[Infowarrior] - FAA: Boeing's New 787 May Be Vulnerable to Hacker Attack

[Richard Forno]

FAA: Boeing's New 787 May Be Vulnerable to Hacker Attack
By Kim Zetter Email 01.04.08 | 7:30 PM
http://www.wired.com/politics/security/news/2008/01/dreamliner_security

Boeing's new 787 Dreamliner passenger jet may have a serious security
vulnerability in its onboard computer networks that could allow passengers
to access the plane's control systems, according to the U.S. Federal
Aviation Administration.

The computer network in the Dreamliner's passenger compartment, designed to
give passengers in-flight internet access, is connected to the plane's
control, navigation and communication systems, an FAA report reveals.

The revelation is causing concern in security circles because the physical
connection of the networks makes the plane's control systems vulnerable to
hackers. A more secure design would physically separate the two computer
networks. Boeing said it's aware of the issue and has designed a solution it
will test shortly.

"This is serious," said Mark Loveless, a network security analyst with
Autonomic Networks, a company in stealth mode, who presented a conference
talk last year on Hacking the Friendly Skies (PowerPoint). "This isn¹t a
desktop computer. It's controlling the systems that are keeping people from
plunging to their deaths. So I hope they are really thinking about how to
get this right."

Currently in the final stages of production, the 787 Dreamliner is Boeing's
new mid-sized jet, which will seat between 210 and 330 passengers, depending
on configuration.

Boeing says it has taken more than 800 advance orders for the new plane,
which is due to enter service in November 2008. But the FAA is requiring
Boeing to demonstrate that it has addressed the computer-network issue
before the planes begin service.

According to the FAA document published in the Federal Register (mirrored at
Cryptome.org), the vulnerability exists because the plane's computer systems
connect the passenger network with the flight-safety, control and navigation
network. It also connects to the airline's business and
administrative-support network, which communicates maintenance issues to
ground crews.

The design "allows new kinds of passenger connectivity to previously
isolated data networks connected to systems that perform functions required
for the safe operation of the airplane," says the FAA document. "Because of
this new passenger connectivity, the proposed data-network design and
integration may result in security vulnerabilities from intentional or
unintentional corruption of data and systems critical to the safety and
maintenance of the airplane."

The information is published in a "special conditions" document that the FAA
produces when it encounters new aircraft designs and technologies that
aren't addressed by existing regulations and standards.

An FAA spokesman said he would not be able to comment on the issue until
next week.

Boeing spokeswoman Lori Gunter said the wording of the FAA document is
misleading, and that the plane's networks don't completely connect.

Gunter wouldn't go into detail about how Boeing is tackling the issue but
says it is employing a combination of solutions that involves some physical
separation of the networks, known as "air gaps," and software firewalls.
Gunter also mentioned other technical solutions, which she said are
proprietary and didn't want to discuss in public.

"There are places where the networks are not touching, and there are places
where they are," she said.

Gunter added that although data can pass between the networks, "there are
protections in place" to ensure that the passenger internet service doesn't
access the maintenance data or the navigation system "under any
circumstance."

She said the safeguards protect the critical networks from unauthorized
access, but the company still needs to conduct lab and in-flight testing to
ensure that they work. This will occur in March when the first Dreamliner is
ready for a test flight.

Gunter said Boeing has been working on the issue with the FAA for a number
of years already and was aware that the agency was planning to publish a
"special conditions" document regarding the Dreamliner.

Gunter said the FAA and Boeing have already agreed on the tests that the
plane manufacturer will have to do to demonstrate that it has addressed the
FAA's security concerns.

"It will all be done before the first airplane is delivered," she said.

Loveless said he's glad the FAA and Boeing are addressing the issue, but
without knowing specifically what Boeing is doing, it is impossible to say
whether the proposed solution will work as intended. Loveless said software
firewalls offer some protection, but are not bulletproof, and he noted that
the FAA has previously overlooked serious onboard-security issues.

"The fact that they are not sharing information about it is a concern," he
said. "I'd be happier if a credible auditing firm took a look at it."

Special conditions are not unusual. The FAA publishes them whenever it
encounters unusual issues regarding a plane's design or performance in order
to communicate on record that it expects the manufacturer to address the
issue. It's then up to the manufacturer to demonstrate to the FAA that it
has solved the problem. Gunter said the FAA has issued eight special
conditions on the Boeing 787, but that not all of them pertain to the
plane's computer systems.