Follow Slashdot stories on Twitter
Pen Test Partners: Boeing 747s Receive Critical Software Updates Over 3.5″ Floppy Disks (theregister.com) 62
“Aircraft themselves are really expensive beasts, you know,” said Lomas as he filmed inside the big Boeing. “Even if you had all the will in the world, airlines and manufacturers won’t just let you pentest an aircraft because [they] don’t know what state you’re going to leave it in.” While giving a tour of the aircraft on video, Lomas pointed out the navigation database loader.
- by cunniff ( 264218 ) on Monday August 10, 2020 @11:28AM (#60385651) Homepage
A lot more secure than a network connection or a USB key. The only issue is finding new stock of floppy disks.
- by DogDude ( 805747 ) on Monday August 10, 2020 @11:32AM (#60385663)Exactly what I was going to say. I’d much prefer flying on an aircraft that was NOT updated via the Internet. Heck, I won’t even drive a car that can be messed with over the Internet.
local USB key is the same as floppy
- by nagora ( 177841 )
local USB key is the same as floppy
Well these days if you leave a floppy on a train the chance that the person that finds it can read it is a lot lower.
local USB key is the same as floppy
Well these days if you leave a floppy on a train the chance that the person that finds it can read it is a lot lower.
Perhaps, but that’s not a huge hurdle; a $25 USB drive from Amazon can fix that if they really are truly interested in the disk contents…
- by nagora ( 177841 )
local USB key is the same as floppy
Well these days if you leave a floppy on a train the chance that the person that finds it can read it is a lot lower.
Perhaps, but that’s not a huge hurdle; a $25 USB drive from Amazon
For most computer users that’s not a huge hurdle, it’s an impassible barrier.
> the person that finds it can read it
I was never very good at reading floppy disks. I always had to get a computer to do it for me.
Re:local USB key is the same as floppy (Score:5, Informative)
local USB key is the same as floppy
That’s if you assume what is being plugged into the USB port is actually a storage device, and not something that just pretends to be a storage device. It would be pretty hard for a 3.5″ floppy to change its own contents on the fly, for example.
Reminds me of a pretty interesting version of the classic ‘abandoned USB stick’ scheme: The USB stick told Windows it wasn’t a storage device but a basic keyboard, honest! And when Windows said okay, you have a new keyboard now, the program on the stick started ‘typing’ commands really really fast.
Re:local USB key is the same as floppy (Score:5, Informative)
by squiggleslash ( 241428 ) on Monday August 10, 2020 @11:42AM (#60385691) Homepage JournalAlas not. A floppy disk cannot pretend to be a keyboard, or a mouse, or an Ethernet connection. It’s relatively easy to make a USB stick that waits until it detects a particular directory being accessed (suggesting the computer is unlocked and keyboard input will work, because the likely reason it’s being accessed is the user is looking at the drive’s contents), which then immediately sends keyboard commands that will do something damaging.
Quite a few COTS avionics systems (e.e. Garmin) get their map updates via SD card. Of course it could be loaded with malicious *data*, but so could a floppy – can an SD card also actually *execute* a package like a USB device?
How can a USB key do this when the operating system is not linux, or Windows, or OSX, or other consumer oriented operating system? Especially on a system that does not even have a keyboard driver, and a port that only has a single mass storage driver loaded for it? Remember, if Windows is a component in your embedded critical system, then unrecoverable damage has already been done. The problem with too many of these systems is that they go cheap and decide to use cheap operating systems so that they can u
Support for the different types of USB devices in a generic sense is handled in part by the USB specification. Mass storage, Human Interface, Hubs etc are all separately defined in their behavior. So a USB compliant keyboard is in large part compatible with any OS that supports USB.
Except in many embedded systems. If the system is not designed to use a keyboard, then the USB HID drivers may not exist. Other times if they exist they aren’t necessarily going to get connected to lower level systems; ie, I worked on a system that had a keyboard with lots of custom controls (a medical) device, but you never got a console that way, could never type in commands, and every keystroke went to the highest level application. Even if you have Linux, you are not required to have your keyboard co
How can a USB key do this when the operating system is not linux, or Windows, or OSX, or other consumer oriented operating system?
I was speaking generically, but for this specific application, and bringing things to the 21st Century: How do you know it’s not Linux or Windows? I’d be surprised if there aren’t critical hardware out there at the moment running that. Tesla, for example, uses Linux [electrek.co] (worse, they actually use a customized Ubuntu apparently.) And there’s a sizable amount of medical equipment out
And to be honest, it’s kind of scary. It’s good that you can use Linux and then that solves a whole lot of issues, such as not worrying about the weird and badly supported third party network stack or USB framework. But it also adds a host of other issues, as it’s usually too large to support in house and many companies just go with a third party to provide a linux platform and build services and support. Technically, a Linux platform could be very small and done in house, but in practice they usually en
Unless someone disguises a USB killer [hackaday.com] as an official looking key.
A USB key works similarly to a floppy drive. The problem is it’s not a USB key port, it’s a USB port, which means you can plug all kinds of stuff into it. Also, you can spoof devices by hacking the microcontroller in a USB key.
There are some remediations you can take (custom USB stack that only allows devices to use the storage protocols) but giving users access to a general purpose interface bus is going to be a lot less secure than only allowing them to stick a floppy in a drive.
- There is probably multiple lifetime supply of AOL disks that can be recycled for this purpose. Much better for the environment than making new USB sticks and much more secure than the unknown malware that can be hidden inside a USB stick controller.
but what about the system / code the splits the data on to X number of disks? or maybe add track errors that load code? Like the copy protection systems?
In my experience, consumer grade floppies last only about a decade to decade and a half at most unless to store them really well. Median is closer to 5-7 years.
Then they’re basically dead.
- by Hodr ( 219920 )
I have Commodore 64 5.25″ floppies that still work (played Cave-man Ugh-lympics a couple weeks ago). Also plenty of Amiga 500 3.5″ disks as well. Stored in the basement and checked every 2-3 years as the urge hits.
Are those the low capacity ones? I recall those were way more stable than later high capacity floppies.
Not really a problem since military still uses 3.5″ too, you can order by the pallet. They only got rid of 8″ for nuclear missile launch systems in 2019.
- As long as the updates are not iOS like (2 GB)…
And nothing is really wrong with floppy disks here. If the data has good checksums, the software system has good security hashes, then the possibility of corrupted data is negligable. If the floppy doesn’t work, you get another one and ground the plane until it arrives.
USB keys are only unsecure if you’re doing something like allowing off-the-shelf moronic software like Windows on the navigation systems. Any system stupid enough to execute random files from a USB key found in a parking lot should be bann
Any security flaw in a network or USB storage would also be present in a floppy disk.
False. USB devices contain a microcontroller, floppy disks do not. This allows for a variety of potential issues and while they can be secured against, it’s another layer of complexity. Network is an even larger attack surface.
- to be fair I haven’t used a well made floppy drive in ages (the cheapo $15 dollar OEM ones I used to buy just before they stopped being needed to boot & install an OS were crazy bad, but my god it was insane buying a disk drive for that money when my 1541 cost $150 in 1989). But USB is pretty reliable and there’s plenty of checks you can do on top of it.
- The 1989s called and want their sneaker net back.
- "Pre-digital tape? Old-school.
Practically pre-school and thus unhackable."
-- Altered Carbon
- by tokul ( 682258 )
> The only issue is finding new stock of floppy disks.
You also have to find aircraft that accepts 3.5 disks and does not require 5.25s or tapes. 747 is from times when 3.5 disks did not exist.
- by RobinH ( 124750 )Yes, this is the same story we get every few years when the new crop graduates with the “if it’s old it’s terrible” mantra. Airplanes last a long time, much longer than your car. That tech was state-of-the-art when the plane was built. Once newer tech (like thumb drives) becomes available and widely used, there’s going to be a conversation like, “Hey boss, we should upgrade all the NAV system updaters so they can support USB thumb drives.” “That’s going to cost a ton of money, both for us and our custom
Getting avionics type-approved through every required governmental regulation agency (US, Europe, Japan, Russia, China, etc…) costs a TON of money. Once something is proven to work, you use it until there is a *very* good reason to stop. Usually this means the cost of maintenance for obsolete parts is greater than the cost of getting new hardware type approved.
In-flight movies were distributed on DVHS tapes until roughly 2017, when they were replaced with solid state drives. This, even though as a consumer format, DVHS had been dead for over 10 years.
how much pull does Hollywood have over DRM on that?
Say people start copying movies will they take the long governmental regulation wait for an fix?- https://tech.slashdot.org/stor… [slashdot.org]
I see this as a good thing as long as it can be kept running. The system is so old and foreign to modern computing that no asshole a world away will be able to hack it. Access requires physically being there, getting past men with rifles. And even if you do manage that you still have a very unique and specialized system that will be hard to break in to merely due to the fact few are around who understand it. How easy is it to write malware for something that only takes 8inch floppies and uses an OS nobody h
Even without the regulations and such, just the practicality of replacing technology is extremely complex. The 2o or 30 somethings may just decide to toss out their television and buy a new one to have it delivered overnight to their front step, and then they think this is oh so easy. But if you’ve got a tube TV built into a wall console furniture, then you’ve got to call out some carpenters to help out, someone to get up on the roof and remove the old antenna, and hire someone to help carry that heavy tu
- by jellomizer ( 103300 ) on Monday August 10, 2020 @11:35AM (#60385673)
A lot of technology doesn’t follow Moore’s law, applying new technology to an existing design, will require a fair amount or regression testing. So a Aircraft to replace a Floppy with say a SD card hooked up to an ISA Cable, May seem like a simple fix. It will change the thermals, power usage, Speed and timing of data collection, vibration and torque. Granted I expect No major consequences for doing this, but it will need to be tested for such a change. Also you will need the fleet to be upgraded, so you will have people opening up the electronics and do the upgrade.
Or just save the data onto a floppy and continue on.
usb stick to floppy emulator??
So what if 3.5″ Floppies are used for Nav updates? (Score:4, Informative)
by mykepredko ( 40154 ) on Monday August 10, 2020 @11:39AM (#60385687) HomepageI guess the article leads off with that point because saying that:
“You can’t just clip into a pair of wires into the back of the aircraft and gain access to all of these [systems].”
Just isn’t a sexy headline.
I would think that 3.5″ floppies are really in the realm of a proprietary data loading system as the public really doesn’t have access to them. I believe that pre-Block 50 F-16s are still using tape cartridges for mission data that are basically commercial 3/4″ tape cartridges that used to be used in broadcast TV.
It was nice to see that the basic message was that airliners are safe from hackers.
The 747-400 was certified in 1989, before USB was a “thing” and things these pen testers take for granted had appeared.
What is certified almost always stays as certified, unless there is a major overhaul to upgrade the tech and re-certify.
Part of the reason these 747s are being scrapped is because they are “old tech”.
This.
The cost-benefit analysis of re-certifying a 747 to use any new device for updates is going to fail.
Heck, I bet just writing the cost-benefit analysis is more expensive than any possible saving for swapping out the floppies.The saving is wastinlg much less time of lhe line maintenance guy who has to perform the updates.
Airbus did that,
I don’t see how this is an issue. If the systems are in place and working, then there’s no reason to replace it for novelties sake. Computers from the era of the floppy disk are perfectly capable of performing the tasks they were designed for.
I don’t see how this is an issue. If the systems are in place and working, then there’s no reason to replace it for novelties sake. Computers from the era of the floppy disk are perfectly capable of performing the tasks they were designed for.
Yep. If you try to move fast and break things around aircraft you’ll end up breaking both aircraft and people. Change for the sake of change is a bad idea in aviation.
and when the maps are to big for the systems?
We can’t fly to ORD as the new runway layout does not work on our 1989 system?
mh370 and it’s bay? is that where the fire started
The average time from creation to market with avionics software and hardware is well over 5 years because ( TEST TEST TEST TEST TEST TEST TEST)
SO, it may not be perfect but every fault is well known by the time it is deployed and every danger vetted. The systems are not changed and updated without really good reasonWhy does it require physical access to know that the beast uses a 3.5″ drive? They could’ve just asked a pilot or maintenance person. I’m sure there are trainings and documentation too which are probably not terribly hard for infosec folks to find and download, even if not public. Or are infosec people so isolated in society that such info doesn’t propagate?
Retaining the floppy instead of replacing the drive with a USB flash drive adapter (as done on everything from sewing machines to CNC machine tools) was convenient and most importantly didn’t require a software and hardware change and certification. Since Slashdot used to be a techie site, here’s an example adapter. I used these on two Bridgeport EZ Trak CNC knee mills. Software included with many adapters partitions USB flash drives into many virtual floppy images. Example Gotek:
https://www.amazon.com/Got [amazon.com]
Answer to “why” is “everything on an airplane is certified, and changing anything is a horribly expensive process.”
There is no shame in using robust technology that meets all requirements of the specification.
Advantages:Floppy technology/versions is now static. No need to worry about the “new version” breaking the system.
Software can assume the storage capacity of the device, because it is fixed.
System is fully tested with this technology over the past 20 years, all behaviours and failure points are known by nowThere is no point in changing unless the requirements change. For example if the data size cannot fit on the
- Why anyone would update anything on a scrapped plane is beyond me, but if someone would want to update a scrapped plane, then using a scrapped AOL floppy disk is probably OK.
Scrapped aircraft are usually parted out,
Although newer ones have PCMCIA slots
Many of them still use CRT displays. Avionics are expensive and most time they are replaced by refurbished parts in case of a defect.
There may be more comments in this discussion. Without JavaScript enabled, you might want to turn on Classic Discussion System in your preferences instead.
Related Links Top of the: day, week, month.
- 800 commentsStack Exchange Removes Moderator For Preferred Pronouns Policy
- 725 commentsRichard Stallman Resigns From MIT
- 626 commentsTrolls Are Swarming Young Climate Activists Online
- 603 commentsTwitter Flags Trump and White House Tweets About Minneapolis Protests for ‘Glorifying Violence’
- 567 commentsKamala Harris Asks Twitter To Suspend Donald Trump For ‘Civil War’ and Whistleblower Tweets
Slashdot Top Deals
- Get more comments
- 62 of 62 loaded
It has just been discovered that research causes cancer in rats.
