Software Vulnerabilities in the Boeing 787 • Hacker News Board

Re: Software Vulnerabilities in the Boeing 787

#31

Post by Aloha » Fri, Aug 16, 2019, 8:45 PM UTC

Hunisgung wrote: post #28

service_bus wrote: post #15

Unlike the security researcher, I do have access to multiple 787s as I am one of many people responsible for maintaining them. I'm obviously not going to attempt to exploit the firmware on an aircraft for obvious reasons, but the security researcher's notion that you can "pivot" from the in flight entertainment to anything to do with aircraft operation is pure fantasy. These systems are entirely separate, including t…

> These systems are entirely separate, including the electricity that controls the systems. This is not what Boeing said to the FAA 12 years ago when they asked to certify their network architecture > The proposed architecture of the 787 is different from that of existing production (and retrofitted) airplanes. It allows connection to and access from external sources (the public Internet) and airline operator network…

Nothing you've quoted here disagreed with what the statement from the parent

Re: Software Vulnerabilities in the Boeing 787

#32

Post by Hunisgung » Fri, Aug 16, 2019, 8:53 PM UTC

Aloha wrote: post #31

Hunisgung wrote: post #28

Earlier quoted context omitted.

> These systems are entirely separate, including the electricity that controls the systems. This is not what Boeing said to the FAA 12 years ago when they asked to certify their network architecture > The proposed architecture of the 787 is different from that of existing production (and retrofitted) airplanes. It allows connection to and access from external sources (the public Internet) and airline operator network…

Nothing you've quoted here disagreed with what the statement from the parent

> It allows connection to and access from external sources (the public Internet) and airline operator networks to the previously isolated Aircraft Control Domain and Airline Information Services Domain.

I believe this contradicts the "systems are entirely separate" statement from the parent comment.

Re: Software Vulnerabilities in the Boeing 787

#33

Post by AceyMan » Fri, Aug 16, 2019, 9:17 PM UTC

selectodude wrote: post #7

sleavey wrote: post #4

It seems to me as someone with no experience of designing aircraft control software, avionics or anything to do with planes, that the entertainment system should be on a physically separate network to anything safety critical. Like, different everything: power supplies, switches, cables, control panels, the works. There should be no entryway into the flight control network except from the cockpit.

The issue is that for every kilogram you need to get into the air, is another kilogram of fuel that you need to carry onboard. Airlines, and by association, Boeing are very conscious of weight over something like airgapping.

The rule of thumb is:

You burn one lb (unit) of fuel for every three lbs (units) of fuel you carry.

Me: FAA licensed dispatcher

(Also, you'll see a 1:1 rule would imply adding fuel does not increase range, which is absurd.)

Re: Software Vulnerabilities in the Boeing 787

#34

Post by xemdetia » Fri, Aug 16, 2019, 9:25 PM UTC

WalterBright wrote: post #21

xemdetia wrote: post #17

Earlier quoted context omitted.

Would you say as someone who deals with these larger planes that at least the 787 current gen is closer to an older style chassis and body for cars? I have always imagined/assumed that 787's are not unique that they would be the same 'chassis' for a cargo plane or a passenger plane, and it really would have to do with how they fitted the plane for purpose? This is part of the reason why I agree with you, because I do…

Not sure what you mean, but aircraft stopped being "chassis and body" some time in the 1930's. That was the switch to a monocoque design with stressed skin.

I couldn't find the right words to describe it, the other person who commented was a bit closer. At a certain point I would assume the Boeing 787 design would have interchangeable configurations that would not be dependent on the airframe and avionics. I wasn't sure if cabin, interior, model, or something else would best describe what I meant and chassis and body for a car was the best I could come up with that could describe these two changeable parts unlike the unibody chassis. It looks like configurations is the most appropriate word.

I was hoping that the person I commented to could point us at some fun manuals to describe how these configurations worked at a technical level.

Re: Software Vulnerabilities in the Boeing 787

#35

Post by WalterBright » Fri, Aug 16, 2019, 9:37 PM UTC

xemdetia wrote: post #34

WalterBright wrote: post #21

Earlier quoted context omitted.

Not sure what you mean, but aircraft stopped being "chassis and body" some time in the 1930's. That was the switch to a monocoque design with stressed skin.

I couldn't find the right words to describe it, the other person who commented was a bit closer. At a certain point I would assume the Boeing 787 design would have interchangeable configurations that would not be dependent on the airframe and avionics. I wasn't sure if cabin, interior, model, or something else would best describe what I meant and chassis and body for a car was the best I could come up with that could…

I don't know about the 787, but in my day (757) every airplane that rolled off the assembly line was different. For one thing, there was a lot of customization for each airline, and the airplanes underwent constant technical improvement from field experience.

Doing things, however, that increased the weight or changed aerodynamics of the airplane were a very big deal, causing a ripple effect that would be very expensive.

Freighter versions were commonplace, with the obvious omission of windows (weight savings) and interior fluff.

Doing a stretch, or a re-wing or re-engine is an enormous thing.

Re: Software Vulnerabilities in the Boeing 787

#36

Post by _kbh_ » Sat, Aug 17, 2019, 12:20 AM UTC

service_bus wrote: post #15

Unlike the security researcher, I do have access to multiple 787s as I am one of many people responsible for maintaining them. I'm obviously not going to attempt to exploit the firmware on an aircraft for obvious reasons, but the security researcher's notion that you can "pivot" from the in flight entertainment to anything to do with aircraft operation is pure fantasy. These systems are entirely separate, including t…

If that is true, I am surprised that Boeing did not use that as a response to the researcher. Instead they responded that they have compiler mitigations in place and could not exploit the vulnerabilities themselves. That response makes me feel like the networks are not entirely seperate.

https://i.blackhat.com/USA-19/Wednesday/us-19-Santamarta-Arm...

page 52.

Re: Software Vulnerabilities in the Boeing 787

#37

Post by Aloha » Sat, Aug 17, 2019, 1:09 AM UTC

Hunisgung wrote: post #32

Aloha wrote: post #31

Earlier quoted context omitted.

Nothing you've quoted here disagreed with what the statement from the parent

> It allows connection to and access from external sources (the public Internet) and airline operator networks to the previously isolated Aircraft Control Domain and Airline Information Services Domain. I believe this contradicts the "systems are entirely separate" statement from the parent comment.

Nothing implies they are directly connected on the airplane however, which was my point

Re: Software Vulnerabilities in the Boeing 787

#38

Post by nickpsecurity » Sat, Aug 17, 2019, 1:10 AM UTC

amluto wrote: post #10

There is IMO exactly one valid way to get data from the flight systems to the entertainment network: use a literal one-way connection. Not “the only supported requests are data retrieval.” Not “the software folks only transmit.” A bona fide physical connection where one side has a transmitter, one side has a receiver, and there is no physical mechanism to send any information whatsoever the other way. These devices a…

Not just that. They have to be designed securely so they work in face of both logical and physical attacks. Security-focused diodes are supposed to include things such as emanation attacks. They're not cheap. Even the cheaper setups would be better than software-based security, though.

Re: Software Vulnerabilities in the Boeing 787

#39

Post by nickpsecurity » Sat, Aug 17, 2019, 1:17 AM UTC

service_bus wrote: post #15

Unlike the security researcher, I do have access to multiple 787s as I am one of many people responsible for maintaining them. I'm obviously not going to attempt to exploit the firmware on an aircraft for obvious reasons, but the security researcher's notion that you can "pivot" from the in flight entertainment to anything to do with aircraft operation is pure fantasy. These systems are entirely separate, including t…

When studying separation kernels, I remember that they were trying to safely/securely consolidate multiple systems (software and hardware) into fewer ones to save cost, size, energy, etc. Two things they were doing were separation kernels allowing lower-criticality stuff to be hosted with high-criticality and a special version of Ethernet (AFDX) that did something similar with provisions like reserving bandwidth.

So, you're saying there's no shared components at all... boards, data lines/switches, power lines/switches... between entertainment and critical systems? They run separate, highly-filtered power wires with separate boards with separate data lines for the two? No shared components at all?

Re: Software Vulnerabilities in the Boeing 787

#40

Post by amluto » Sat, Aug 17, 2019, 1:39 AM UTC

nickpsecurity wrote: post #38

amluto wrote: post #10

There is IMO exactly one valid way to get data from the flight systems to the entertainment network: use a literal one-way connection. Not “the only supported requests are data retrieval.” Not “the software folks only transmit.” A bona fide physical connection where one side has a transmitter, one side has a receiver, and there is no physical mechanism to send any information whatsoever the other way. These devices a…

Not just that. They have to be designed securely so they work in face of both logical and physical attacks. Security-focused diodes are supposed to include things such as emanation attacks. They're not cheap. Even the cheaper setups would be better than software-based security, though.

Does any of that actually matter in a realistic threat model in an airplane? The integrity of the critical systems matters, but there shouldn’t be any secrecy concerns. An attacker learning the full state of the avionics computer would be of little value. Similarly, a side channel from the entertainment system to a critical system shouldn’t matter unless the critical system is already compromised, since the critical system won’t be listening to the side channel.