Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

wired.com

Post reply on HN
Print view View original

121–130 of 277 posts

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#121

Post by fishywang »

blackflame7000 wrote: post #104
jquery wrote: post #82

Earlier quoted context omitted.

>I have no idea how that company will ever earn back my trust Millions of ongoing safe flights? I dunno. I feel like they're getting savaged (which they deserve... to a point... but we will cross that point I am pretty sure, if we haven't already...) The thousands (tens of thousands?) of safe flights per day don't make the news. Boeing has been a pioneer in the safest form of transportation in existence. Mentour Pilo…

If you look at the Top 7 safest airplanes in terms of accidents per hours flown you get: 1) Airbus A340 - No crashes 2) Boeing 777 - 5 crashes, 2 intentional (Malaysia x2), 1 engine-related (Rolls-Royce problem), 2 pilot-error (Asiana/Dubai) - [Thanks fishywang] 3) Boeing 747-8 4) Boeing 737-NG 5) Boeing 767 6) Airbus A320 7) Boeing 757

Did you miss the Asiana 777 at SFO? Or is that engine-related?

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#122

Post by scandox »

draugadrotten wrote: post #36

From the article: "He was surprised to discover a fully unprotected server on Boeing's network, seemingly full of code designed to run on the company's giant 737 and 787 passenger jets, left publicly accessible and open to anyone who found it. So he downloaded everything he could see." Is that even legal? Will he ever be allowed to cross the US border after admitting this?

Isn't this in itself a big story? How the hell are they being so lax with their source code?

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#123

Post by panarky »

msbarnett wrote: post #23

> But Boeing counters that it has both "additional protection mechanisms" in the CIS/MS that would prevent its bugs from being exploited from the ODN, and another hardware device between the semi-sensitive IDN—where the CIS/MS is located—and the highly sensitive CDN. That second barrier, the company argues, allows only data to pass from one part of the network to the other, rather than the executable commands that wo…

Boeingspeak: "IOActive's scenarios cannot affect any critical or essential airplane system and do not describe a way for remote attackers to access important 787 systems like the avionics system."

English: "This random guy on the internet discovered real vulnerabilities and we're scrambling like hell to fix them. We hope this carefully worded statement written by lawyers will keep the public and the FAA off our back until we can fix the problems."

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#124

Post by yc-kraln »

toomuchtodo wrote: post #6
tjr wrote: post #5

Earlier quoted context omitted.

Connecting entertainment systems to flight control sounds very wrong. Connecting entertainment systems to flight management would be common; it should be one-way communication (entertainment can only read FMS data, not send any), for the purpose of driving the moving map displays for passengers.

> it should be one-way communication (entertainment can only read FMS data, not send any), for the purpose of driving the moving map displays for passengers. Would you agree that this logical boundary should be physically enforced? Such as an opto-isolator?

This sounds like a good idea, until you realize that the head unit is typically the thing in the car with the most computing power (think AI workloads as well as a GPU and multiple ARM cores) and the thing in the car with the network connection.

A trivial use case which requires write access to the CAN bus is the navigation system informing cruise control of an upcoming hill.

Equally trivial would be the seat position memory or profiles being applied through the main touchscreen.

(I work for a company that is developing infotainment systmes)

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#125

Post by FDSGSG »

fishywang wrote: post #121
blackflame7000 wrote: post #104

Earlier quoted context omitted.

If you look at the Top 7 safest airplanes in terms of accidents per hours flown you get: 1) Airbus A340 - No crashes 2) Boeing 777 - 5 crashes, 2 intentional (Malaysia x2), 1 engine-related (Rolls-Royce problem), 2 pilot-error (Asiana/Dubai) - [Thanks fishywang] 3) Boeing 747-8 4) Boeing 737-NG 5) Boeing 767 6) Airbus A320 7) Boeing 757

Did you miss the Asiana 777 at SFO? Or is that engine-related?

That one was stupidity-related.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#126

Post by filoleg »

3JPLW wrote: post #87
jakeogh wrote: post #67

Earlier quoted context omitted.

Bad actors (APT's especially) dont want it open sourced.

Said bad actors probably already have access to the source — or could get it if they wanted it.

I think that's the exact point the parent was making. They don't want it open-sourced, because they already can access it, and open-sourcing would only mean that good guys will have access to it too.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#127

Post by yc-kraln »

gumby wrote: post #40
kps wrote: post #2

Who thought that having any communication path from the passenger entertainment system to flight control was a good idea?

When you're trying to cut the BOM and weight, sharing a network can seem like a good idea. Also industries have cultures, and dunning-kruger often applies outside their core domains. For example: I did some work with Mercedes (no insult to them -- I've happily owned several of their cars). They were " real " engineers; the "schnook" of the door when it shut. The brake-by-wire folks modeled everything in Matlab, devel…

Some of us are working to change that... :)

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#128

Post by tolstoshev »

sushisource wrote: post #3

It seems insane that all this code isn't just open source by default. No one's going to be able to rip off airlines by stealing it, you still need to have a company that, you know, sells planes. Keeping it closed seems like a full admission that "there are probably a bunch of bugs in here and we don't want people to see them"

The real reason more code isn't open source is because it would severely embarrass a lot of companies, because of how bad their code is.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#129

Post by [deleted] »

fdhfqbu wrote: post #108
kevin_thibedeau wrote: post #66

Earlier quoted context omitted.

Shhh. Let the new kids enjoy their smug.

I've done security auditing of ADA and C avionics code. (including for DAL-A components). As a language, I'd take Rust any day (in terms of security/robustness properties). However, the rust/LLVM compiler pipeline is nowhere near mature enough for use in high-criticality environments.

[deleted]
Post reply on HN