January 5th, 2008

Boeing 787 at risk of in-flight hacking

Posted by Michael Krigsman @ 8:25 pm

Categories: IT issues, Project failures, Project management, Project strategy

Tags: FAA, Hacking, Network, Boeing Co., Networking, Michael Krigsman

The network architecture aboard Boeing’s new 787 leaves the aircraft susceptible to infiltration by passengers during a flight. As reported by Wired:

The computer network in the Dreamliner’s passenger compartment, designed to give passengers in-flight internet access, is connected to the plane’s control, navigation and communication systems, an FAA report reveals.

Given the need for fail-safe operation during flight, this issue justifiably raises serious concerns. Here’s an excerpt from the FAA report (also at Cryptome.org):

The proposed architecture of the 787 is different from that of existing production (and retrofitted) airplanes. It allows new kinds of passenger connectivity to previously isolated data networks connected to systems that perform functions required for the safe operation of the airplane. Because of this new passenger connectivity, the proposed data network design and integration may result in security vulnerabilities from intentional or unintentional corruption of data and systems critical to the safety and maintenance of the airplane.

In plain English, the FAA document says that connection points exist between on-board flight systems and the passenger Internet and entertainment networks. Unauthorized intrusion is a possibility anytime physical connections between networks are present, raising the chance that passengers could access the flight systems side of the network. According to Wired, Boeing promises to fix the problem before putting the plane into commercial service.

I’m at a loss to figure out why they designed the network this way. Thinking caps, Boeing, you need to put on your thinking caps next time.

Boeing also appeared in this blog back in September, in connection with the Virtual Fence it is building for the Department of Homeland Security (DHS).

Update: If you think it would be absolutely impossible for users to gain access to a poorly-designed flight system, be aware a 14-year old hacked into the transport network in Lodz.