Hacker Says He Can Break Into Airplane Systems Using In-Flight Wi-Fi | Hacker News Reader

Hacker Says He Can Break Into Airplane Systems Using In-Flight Wi-Fi

npr.org

77 pointsuger55 comments

I interned at Boeing for one summer on the 787 project. The way Boeing does networking at first seems old fashioned and asinine, until you think about it for a bit.

For one thing, they had static routing tables in place on a per port basis, and this was very finely gone over. Not counting all the other layers of protection in place, it was the case that flat out the consumer focused networking gear was not able to get packets routed over to any critical systems.

At the time, our threat assessment was "Osama Bin Laden gets on board with a laptop".

IIRC, and it has been quite a few years (the better part of a decade!), the few hardwired ports that did have access to more critical systems could only be used by laptops that had certificates on them providing authentication. Without that, even the ports that DID have the potential for routing to more important systems on board would get all their traffic forwarded to /dev/null.

Thanks for sharing! I would have always assumed that there was an air gap between the consumer focused IFE networking gear and the flight systems.

Why are the two systems even communicating?

That's a good question, one example I can think of is the TV channel on some aircraft that displays positional and airspeed information to passengers.

I assume this data comes somewhere from the flight computers.

Probably, although if you were paranoid enough (or required by regulation), you could airgap the TVs and give them information through a normal GPS system (minus the artificial altitude restriction), or have a hardware unidirectional data path. More reasonably, you could consider the TVs part of the flight system network (with many of the same protections to prevent someone from physically opening one and hacking), and still have an airgapped wifi network.

What altitude restriction? My phones' GPS works fine in flight, I use it a lot to check speed and altitude.

Yeah, the altitude restrictions don't really apply to commercial flight. You can conduct a test yourself, you just need to get a little higher and travel a little faster than your typical 757.

Try attaching your cell phone to a rocket travelling over 1200 mph or above 60,000 feet, you'll find that your GPS unit basically shuts down. That's not to say that your GPS hardware is incapable of operating under those parameters, it's just designed to shut down so it can't be used to guide ICBMs. Commercial airplanes typically operate at half the altitude and speed which would trigger the condition.

Don't both speed and altitude trigger the block? The gps must be over a certain altitude AND be going faster than a certain speed.

It is one or the other.

IIRC, the legal requirement is to shut down with both conditions are present, some GPS manufacturers simply found it easier to implement each restriction separately.

According to [1] some manufacturers apply this limit when both speed and altitude limits are reached, while other manufacturers disable tracking when only a single limit is reached.

The limits are 1,200 mph speed and 18,000 m altitude. Google tells me a 747's limits are around 615 mph and 14,000 m; Concorde's limits were closer to 1,350 mph and 18,300 m. Still, I'm sure if you're making an airliner you can get access to GPS receivers that will work even at maximum speed and altitude!

[1] http://en.wikipedia.org/w/index.php?title=CoCom&oldid=608893...

Do the limitations also apply to GLONASS which is now in all modern devices?

For stuff like positional and airspeed information, it would not be difficult to design a connection that is physically limited to one-way communication.

It would also seem sensible that any interaction the pilots might want to perform on the cabin computer systems could be done by giving them a terminal on that network.

For some stuff that did have data sharing there was a very tightly controlled pipe. Oddly enough it was Linux on one side and Windows on the other.

The level of scrutiny that IPC (inter-processor communication) channel got was insane. It is probably one of the safest IPC channels in existence!

Unfortunately I didn't fully grasp what systems it was connecting, aviation is full of its own parallel set of jagon that I didn't fully learn in my short time at Boeing!

> Oddly enough it was Linux on one side and Windows on the other.

Doesn't sound at all odd -- quite sensible actually. Though I would probably have suggested a pairing more along the lines of OpenBSD/x64 and Linux/ARM or some-such. It depends on what the remainder of the systems is using. This is a perfect example of where ecosystem diversity is a Good Thing.

Every map channel I've seen has been analog, even on otherwise purely digital IFE, implying that the map video signal is generated by a device networked on the avionics side and then piped by standard RF to the IFE, like the address system. So no two-way communication.

Newer ones are digital (I've seen 3D interactive ones on an A380)

Most IFE stuff is aftermarket. Boeing was aiming to make things like Wi-Fi standard across all 787s. I'm not sure to what extent IFE was part of 787 plans.

I mostly worked on the Electronic Flight Bag, which is a hilarious case of Boeing realizing that paper flight bags were asinine, and then coming up with an industrial strength solution to the problem of carrying what amounted to a few PDFs on board an airplane.

Last time I checked (years ago) airlines were just moving to iPads whenever possible.

(A flight bag has hundreds upon hundreds of pages of paper that are required by law to be on board an airplane with the pilot, everything from safety literature to information on the current flight, it is a huge hassle)

Again the problem here is, if Boeing ships something stock, the FAA equivalent in every market a plane will be sold into has to agree to every decision made. If a single regulatory body anywhere declares that iPads are not safe for use onboard an airplane, well, the entire idea gets scrapped. This happens to a lot of good ideas.

If Boeing had its way, we'd all have in flight cellular, Wi-Fi, and more, as options on every plane trip we took. Boeing spends a lot of time and a lot of effort on what they know will likely be futile efforts to improve the passengers' experience. But they try anyway. Everyone I met working there flat out loved airplanes with the same zest and zeal we all here share about technology.

The latest flightbag systems look a bit more sophisticated than a fancy PDF reader on a tablet.

Here's a glimpse of the flightbag that Lufthansa is using on the B747. It actively maps plane position in the terminal among other things.

https://www.youtube.com/watch?v=nhXXjNybx6A&t=2m4s

https://www.youtube.com/watch?v=nhXXjNybx6A&t=13m43s

(FYI, PilotsEye.TV on YouTube is incredible if you enjoy geeking out on airplane stuff. They somehow convinced a few European carriers to mount cameras all over the cockpits and talk to the pilots in-flight. There are DVDs as well but I think they're all in German. Check out the A340 that loses an engine in the air. I don't think that's ever been publicly filmed before).

True! But the paper books ended up being replaced by ipads in some cases. The EFB does other stuff as well, but the effort around getting all the papers onto it versus "use an iPad" is rather amusing imho.

From what I understand, pilots spend countless hours updating their books with technical updates, procedure changes, and map revisions. And you hope that each one is 100% up-to-date when they fly. I think the EFB is a great innovation.

So was this 802.1X? Do you know if they upgraded to 802.1X-2010? TFA says that logins are hard-coded; does that agree with your recollection?

All I can remember was that some critical systems still used an industry variant of token ring, because it provides hard promises for bandwidth and latency, akin to what an RTOS provides in regards to a guaranteed time slice.

It was funny, in my networking class we were told there were two things we'd likely never encounter: Static routing tables and token ring.

I recall there was some controversy about having the low security stuff on the same network as anything else at all. The FAA freaked the heck out and made Boeing go to the umpteenth degree to make it super secure.

I really should remember more given that my resume had a line item on it of "Helped prepare 787 Avionics security training material"!

That does seems wrong. First, did Osama (or Al Qaeda) really have any experience with hacking computer systems in this way?

Second, why would you rely on "static routing tables" and "certificates" for defending against an attacker in the worst case when you could just use an air gap?

There are multiple networks on an airplane. Some are air gapped, but running multiple parallel wiring systems adds a lot of weight to a plane. If a medium and low security system can share some cabling and be secured through software, then there is little reason not to.

The engine control wasn't hooked up to the AV system or anything!

How do you explain Boeing's decision for backdoors in their planes, then? If a hacker ever gets access to that, Boeing deserves to go bankrupt over international outrage.

http://www.theguardian.com/technology/2012/may/29/cyber-atta...

Ridiculous article..

Here's the actual blog post, and the 25-page whitepaper.

http://blog.ioactive.com/2014/04/a-wake-up-call-for-satcom-s...

http://www.ioactive.com/pdfs/IOActive_SATCOM_Security_WhiteP...

On a side note, what's with all the similar press photos of this guy in front of graffiti?

https://imgur.com/a/nOuff

The graffiti gives him mad street cred.

It's Gilfoyle[1] from Silicon Valley!

[1] http://silicon-valley.wikia.com/wiki/Gilfoyle

A newspaper writer or photographer will often have questionable ideas for framing you in a photograph. I know of one guy locally who ended up wrapped in networking cables (including ethernet plugs in his ears!?) for a photo because he's a web developer and you know, internet, cables...

They would've said "Have you got any laptops you could have with and near you? OK, bring them all and we can place them around. I saw a great door with graffiti nearby, we can shoot there. Now, look like you're serious and might hack something at any second."

Source: We got local press for hexiledgame.com (2 million plays in first 10 days, had never made a game before) and the photographer came out on Monday. And I think we escaped lightly! Most frequent instruction was "Now, smile like you've had 2 million plays!" All the while, I was thinking "We need to get back to adding language support and I haven't even made a press kit -- too worried to smile..."

A few years ago I remember reading a discussion about the possibility of "hacking a plane" and someone who worked in the industry said that the avionics were immune to this since the communication only goes one way. On the other hand, I don't doubt at all that the IFE/passenger displays could be hacked, since apparently things like this happen rather frequently:

http://img.thedailywtf.com/images/13/q2/e67/Pic-2.jpg

http://img.thedailywtf.com/images/13/q3/e74/Pic-4.jpg

http://img.thedailywtf.com/images/200905/errord/DSC_0001.JPG

http://img.thedailywtf.com/images/14/q2/e117/Pic-5.jpg

these are images of bugs, not hacks

Anything consumer focused installed after a plane leaves the factory is subject to much less stringent checks.

Anything Boeing puts on a plane as stock has to pass review by the appropriate agency of all countries the plane will be sold to.

I remember one poor guy, his job was to try and negotiate the necessary agreements for in flight phone calls for every country the 787 would be flying over for the routes of its initial sales.

As I recall, he got damned close! It had to be scrapped when some countries wouldn't allow it.

Individual carriers can easily enough add it to only flights over countries that they can meet proper regulations for. Much less of a hassle!

Oh those displays are so ugly... Someone please hire Michael Okuda or someone else who has this thing called "attention to detail" and knows how to make displays that don't look like crap.

But yeah, I know, no profit in making things look nice; it's enough to make them just not repulsive. It saddens me that in the last 20 years we've developed many technologies straight out Star Trek and others, and yet they don't feel like from the movies mostly because no one cares about aesthetics in real world.

If you want to see something highly functional but also out-of-the-movies sharp, try redeeming an iTunes gift card on a Mac via the built-in camera.

Define "break in" and "interfere."

Could he down an airplane? Or just access logs?

If you read the article: "One vulnerability that Santamarta said he found in equipment from all five manufacturers was the use of 'hardcoded' log-in credentials, which are designed to let service technicians access any piece of equipment with the same login and password."

Sounds like he could access the plane's systems from an administrator's perspective. I would watch the Black Hat presentation to be sure.

The "all five manufacturers" in question are the manufacturers of satellite equipment. It sounds like he could access the satellite entertainment equipment as an administrator, but that's (one would hope) a far cry from being able to access anything important on the plane.

During an international Air Canada flight, they had USB ports right beside the touch screen seat back monitors. I thought I'd try plugging my remote mouse into it. Worked perfectly fine, a mouse pointer showed up and I could use it fine.

I was wondering what I could do with a keyboard, or a nicely crafted USB stick. The interface seems to be an HTML/JS interface, so I'm not sure what OS it was running on. The mouse pointer was not a Windows default so it was probably Linux.

I wonder if I could have switched terminals if I had my keyboard. Also, if I had my keyboard I'd be too scared to try.

Some Delta planes and I think all Virgin planes that have that inflight infotainment system run on a flavor of linux with a ton of plugins and insecure SSH enabled by default. Ask me how I know.

How?

I remember once the screen in front of me crashed and clearly booted up some flavour of linux. (it even displayed the penguin!) Oh and i think it did end up on a console... though there were no USB ports visible at the time

I've seen this too.

Flew on a 787 recently, they had a problem with the IFE system and rebooted it; it's Linux. Recognised the default X11 cursor straight away and was even able to move it around with my touchscreen before it disappeared and their UI came up.

That plane had a USB port by each screen too; I didn't have any peripherals to test if it interfaced though.

Singapore Airlines IFE rebooting the Linux kernel https://www.flickr.com/photos/kalleboo/2473197800/

Running StarOffice https://www.flickr.com/photos/kalleboo/2473197320

Thai Airways entertainment system rebooting Linux (with the penguin logo visible) https://www.flickr.com/photos/kalleboo/3911989854/

isn't this why equipment used to be administered with a hard serial port on the back? (I remember switches that need to be administered that way, from a few years ago).

It boggles the mind that hard coded credentials to flight systems could be exploited from customer facing wifi.

Sort-of relevant XKCD: http://xkcd.com/463/

Why would the airplane's critical systems be in any way connected to passenger WiFi? Or the Internet in any way?

787s have some really cool self monitoring abilities. Every part on them is wired up with every type of sensor you can imagine. This allows the plane to track its health at all times. The coolest feature we saw a demo of (I have no idea if it shipped!) was the plane radioing ahead to the airport it was headed to with a maintenance request form auto filled out! Personnel at the airport would be informed and have the relevant maintenance manuals automatically downloaded to their laptop.

This actually removed a lot of down time for the plane, as typically workers would have to manually inspect many of these parts on a regular basis to check wear levels.

Seriously cool stuff!

What does that have to do with the public-facing wifi? I suppose if there's any radio connection and they have hard-coded credentials, the "public-facing" part of it doesn't really matter as much, but still, it's kinda basic stuff to airgap critical networks from the public.

That's the multi-million dollar question.

I could theorize the cheapest way for the features com2kid is talking about to work is to use the commercial Internet connection for uploads. Then the device that connects needs an IP, and just happens to be running a telnet server for maintenance (it's always telnet) and nobody ever changes the default credentials. Now that device still has no actual control but it's connected to the airplane systems over a serial console. Which is also available to log in with the default credentials...

Another comment here suggests he only gained access to the satellite systems which would suggest this is overblown.

Unfortunately I have no recollection of how everything is wired together. (Not that I ever had complete understanding of it!)

I know they consolidated some wiring, but I cannot say what was consolidated with what. I just remember the static routing table for security.

Do mechanics still schedule manual checks periodically? I'd be afraid of relying too much on automated systems.

Yup! But the periodic inspections can happen less often on the 787, thus saving the airline a substantial amount of money! The inspections take an extended period of tine during which the plane isn't earning any money. By enabling those inspections to happen less often, the 787 reduces overall costs to the airline.

no no no no.

They just started letting us use devices during takeoff. No more alarmist headlines please.

Precisely my thought...it was fun while it lasted!

Reply on news.ycombinator.com