exposing software like that to the internet is of course a completely insane step.
> Well, this is just standard Aerospace grade software Can't be further from the truth. DOD software is given huge budgets where it's not surprising to see 3 separate teams performing QA for one software milestone. It's one of the few sectors that still plan software upfront waterfall style and implement strict procedures for traceability, change management, etc. Who else is using formal methods or safety critical st…
LOL
Re: Collins Aerospace: Sending text messages to the cockpit with test:test
#24Re: Collins Aerospace: Sending text messages to the cockpit with test:test
#25Earlier quoted context omitted.
> Well, this is just standard Aerospace grade software Can't be further from the truth. DOD software is given huge budgets where it's not surprising to see 3 separate teams performing QA for one software milestone. It's one of the few sectors that still plan software upfront waterfall style and implement strict procedures for traceability, change management, etc. Who else is using formal methods or safety critical st…
LOL
You know, maybe you're right. It's possible that entire comment was meant as a joke. Poe's Law strikes again?
Re: Collins Aerospace: Sending text messages to the cockpit with test:test
#26Earlier quoted context omitted.
> Well, this is just standard Aerospace grade software Can't be further from the truth. DOD software is given huge budgets where it's not surprising to see 3 separate teams performing QA for one software milestone. It's one of the few sectors that still plan software upfront waterfall style and implement strict procedures for traceability, change management, etc. Who else is using formal methods or safety critical st…
> Who else is using formal methods or safety critical stacks like ADA/Spark? This is not actually as common as many people seem to believe. The mandate died almost two decades ago. DOD aircraft fly on Fortran, JOVIAL, C, and C++ more than Ada. And DOD IT systems are a clusterfuck. > It's one of the few sectors that still plan software upfront waterfall style That's not the good thing you seem to think it is. Also, wh…
Pedantics aside, not much reasoning against quality. Perhaps I've lucked out, but I've worked in many sectors and do not at all agree with sentiment here about DOD software quality. There is significant formal investment/research in DOD to improve operations, including taking the best of practices in commercial. In my experience, the worst of software is written by teams with little experience improvising under Agile and taking on tech debt with no time/resources to get things done the right way.
Re: Collins Aerospace: Sending text messages to the cockpit with test:test
#27Earlier quoted context omitted.
They will respond after a year or two with a lawsuit and SWAT busting doors.
They're not in the US. I'm not familiar with German law enforcement practices but I wouldn't be surprised if they had a process that was a little less door-kicky.
In germany linux dev get swated while live streaming.
Re: Collins Aerospace: Sending text messages to the cockpit with test:test
#28(2009)
Re: Collins Aerospace: Sending text messages to the cockpit with test:test
#29> RTX did not respond to our vulnerability report I guess they mean you should sell the vulnerability to highest bidder instead of reporting? Weird choice.
Unfortunately, RTX did not respond to our vulnerability report. The account was disabled. Some sort of acknowledgement of the report certainly would have been good here, but at least they did disable the account. I presume the reported vulnerability no longer exists.
> but at least they did disable the account.
Probably added test2:test2.
Not worked in aerospace only enterprise but sometimes I worry I'm too cynical and then I remember the things I've seen and think I'm not cynical enough.
That said nothing I work on is aerospace level critical, could cost a lot of money if it's out but no one would ever have died.
Re: Collins Aerospace: Sending text messages to the cockpit with test:test
#30(2009)
No, this seems to be quite recent. At least the discovery, disclosure, and post are recent, as always, who knows how long the vulnerability has existed... I'll admit I was also confused because their "screenshots" is an old official document containing screenshots of the application in question, but it's just used to illustrate what the application is and does.