Boeing Dreamliner....

[sn00p]

This is brilliant.

http://www.wired.com/politics/security/news/2008/01/dreamliner_security

So, which idiot (or group of idiots) at boeing decided it'd be a really good idea to have the passenger network connected to the same network at the avionics system.

It's a real good job that the FAA are on the ball, I hope everybody who let this get as far as this have got the sack.

Scary.

 

[Brand86]

Ha not going to be going on that bad boy until they stick up some kind of uber firewall. Imagine, one minute you think you are playing MS Flight Simulator on your laptop, the next your actually flying the plane. I imagine terrorists would be pretty keen to have a pop!

 

[Mike_182]

There's only limited information in there so how you can make a sweeping statement such as that is beyond me. The FAA may only be concerned with one aspect of it's use, and it may not be as significant as the article makes out.

We all know how much news can be very over the top and exaggerated.

 

[Pep]

The amount of money that I see going into developing a single engine for the plane shows just how much would go into the actual plane itself, there would only be a very very small chance anything like that could happen. Admitidly though that is enough but I very much doubt it is linked to any of the vital systems in the plane, if it even is at all.

As Mike above says, it will more than likely be exaggerated beyond belief.

 

[sn00p]

I think the FAA are concerned because the 2 networks are actually connected, possibly with a firewall (no specific details), but that is just plain wrong, these two networks should not be connected in any way, shape or form.

Not an exaggeration by the FAA, f**king common sense. Boeing are obviously fully aware that they've fucked up because they're now having to fix the problem.

I've written a TCP/IP stack and I'd be very concerned if I had a safety critical system which allowed john & jane doe access to the phsyical transport layer, seriously, this is the sort of crap you'd expect in a "hollywood hacker movie".

It's incredibly easy to f**k a network up (spoof ARP packets would be a good start), if you managed to get these through their firewall (and I'm presuming there is one, hopefully they're not that *dumb*) then you could potentially inhibit these systems talking to each other.

 

[sn00p]

Admitidly though that is enough but I very much doubt it is linked to any of the vital systems in the plane, if it even is at all.

As Mike above says, it will more than likely be exaggerated beyond belief.

From the FAA report:

The digital systems architecture for the 787 consists of several
networks connected by electronics and embedded software. This proposed
network architecture is used for a diverse set of functions, including
the following:
1. Flight-safety-related control and navigation and required
systems (Aircraft Control Domain).
2. Airline business and administrative support (Airline Information
Domain).
3. Passenger entertainment, information, and Internet services
(Passenger Information and Entertainment Domain).
The proposed architecture of the 787 is different from that of
existing production (and retrofitted) airplanes. It allows new kinds of
passenger connectivity to previously isolated data networks connected
to systems that perform functions required for the safe operation of
the airplane. Because of this new passenger connectivity, the proposed
data network design and integration may result in security
vulnerabilities from intentional or unintentional corruption of data
and systems critical to the safety and maintenance of the airplane. The
existing regulations and guidance material did not anticipate this type
of system architecture or electronic access to aircraft systems that
provide flight critical functions. Furthermore, 14 CFR regulations and
current system safety assessment policy and techniques do not address
potential security vulnerabilities that could be caused by unauthorized
access to aircraft data buses and servers. Therefore, special
conditions are imposed to ensure that security, integrity, and
availability of the aircraft systems and data networks are not
compromised by certain wired or wireless electronic connections between
airplane data buses and networks.

It's scary that 1 & 3 could even conceivably be connected together, you know, even network giants like cisco get firewalls wrong time to time.

 

[Mike_182]

From the FAA report:

The digital systems architecture for the 787 consists of several
networks connected by electronics and embedded software. This proposed
network architecture is used for a diverse set of functions, including
the following:
1. Flight-safety-related control and navigation and required
systems (Aircraft Control Domain).
2. Airline business and administrative support (Airline Information
Domain).
3. Passenger entertainment, information, and Internet services
(Passenger Information and Entertainment Domain).
The proposed architecture of the 787 is different from that of
existing production (and retrofitted) airplanes. It allows new kinds of
passenger connectivity to previously isolated data networks connected
to systems that perform functions required for the safe operation of
the airplane. Because of this new passenger connectivity, the proposed
data network design and integration may result in security
vulnerabilities from intentional or unintentional corruption of data
and systems critical to the safety and maintenance of the airplane. The
existing regulations and guidance material did not anticipate this type
of system architecture or electronic access to aircraft systems that
provide flight critical functions. Furthermore, 14 CFR regulations and
current system safety assessment policy and techniques do not address
potential security vulnerabilities that could be caused by unauthorized
access to aircraft data buses and servers. Therefore, special
conditions are imposed to ensure that security, integrity, and
availability of the aircraft systems and data networks are not
compromised by certain wired or wireless electronic connections between
airplane data buses and networks.

It's scary that 1 & 3 could even conceivably be connected together, you know, even network giants like cisco get firewalls wrong time to time.

Actually, just about every network is phsically connected to every other network via this massive thing called the Internet. It's all to do with getting your firewalls right and tbh that's easy from a corporate point of view. Keep the two sides on different subnets and only put in the rules for the things that you need (a whitelist firewall). Blacklist firewalls are more difficult to set up as they specify what is blocked.

A well set up firewall should be bulletproof, and I've managed it a few times myself.

 

[sn00p]

Actually, just about every network is phsically connected to every other network via this massive thing called the Internet. It's all to do with getting your firewalls right and tbh that's easy from a corporate point of view. Keep the two sides on different subnets and only put in the rules for the things that you need (a whitelist firewall). Blacklist firewalls are more difficult to set up as they specify what is blocked.

And how many high security systems get hacked every single day?

This is also subtly different (and more dangerous) because the underlying transport layer is exposed too, i.e ethernet, which it isn't when you're accessing the internet where only the protocol layer is exposed.

A well set up firewall should be bulletproof, and I've managed it a few times myself.

"should be".....couldn't say it better myself.

 

[Mike_182]

And how many high security systems get hacked every single day?

This is also subtly different (and more dangerous) because the underlying transport layer is exposed too, i.e ethernet, which it isn't when you're accessing the internet where only the protocol layer is exposed.

How can you say that for certain? Did you construct it?

Just because the FAA have issued a request for it doesn't mean it's actually a fault - it could be that as it's an undocumented area of technology within the airline industry that they just need it's security and stability demonstrating.

And yes, I come from an Aerospace engineering background.