Is it true that in the latest generation of Boeing aircraft some software components / Electronic Flight Bag data can be pushed to the flight remotely via a Wireless link?

If so, what sort of safeguards are in place to preserve the integrity of such an update? How does the aircraft authenticate that the data sent is indeed legitimate?

I'm curious to know the details. e.g. Are these conventional Ethernet networks over which the update gets pushed at the airport end? Is the final wireless transmission done by a COTS WiFi router? Does the update travel via the internet from (say) Boeing till the airport?

  • 1
    $\begingroup$ "I'm curious to know the details": Not sure the designers want to satisfy your curiosity and help you start searching for the possible weaknesses. Even if hiding things is not a security, it sometime helps. $\endgroup$
    – mins
    Jan 20 '16 at 12:11
  • 1
    $\begingroup$ @mins Yes, I admit hiding things can sometimes help, but when it comes to something as critical as an aircraft the right way to do things IMO is to have better strategies than obscurity. You want to be more sure than PIAs & NDAs to protect your channels. I think security through obscurity is OK for things like toilet master lock opening buttons e.g. aviation.stackexchange.com/questions/24054/… but not for critical stuff like avionics software updates. $\endgroup$ Jan 20 '16 at 12:54
  • 1
    $\begingroup$ @mins One key issue is how the aircraft system verifies that the patch it is getting over the air is a valid, un-tampered one? Is there a hardware based key verification module in the aircraft? $\endgroup$ Jan 20 '16 at 14:05
  • 2
    $\begingroup$ @curious_cat Amount of simple operations that is safely out of reach for all humanity? on the Information Security SE might be of interest. $\endgroup$
    – user
    Jan 22 '16 at 15:07
  • 2
    $\begingroup$ @curious_cat wrote "If the hardware key was transferred from Boeing to the aircraft owner by hand ...." They don't even need to do that. Boeing built the plane. They can install the certificate in the computer while they're still building the plane! They know what certificate is installed, and can use a unique, known certificate for every plane in existence. $\endgroup$
    – abelenky
    Jul 5 '16 at 20:42

Boeing claims in this document:

The 787 uses wireless (802.11 b/g) technology while at the gate to transfer maintenance data and update the Electronic Flight Bag (EFB). This is referred to as “e- Enabling” and it will allow airlines flying the 787 to operate more efficiently.

So, yes, they use a regular WLAN connection for transmitting data while on the ground.

The document continues:

Upon weight on wheels the 787 attempts to authenticate specific ground access points. Information regarding the key configuration requirements and how the 787 authentication occurs requires the signing of a PIA.

I interpret PIA as Proprietary Information Agreement, a form of secrecy agreement. Boeing uses security through obscurity to safeguard the integrity of the connection.

If you want to know more, Boeing advises to contact 787terminalwireless@boeing.com. However, I doubt they will talk to you or me unless we are airport representatives with a credible need to know.

  • 1
    $\begingroup$ Ha! That's the worst kind of security & is exactly what I feared. I'm hoping that the grapevine will reveal more details. There must be a ton of people at airports exposed to this which unfortunately makes it neither secure nor obscure. $\endgroup$ Jan 20 '16 at 7:31
  • 2
    $\begingroup$ You only have to review the Stuxnet saga to see how security through obscurity works in practice for mission critical equipment. $\endgroup$ Jan 20 '16 at 7:33
  • 3
    $\begingroup$ @curious_cat I don't see what is wrong with adding security through obscurity to an otherwise secured system. $\endgroup$
    – DeltaLima
    Jan 20 '16 at 8:01
  • 2
    $\begingroup$ @DeltaLima, security through obscurity does not stop the serious attacks, but it stops the less serious ones and the white hats and security researchers, but you want those to test the system to warn you about vulnerabilities before the serious attackers abuse them. $\endgroup$
    – Jan Hudec
    Jan 20 '16 at 8:07
  • 6
    $\begingroup$ @curious_cat "exactly what I feared". What is your fear? You seem to assume that some obscurity is the only security, which it is not. It is simply yet another layer which, as others have pointed out, is just a case of "why make it easier". They are not using open internet and standard protocols here. It's not a system a script kiddie or anonymous no-friends cyber-psychopath can just break into. Also, they key, safety critical systems cannot be updated "over the air". They have replaceable cards and in some cases, plugin updates which require physical access. $\endgroup$
    – Simon
    Jan 20 '16 at 20:31

In theory, they are just transmitting data, not code updates to the aircraft. So, the worst-case scenario would be that somebody would replace a chart with fake chart or something like that, which would be a nuisance but should not affect the safety of the flight.

As a matter of routine, any radio link should be considered an inherently insecure mode of communication, because it is open, unlike wire connections which can be physically isolated and secured against intercept.

Of course, if there is a bug or weakness in their system somewhere, it might be possible for a hacker to "pierce the veil" and somehow modify a live system. Whether that is possible or not depends entirely on the system architecture and implementation details of the software in question. Without knowing this (highly proprietary) information it is impossible to know whether such a weakness exists.

The official guidance on practices is contained in various FAA circulars, notably FAA advisory circular (AC) 20-153.

Here is a paper describing the general security situation: FAA Aircraft Systems Security.

Only the 787 is able to load actual flight system modules remotely, I believe, although as mentioned above many aircraft can wirelessly retrieve flight bag info. How Boeing verifies that a module is valid before loading I do not know, but in all likelihood they use a cryptographic certificate. If this is the case, then a hacker would either have to steal the cryptographic keys from Boeing, or find a bug in how they were using the certificate, in able to introduce a false module to the aircraft.

  • $\begingroup$ Are you sure no code updates are pushed over wireless? From what I remember the Wireless link is also proposed to be used to push Loadable Software Airplane Parts. That sounds like code. $\endgroup$ Jan 21 '16 at 18:26
  • 3
    $\begingroup$ Wired connections are no more secure than wireless if you are determined. There exists equipment to intercept traffic on wired networks with no physical access from tens of metres away. Really secure installations use specially designed buildings to mitigate this. $\endgroup$
    – Simon
    Jan 22 '16 at 4:34
  • $\begingroup$ @abelenky You would use encryption to prevent industrial espionage, among other things. $\endgroup$ Jul 5 '16 at 20:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.