Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

wired.com

Post reply on HN
Print view View original

241–250 of 277 posts

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#241

Post by blunte »

userbinator wrote: post #186
blunte wrote: post #88

Earlier quoted context omitted.

Considering that cars are becoming more drive-by-wire, it's only a matter of time before a hacker will be able to actually steer a car or activate (or prevent activation of!) the brakes.

it's only a matter of time before a hacker will be able to actually steer a car or activate (or prevent activation of!) the brakes. A Tesla is the perfect example. The fact that it has self-driving---I mean, "assisted cruise control"---naturally means a computer can take over the controls entirely.

I forget which car it was, but I watched a car review video recently where the presenter fussed about taking the (otherwise great) car to a track. Some of the assists couldn't be disabled, so going around the track he would occasionally have to fight the steering wheel when it would try to turn him a certain way to stay within a "lane".

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#242

Post by laythea »

jiggawatts wrote: post #185

My $0.02: I came across Boeing's documentation for their "Boeing Update" solution. (think Windows Update, but for 787s). It described in detail how the planes are updated with new firmware for the avionics, entertainment system, and the engines. I was shocked to learn that the 787 uses a lot of COTS kit internally, such as standard WiFi and Ethernet connections. There's an RJ-45 jack at the front landing gear accessi…

Then again, the more complicated something is 1) the easier it is to break 2) the more vulnerable it is, no matter what the designers think. It gets to a point where full testing cannot be done.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#243

Post by dotancohen »

akira2501 wrote: post #189
jdavis703 wrote: post #134

Earlier quoted context omitted.

I can tell you traffic lights are extremely insecure. Last month there was a traffic light that was turned the wrong way, such that it was impossible to tell if the light was green. So I climbed the poll and turned it to the right direction. Another fellow pedastrian thanked me. A bad actor could do anything from a DOS (positioning it the wrong direction) to tampering with the bulbs (for example swapping out all the…

> I can tell you traffic lights are extremely insecure. All municipal infrastructure tends to be. It's usually implemented to a cost and security considerations are completely absent. You can bet that in any given city, all those street light control cabinets are keyed alike and the city has no true idea who has keys and who doesn't. This exact problem applies to so many domains it's literally for lack of effort that…

All those cabinets use the same key across cities as well! Otherwise FEMA and other services would be unable to function. For the same reason all LEO handcuffs use the same key, so that any officer could release any handcuffed individual.

Edit: Some googling for links let me to this video, which seems relevant:

I'll Let Myself In: Tactics of Physical Pen Testers

https://www.youtube.com/watch?v=rnmcRTnTNC8

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#245

Post by p_l »

throw7 wrote: post #150
p_l wrote: post #79

Earlier quoted context omitted.

Separation of IFE and avionics networks is something FAA actually chastised Boeing over during 787 design, and forced them to fully separate networks not VLAN crap.

Thanks for that. It sounds like the networks, while not air gapped, are being separated by some "high" security design or device... that happened to withstand the attack (hence the testing on Boeing's part). Fair enough?

From my understading there are 'data diodes" used, and as such flows are only from IFE to maintenance, and from avionics to maintenance, but not the other way around.

AFDX (used for network in 787) uses unidirectional messages with no ACKs or anything so you can reliably make a data diode by just cutting cables right.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#246

Post by croh »

jiggawatts wrote: post #185

My $0.02: I came across Boeing's documentation for their "Boeing Update" solution. (think Windows Update, but for 787s). It described in detail how the planes are updated with new firmware for the avionics, entertainment system, and the engines. I was shocked to learn that the 787 uses a lot of COTS kit internally, such as standard WiFi and Ethernet connections. There's an RJ-45 jack at the front landing gear accessi…

Hmm looks like it is job of a single or 2 authors who were really in love with their jobs(most probably contractors). having seen interviews of different people from boeing, i dont believe they can do anything good unless there is money

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#247

Post by krona »

windexh8er wrote: post #191
samuell wrote: post #43

Earlier quoted context omitted.

Or, Ada, no? :)

Isn't ADA required? I worked with Air Force C2 platforms for east European NATO programs and the systems I was working with (one was called ASOC) was, at it's core, ADA. We also had civilian ATC in our facility and a few of those devs played on our softball team all writing ADA as well. But, it was part of the design spec and non-negotiable per FAA, Air Force, etc as far as I remember.

Airbus confirmed that SQLite is being used in the flight software for the A350 XWB family of aircraft. SQLite is written in C.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#248

Post by adwww »

johannes1234321 wrote: post #156
winter_blue wrote: post #133

Earlier quoted context omitted.

> However, the rust/LLVM compiler pipeline is nowhere near mature enough for use in high-criticality environments. I don't know about Rust, but LLVM isn't mature? Nearly ever program running in the Apple ecosystem was compiled using LLVM. Swift is compiled using LLVM. Since Xcode 4.2, Clang is the default compiler. So iOS and macOS apps are built with LLVM. I'd also wager a guess that Apple uses Clang to compile key…

MacOS and related don't run the airplane. Pilots have an iPad for some checklists and other things where "have you tried turning it off and on again" works as failure prcedure. If a failure, caused by a compiler bug leading to an overflow in a rare flight situation, happens on an airplane system a reboot is not really the option you want to depend on.

I write software for in cockpit ipad apps - they are becoming more and more integral to the workload of pilots, everything from route planning, guidance, checklists, manifests and ordering fuel.

There was actually an incident posted on HN a while ago where IIRC an ipad did a software update or similar at a critical moment, and caused complications bad enough to get an incident report published on some aviation agency's website.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#249

Post by DocTomoe »

linuxftw wrote: post #142
ummonk wrote: post #52

Earlier quoted context omitted.

Given that airplanes haven’t been hacked yet, security by obscurity seems to have been working...

Lack of evidence of hacking is not evidence of lack of hacking.

And you are certain that all the "faulty sensors" that come up every now and then are actually mechanically faulty and not some bad actor sending garbage data apparently coming from that sensor to avionics?

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#250

Post by dx034 »

rootusrootus wrote: post #64
tjr wrote: post #41

Earlier quoted context omitted.

Outside temperature is pretty impressive indeed. The map also shows projected flight plan and ETA, which would not come purely from GPS.

Most/all international flights I've been on are really terrible at providing an accurate flight plan or ETA to the passengers via the entertainment system. I would not be surprised if it is already a manual update done when convenient by a member of the flight crew.

They tend to use what's programmed in the FMS. Pilots will have the cleared route in there, even if they already know that they'll probably get several short cuts along the way.
Post reply on HN