Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

wired.com

Post reply on HN
Print view View original

51–60 of 277 posts

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#51

Post by b_tterc_p »

avgDev wrote: post #24
sushisource wrote: post #3

It seems insane that all this code isn't just open source by default. No one's going to be able to rip off airlines by stealing it, you still need to have a company that, you know, sells planes. Keeping it closed seems like a full admission that "there are probably a bunch of bugs in here and we don't want people to see them"

Because by keeping it closed, it is safer. /s Most executives care about profits, security is simply not important. Even if an engineer explains that he needs more time to properly secure something, he will be asked to cut corners. Then, when shit hits the fan the executive will make a "pikachu face" and engineer will get fired for not properly implementing security.

Having met a fair number of top executives I don’t feel this is true. People at the top do care quite a bit, and put personal pride into their company being good. But all low level decisions are made downstream, and middle managers are far less personally invested. Reactions to bad press are reactions. Hard to say whether it reflects anyone’s reality.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#52

Post by ummonk »

sushisource wrote: post #3

It seems insane that all this code isn't just open source by default. No one's going to be able to rip off airlines by stealing it, you still need to have a company that, you know, sells planes. Keeping it closed seems like a full admission that "there are probably a bunch of bugs in here and we don't want people to see them"

Given that airplanes haven’t been hacked yet, security by obscurity seems to have been working...

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#53

Post by tyingq »

phkahler wrote: post #34
izzydata wrote: post #29

Earlier quoted context omitted.

There is more than 1 company that sells planes and writes plane software.

So they would all contribute, which would lower costs?

Personally, I would not want a tech monoculture for passenger jets. A single issue grounding all flights (or worse) wouldn't be good.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#54

Post by airstrike »

volkk wrote: post #50
airstrike wrote: post #45

Earlier quoted context omitted.

They'd lose the ability to differentiate themselves (only on this specific criteria, but definitely affects overall competitiveness), thus having to compete more on price, which is great for customers but bad for companies.

i dont think i know of any airline company that prides themselves on the code they wrote?

Airbus.

Not a matter of pride, but you don't want to help your competitors offer the same capabilities as you for $0 R&D costs

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#55

Post by ken »

sagebird wrote: post #19

If I owned a 787, would I be likely to have the rights to lend it to security researchers to test the exploits, or would it be prohibited through a contract that Boeing requires customers to agree to? Is there a reason that an individual would own a 787 for personal use— eg - is it a plane that people change the interior layout for use as a private jet, or are these planes all tied up in commercial use? If I owned on…

Drake owns a 767 [1], and the founders of Google own one [2]. A couple members of the Saudi Arabian royal family are reported to own 777s [3]. It's not inconceivable that an individual could own a 787, though I can't find any reference to one yet.

I think, though, that the sort of person who owns one doesn't tend to want to tinker with it. You just hire someone to fly it, and know that it's always available. The difference between owning and renting, at that level, is mostly financials. Besides, even if you own the aircraft, it's likely you don't own the engines [4], and they're kind of an important component of the overall system.

Likewise, I don't know anyone who owns a car who has loaned it to a researcher to analyze it for design flaws. A couple people have done it [5], but for the vast majority of owners, you just use it normally, and if something breaks, you deal with the problem then. Airplanes are loaded with redundancies for critical systems so a lot of things have to go wrong for it to crash.

[1]: https://www.cbsnews.com/news/inside-air-drake-rapper-unveils... [2]: https://searchengineland.com/your-guide-to-the-google-jet-12... [3]: https://www.private-jet-fan.com/private-jet-owners-register.... [4]: https://www.quora.com/Do-some-airlines-not-own-the-engines-o... [5]: https://www.washingtonpost.com/news/morning-mix/wp/2015/07/2...

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#56

Post by AmericanChopper »

msbarnett wrote: post #23

> But Boeing counters that it has both "additional protection mechanisms" in the CIS/MS that would prevent its bugs from being exploited from the ODN, and another hardware device between the semi-sensitive IDN—where the CIS/MS is located—and the highly sensitive CDN. That second barrier, the company argues, allows only data to pass from one part of the network to the other, rather than the executable commands that wo…

Every exploit payload is comprised entirely of data, so I think you’re even giving them too much credit there...

The thing that triggered me the most was that they got the engineers who wrote the code to test it, and report back that their own code was fine. From the sound of it they didn’t even test the vulnerability, they just did an external test, without specifically testing the segmentation controls or the components in question.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#57

Post by FDSGSG »

sagebird wrote: post #19

If I owned a 787, would I be likely to have the rights to lend it to security researchers to test the exploits, or would it be prohibited through a contract that Boeing requires customers to agree to? Is there a reason that an individual would own a 787 for personal use— eg - is it a plane that people change the interior layout for use as a private jet, or are these planes all tied up in commercial use? If I owned on…

A 787 will be harder to come by, but if someone here wants to buy a cheap 737 with an interesting backstory, here's one https://www.controller.com/listings/aircraft/for-sale/203487...

Previous owner was this guy https://www.insurancejournal.com/news/southcentral/2018/10/1... https://uk.flightaware.com/resources/registration/N912NB

I can't help but wonder what he planned to do with the plane, any insurance fraud scheme involving a passenger jet would probably invite interesting consequences.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#58

Post by samuell »

sushisource wrote: post #3

It seems insane that all this code isn't just open source by default. No one's going to be able to rip off airlines by stealing it, you still need to have a company that, you know, sells planes. Keeping it closed seems like a full admission that "there are probably a bunch of bugs in here and we don't want people to see them"

Anything that can create the proper incentives for keeping code at all levels secure enough. (Indeed, perhaps open source is the only realistic one, for newly written code at least).

Because yes, it seems the problem is with incentives. If attacks on such things happen seldom enough, that will never trickle down into incentives for managers at all levels to prioritize security high enough.

Then, somebody could argue that if it happens seldom enough, that is reason to not prioritize it that highly. But I don't think the actual risk translates into actual incentives for managers in a very linear, nor fact-based manner, especially when the number of occurances is very low, while still with catastrophic consequences.

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#59

Post by starpilot »

> To be clear, neither Savage nor Koscher believe that, based on Santamarta's findings alone, a hacker could cause any immediate danger to an aircraft or its passengers. "This is a long way from an imminent safety threat. Based on what they have now, I think you could let the IOActive guys run amok on a 787 and I'd still be comfortable flying on it," Savage says. "But Boeing has work to do."

Re: A Boeing Code Leak Exposes Security Flaws Deep in a 787's Guts

#60

Post by passivepinetree »

volkk wrote: post #50
airstrike wrote: post #45

Earlier quoted context omitted.

They'd lose the ability to differentiate themselves (only on this specific criteria, but definitely affects overall competitiveness), thus having to compete more on price, which is great for customers but bad for companies.

i dont think i know of any airline company that prides themselves on the code they wrote?

I used to work for an airline as a software engineer (different from a company that makes airplanes, but you brought up airlines, so I think it's valid).

We definitely attempted to write the best code as we could given the circumstances, but we had issues doing so:

* airline margins are razor thin, so salaries are comparatively low, which means

* the best employees frequently left for other opportunities, causing

* management to institute an over-reliance on process and tech debt from poor engineers to build up like crazy, and then

* management's priority was always "keep the lights on" rather than repay any tech debt or start new ventures.

Eventually we were working on an unmaintainable codebase, spending way too long to ship each feature, and the situation was not improving.

It was not a wonderful environment to work in (hence my departure).

Post reply on HN