Boeing 787 May Be Vulnerable to Hacker Attack 332
palegray.net writes "An article posted yesterday on Wired.com notes that 'Boeing's new 787 Dreamliner passenger jet may have a serious security vulnerability in its onboard computer networks that could allow passengers to access the plane's control systems, according to the U.S. Federal Aviation Administration.' They're already working on solutions to the problem - including placing more physical separation between aircraft networks and implementing more robust software-based firewalls."
I don't get it... (Score:5, Insightful)
Wow, this is scary (Score:1, Insightful)
Re:I don't get it... (Score:4, Insightful)
Re:I don't get it... (Score:4, Insightful)
Madness (Score:2, Insightful)
who cares? (Score:5, Insightful)
Madness, and probably a violation of safety regs (Score:4, Insightful)
My thought is that some asshole at boeing decided to save some money on cable runs and ginned up an explanation of how software segregation would serve as an adequate barrier between flight critical systems and passenger systems. They never learn.
Doesn't say how the networks are connected.... (Score:3, Insightful)
Someone should get fired for this (Score:3, Insightful)
The control and navigation system of an airplane is one of the most critical networks possible; the lives of hundreds of passengers (and potentially of thousands of people on the ground) depend on its correct functioning. There are not many more critical networks than that, except maybe control systems for weapons, nuclear plants and some factory control systems.
Even the worst sysadmin out there knows that you do not physically connect such a highly sensitive, highly critical network to something crappy like the in-flight passenger entertainment network.
Why should the two networks should be connected at all? To tell the passengers the current speed of the plane?
The XBox was hacked. The playstation was hacked. DVDs were hacked. HD-DVD was hacked. Pretty much anything out there was hacked if someone had an interest in it (and mostly the interest wasn't commercial, just "for fun"). Even if they do aren't "completely connected" as Boeing claims, the danger of it being hacked is very real. On one hand you are not allowed to use your mobile phone on a plane, and on the other you can play with a network which is attached to the navigation and control system? Come on.
Re:I don't get it... (Score:4, Insightful)
(stupid NDA...)
Re:I don't get it... (Score:5, Insightful)
My guess is it has to do with controlling the actual system for the passenger use. Pilots gotta have access to the No Smoking sign switch for example. So without any real technical background in how these systems work, I'd say they were simply given a switch to turn access on or off etc, and that simply meant some sort of basic connection had to be issued between the cockpit systems and passenger entertainment systems.
The FAA report doesn't say exactly what the connection is between the systems, it just says there is a connection. My guess is it's the FAA over-hyping a situation, or someone else, to try and get these birds as safe as possible. Although I would agree that the passenger system should be as isolated as possible, and if control of these systems is needed, just run separate lines that link only to that system, even if it is basically pointless if the connection I assume it is really is that simple. I guess i welcome my first post to /. too after reading it for a year or so and keepin my thoughts to myself =D
Re:Two seperate networks (Score:2, Insightful)
I am a Military Avionics Technician and I must admit that I find this report confusing.
The only thing that is being suggested is that the passenger system could corrupt the flight systems which I find unlikely - it's chalk and cheese with regard to how these systems communicate. The only way I can see a problem is if one of the Avionic bus controllers is swamped by requests from one of the passenger systems.
I know this isn't a military design but surely the flight systems such as flight management and navigation are not on the same bus?
Disclaimer - Digital is new in my countries military ;-)
Re:Wow, this is scary (Score:3, Insightful)
If that worries you, then I look into Airbus - at least Boeing beleives the pilot should always have the last say, not the computer [ncl.ac.uk]
Re:Madness, and probably a violation of safety reg (Score:2, Insightful)
While I completely agree, designers are always under pressure to reduce the amount of wiring looms - they add a surptising amount of weight thereby decreasing fuel economy.
Re:Madness, and probably a violation of safety reg (Score:3, Insightful)
Re:I don't get it... (Score:5, Insightful)
The pilots certainly do need access to some of the cabin systems, for the seatbelt sign, for example. They may also need to be able to turn the cabin network off altogether. But those switches should have no signal connection of any kind to the maintenance and monitoring/control systems. The two networks should be physically partititioned.
The way I read the article, there really are some connections between the networks (my guess is that it was simply cheaper or more convenient to link them), and the FAA's not happy with that state of affairs. I can't say I blame them.
Somehow I have a suspicion that someone will crack this sooner or later, and the TSA will react by banning use of laptops or something equally foolish, rather than addressing the more basic fact that the plane's systems have not been hardened appropriately (in this case, by being physically partitioned).
Act of Faith (Score:3, Insightful)
"Sure, Boeing's spent a decade designing this plane with thousands of engineers, but I read a short Slashdot story summary and now I'm going to decree I know more than them!"
Re:I don't get it... (Score:3, Insightful)
[extreme sarcasm] Routers and switches have never had vulnerabilities before... I'm not worried at all!!![/e]
Please leave the mission-critical security analysis to the rest of us, okay NEWB?
Re:I don't get it... (Score:3, Insightful)
Why does there have to be a "network" for this at all? What happened to a simple *switch*, *light bulbs*, and wires to connect them to the battery? It's reliable, works well, and cheap. And you don't have to worry about passengers hacking the jet through the seatbelt light.
Why are companies so obsessed with making things needlessly complicated these days? I'm a geek, and love computers. But there are some things that are so simple, you don't need a computer to make them work. The seatbelt light on a plane is one of these things. Snap switch. Light bulbs. Power source. Wires. DONE. End of story.
Further proof Wired SUCKS at news. (Score:2, Insightful)
Re:I don't get it... (Score:3, Insightful)
Uh, OK.
Re:I don't get it... (Score:5, Insightful)
Actually, we try pretty hard to make sure that when it does happen, it is an accident.
A little perspective (Score:5, Insightful)
This is not a "Windows vs Linux" thing. These are highly specialized data networks designed specifically for aircraft. The typical running life of a big jet is some 40 years or more - the idea of a consumer O/S such as Windows (or even Linux) being suitable for such a situation is simply stupid. Everything is coded in firmware, micro-processor based, with a likelyhood of actually crashing accidentally being somewhat less likely than getting struck by lightning on a sunny day while sitting in the cellar of your 4-story house.
Not bloody likely.
But, actual, malicious attack? Possible - and if there was *ANY* connection between the passenger data networks and the main control networks, that's an issue that must be addressed.
Most likely, the FAA found some part that was connected to both networks, that itself was not capable of actually transmitting data. But they're being car eful, as is their job, since lives are on the line.
Go FAA!
Re:I don't get it... (Score:3, Insightful)
Re:I don't get it... (Score:4, Insightful)
There, I've just done three hundred man-hours of six-figure-salary engineering... in 5 minutes. I'll wait by my mailbox for the check. Thanks!
Re:I don't get it... (Score:3, Insightful)
Because the cabin systems directly affect resource usage.
- An enterprising hijacker could use this to drain the available electrical energy and make operating the aircraft difficult to impossible
- A pilot needs to be able to shutdown systems in case of emergency (like, we only have 50% generator capacity because we lost an engine, is it going to be used to actually fly the airplane, or to present nice pictures on displays in the cabin)
Even when you make flight attendants responsible for it in normal circumstances, you do need a way to override it from the cockpit.
Re:Restriction on software during flight? (Score:3, Insightful)
Re:I don't get it... (Score:3, Insightful)
This way, the pilot has an quick and easy chance of turning everything off in an emergency and the layer separation between avionics and utilitiy systems is as good as it can be. No hacker and hijacker can then drain the plane's energy supply AND no hacker can interfere with the flight controls.
Simple, reliable one-way connections only. For data transfer we have things like forward error corrections already and the optical one-way interconnect should work extremely well. Use a standard gigabit optical fiber connection with only the sending fiber connected, as the IR-connection is too simply and error prone. Gigabit fiber has enough bandwidth, is electrically isolating and inherently secure. Why don't they use optical connections for the airplane version of the CAN bus anyway?