Pen Test Partners: Boeing 747s receive critical software updates over 3.5" floppy disks
- Reference: 1597068086
- News link: https://www.theregister.co.uk/2020/08/10/boeing_747_floppy_drive_updates_walkthrough/
- Source link:
The eye-catching factoid emerged during a DEF CON video interview of PTP's Alex Lomas, where the man himself gave a walkthrough of a 747-400, its avionics bay and the flight deck.
Although airliners are not normally available to curious infosec researchers, a certain UK-based Big Airline's [1]decision to scrap its B744 fleet gave Pen Test Partners a unique opportunity to get aboard one and have a poke about before the scrap merchants set about their grim task.
"Aircraft themselves are really expensive beasts, you know," said Lomas as he filmed inside the big Boeing. "Even if you had all the will in the world, airlines and manufacturers won't just let you pentest an aircraft because [they] don't know what state you're going to leave it in."
While giving a tour of the aircraft on video (full embed below), Lomas pointed out the navigation database loader. To readers of a certain vintage it'll look very familiar indeed.
[2]
Navigation data aboard Boeing 747-436 airliners is updated via a 3.5" floppy drive. The aircraft were built in the late 1990s
"This database has to be updated every 28 days, so you can see how much of a chore this has to be for an engineer to visit," Lomas said, pointing out the floppy drive – which in normal operations is tucked away behind a locked panel.
[3]Youtube Video
A quick tour of the avionics bay, buried beneath the floor of the lower passenger deck, revealed a server-room-esque array of line replaceable units and cabling, prompting Lomas to bust lots of Hollywood-grade dreams by saying: "You can't just clip into a pair of wires into the back of the aircraft and gain access to all of these."
In a subsequent Q&A for DEF CON's virtual attendees (this year's hacking conference was done remotely thanks to COVID-19), Pen Test Partners chief Ken Munro asked Lomas about points of interest to aviation infosec researchers. The latter then described various aviation-specific ARINC equipment and connectivity standards, including ARINC 664 ("...Ethernet with some extra quality-of-service layers on top to make sure flight-critical things can talk to each other") [4]as used in the Boeing 787 and the latest generation of airliners, ARINC 629 ("really only used in the [Boeing] 777"), and other potential areas of research interest including VxWorks' real-time OS, which is used in a number of airliners' internal networks.
From 'Queen of the Skies' to Queen of the Scrapheap: British Airways chops 747 fleet as folk stay at home [5]READ MORE
The key question everyone wants to know the answer to, though, is whether you can hack an airliner from the cheap seats, using the in-flight entertainment (IFE) as an attack vector. Lomas observed: "Where we've gone deliberately looking, we've not found, at this point, any two-way communication between passenger domain systems like the IFE and the control domain. There is the DMZ of the information services domain that sits between the two; to jump between two layers of segregation would be tricky in my view."
That hasn't stopped some people from trying, most notably an infosec researcher from a Scottish university who [6]deployed a well-known pentesting technique against IFE equipment at the start of a nine-hour transatlantic flight. Mercifully he only managed to KO his own screen.
There is a long and storied history of otherwise obsolete technologies being retained in use because they're built into something bigger and yet work well, not least aboard Royal Navy survey ship HMS Enterprise . Last seen in these hallowed pages a couple of years ago when the Navy invited your correspondent aboard the warship during a NATO exercise in Norway, Enterprise 's [7]hotchpotch of Windows ME-based survey software is now helping port authorities in Beirut assess the damage caused by the disastrous ammonium nitrate explosion [8]earlier this month . ®
Bootnote
Of potential interest to researchers who don't have access to a spare 747 for a spot of pentesting is the new Microsoft Flight Simulator. Due for release in just over a week, the latest version of the classic sim franchise will include and support the use of ARINC 429-compatible navigation datasets, of the exact same type loaded into the 747 on a 3.5" floppy.
While the fidelity of the simulator software reading and executing that data may not be comparable with the real thing, inexpensive access to a real dataset can offer insights into further research areas – though the tale of [9]the Boeing 787 and Warsaw's BIMPA 4U arrival is unlikely to be repeatable.
Get our [10]Tech Resources
[1] https://www.theregister.com/2020/07/17/british_airways_747_axed/
[2] https://regmedia.co.uk/2020/08/10/b744navdatafloppydrive.jpg
[3] https://www.youtube.com/watch?v=yq8wgJO-JXY
[4] https://www.theregister.com/2020/04/02/boeing_787_power_cycle_51_days_stale_data/
[5] https://www.theregister.com/2020/07/17/british_airways_747_axed/
[6] https://www.theregister.com/2019/03/08/thales_topseries_vuln/
[7] https://www.theregister.com/2018/11/09/royal_navy_old_os_at_sea/
[8] https://www.bbc.co.uk/news/world-middle-east-53720383
[9] https://www.theregister.com/2020/04/02/boeing_787_power_cycle_51_days_stale_data/
[10] https://whitepapers.theregister.com/
Re: Honestly..
It looks modern to me, I still have a pile of 9-track tapes and a few cartridges in a box.
Re: Honestly..
Unfortunately any non flat floppy disk, more so those made from the middle of the 90s and up fail terribly.
I say that from personal experience. Heck not even using RAR compressed files with recovery file included to store files could save stuff from the crappy things sometimes.
Flat floppy disks may not be eternal but the ones I had lasted about two decades working just fine.
Re: Honestly..
I've got some for the BBC B that are still going.
Re: Honestly..
"Flat floppy disks may not be eternal ..."
When they do fail where would someone like BA get new ones?
As far as I know they haven't been made for years.
Re: Honestly..
Far longer than you can expect any USB-stick to… though I don't think that's necessarily the main factor here: it's the consistency of the interface rather than the durability of the media that matter.
Of course, they could always follow the lead of the automobile industry and allow the control systems to be hacked from the entertainment system. I mean, what could possibly go wrong?
Re: Honestly..
Perhaps they should install a replacement Gotek drive as you could with any other retro computer.
I'm not sure if I'm joking or this would be a viable solution on a 747.
Re: Honestly..
It is viable, although they tend to go with a full fat HxC instead. Far easier to create a number of floppy images on a USB stick and then flick through them than keep swapping floppies that may or may not still work.
Re: Honestly..
This explains so much! I thought I was going nuts when I heard the unmistakable screech of a 56K baud modem connecting during my last flight!
Re: Honestly..
It could have been worse, some systems from about that time used punched tape or stacks of punched cards. Woe betide anyone who dropped the tape or cards scrambling their order, tore the tape or got either one wet. Even worse, loaded it the wrong way and chewed it up completely. Yes, it was across the water from where I lived, but I knew they did several of the punched tape sins while a system was down and out for a long outage,
Re: Honestly..
I'd imagine there have been quite a few package upgrades since then.
Hopefully I'll be dead before "automated updates over 5G" come to aircraft.
Cloud
You would assume that connectivity of planes to the cloud should be a simple thing to do - at least for part of their working day
I guess that could be termed a fly-by download rather than a drive-by download.
Re: Cloud
Be glad it's not Apple compatible. I don't think I'd enjoy an Airdrop on a plane.
Re: Cloud
Simple, all you need to do is ensure that everything in the system from the ethernet cable to the link to the cloud and all the systems at the cloud data center are FDA approved and then get all the other aviation agencies around the world to agree (including the French) and you're done
Re: Cloud
I'm pretty sure you meant the F ederal A viation A dministration, not the F ood and D rug A dministration.
Cheers!
Re: Cloud
I make occasional typos - that's why I'm not president !
Re: Cloud
I was referring to the one made out of water vapour that results in a bit of turbulence when you fly through them.
I'd guess you just need a wireless connection to the cloud.
On reflection, perhaps I should have added the joke icon to the previous posting.
"It's such a chore doing these data updates in person". Sure. On the other hand, probably more secure than having all planes connected to a mothership, where someone opens up that what looks like the latest ad for the favorite shop, opens that pdf with the latest ads, and...
also.
*please don't provide any steering input while the firmware is being updated*
"Jack! Why did you decide to update the firmware while flying?!" "Well, i do that on my laptop as well. as soon as an update comes by, i just install it! Really just muscle memory, innit?"
That particular system might not be connected to the mothership (3.5" floppy disks came out in 1982), but modern jet engines do send realtime analytics back to the mothership and the manufacturer advises the airline if they believe any work should be done on any particular part.
King's Quest
Reminds me of the install process of King's Quest VI: "Insert disk 2 out of 12."
Now you just casually download a 30-50 GB thing in the background. You lose the building tension of maybe not finding a disk! Actually that wasn't a thing. At the speed it went, you had a lot of time on hand to nicely order your stack of disks.
I imagine planes need to be as deterministic as possible. As soon as you connect to that cesspit known as "the cloud", all bets are off.
I am surprised a 3.5" floppy was used and not something earlier. Didn't they come out later than the initial 747s? This suggests their update machinery went through a number of revisions in a relatively short time.
The initial 747s probably didn't have much of a flight management system. What they had was a flight engineer with a proper aviation grade mustache
The 3.5ʺ floppy-based ARINC 615 device is the modern (1989 “high speed”) successor to the 1981 ARINC 603 data loader, which used quarter-inch tape cartridges…
... revealed a server-room-esque array of line replaceable units and cabling,
So, Hollywood. What was that film with Kurt Russell where they killed off Steven Seagal's character in minutes? Just like in that then.
Bet it doesn't have an access hatch in the floor though. You know the one to attach a Stealth Fighter that magically lacks engine, fuel, etc and thus has room for an assault team and an access tube, restoring normal Hollywood credibility levels.
Best Steven Seagal film I've ever seen! Unfortunately I can't remember the name either.
Executive Decision
This one?
https://en.wikipedia.org/wiki/Executive_Decision
Access Hatch
AFAIK there is one from the cockpit into the avionics bay below. It's there in case a pilot has to do the ultimate off-on-hit-it-with-a-hammer in flight fix.
How is "visiting a plane every 28 days" a chore?
I sure hope maintenance people visit the cockpit more often than that! It doesn't exactly take the highest qualified guy on staff to insert a floppy.
Re: How is "visiting a plane every 28 days" a chore?
Have you not read 'On Call' ?
PC LOAD
FLOPPY ?
(gets coat)
All well and good
I wonder if they are still using them on starliner or have gone back to the real floppy ones to save weight ?
Mercifully he only managed to KO his own screen
Well, if he really wanted to screw with the aircraft he should have just flipped the Gary Larson "wings" switch! [1]https://i.pinimg.com/originals/af/08/4b/af084b2f06ab7977d9241bfbcbd08998.jpg
[1] https://i.pinimg.com/originals/af/08/4b/af084b2f06ab7977d9241bfbcbd08998.jpg
Honestly..
Honestly, in this day and age, I'd *rather* information updates to the avionics systems came on something like floppy disk rather than tethering to the Internet.
Sure, they could upgrade to Flash disk or something. But then again, the 747 was first produced in _1968_
I'd imagine there have been quite a few package upgrades since then.