Intellectual Property Law

New Boeing 787 Dreamliner May Be Vulnerable to a Cyber-Hjacking

By IBLS Editor

Completing the greatest year in the history of aviation marketing with sales of over 800 units, upon the development of its new gas-efficient airplane the "Dreamliner," Boeing is currently riding high. Yet a new report by the U.S. Federal Aviation Administration (FAA) claims the plane may be at risk for hacking into its on-board computer system, with possible disastrous consequences. The flaw might allow passengers to access the plane's control systems, according to the report titled "Special Conditions: Boeing Model 787-8 Airplane; Systems and Data Networks Security--Isolation or Protection From Unauthorized Passenger Domain Systems Access."

The Dreamliner ended up being a marketer's fantasy, as the jet's design was just being finalized -- being a major breakthrough in efficiency since composite materials were used to cut down on fuel costs -- when oil spiked on world markets. Suddenly, the airplane went from being a Green model for lowering its "carbon footprint" to being considered a necessity by many carriers for lessening the skyrocketing financial impact of oil tripling in a year. Competitor Airbus had designed the world's largest aircraft during the same period, not worrying about efficiency, but was suddenly caught wrong-footed.

The problem stems from a computer network installed in the Dreamliner's passenger compartment, which was designed to allow passengers in-flight internet access. Surprisingly and unfortunately, this system is also connected to the plane's control, navigation and communication systems, according to the FAA report.

This news has caused palpable concern in air-security circles as this systemic connection of the passenger and plane networks could be breached to access the plane's control systems by hackers. Experts insist the only way to counter the threat would be to physically separate the joint network into two. Boeing claims it is aware of the problem and will take measures to address the security danger.

Mark Loveless, a network security analyst with Autonomic Networks, says: "This is serious. This isn't a desktop computer. It's controlling the systems that are keeping people from plunging to their deaths. So I hope they are really thinking about how to get this right." Loveless recently delivered an industry talk entitled, "Hacking the Friendly Skies."

The plane has yet to be released and experts are hoping all the security bugs are eliminated before it officially rolls of the assembly line. The jet will seat between 210 and 330 passengers, depending on configuration. The 787 is due to enter service in November 2008. But the FAA is requiring Boeing to prove it has addressed the computer-network issue before the planes are delivered.

The FAA is extremely concerned about the security flaw, and claims the 787's design "allows new kinds of passenger connectivity to previously isolated data networks connected to systems that perform functions required for the safe operation of the airplane. Because of this new passenger connectivity, the proposed data-network design and integration may result in security vulnerabilities from intentional or unintentional corruption of data and systems critical to the safety and maintenance of the airplane."

Boeing spokeswoman Lori Gunter claimed the FAA document is misleading and that the plane's computer systems don't actually connect well enough to cause concern despite the fact that data can pass between the two systems. She says Boeing will still address the issue. She says there are so-called "air gaps," and software firewalls that separate the systems, stating: "There are places where the networks are not touching, and there are places where they are."

Loveless claims to be happy the FAA and Boeing are dialoging upon the topic, but he says that without knowing how exactly Boeing proposes to address the dangers, a response cannot be given as to how safe the plane might be from in-air hackers. Loveless says that while some solutions exist in the marketplace they are not bulletproof, and that the FAA has a history of overlooking troubling onboard-security issues. He said, "The fact that they are not sharing information about it is a concern. I'd be happier if a credible auditing firm took a look at it."

Full post as published by IBLS Internet Law Blog on January 13, 2008 (boomark / email).