FAA: Boeing's New 787 May Be Vulnerable to Hacker Attack

Boeing's new 787 Dreamliner passenger jet may have a serious security vulnerability in its onboard computer networks that could allow passengers to access the plane's control systems, according to the U.S. Federal Aviation Administration.

The computer network in the Dreamliner's passenger compartment, designed to give passengers in-flight internet access, is connected to the plane's control, navigation and communication systems, an FAA report reveals.

The revelation is causing concern in security circles because the physical connection of the networks makes the plane's control systems vulnerable to hackers. A more secure design would physically separate the two computer networks. Boeing said it's aware of the issue and has designed a solution it will test shortly.

"This is serious," said Mark Loveless, a network security analyst with Autonomic Networks, a company in stealth mode, who presented a conference talk last year on Hacking the Friendly Skies (PowerPoint). "This isn’t a desktop computer. It's controlling the systems that are keeping people from plunging to their deaths. So I hope they are really thinking about how to get this right."

Currently in the final stages of production, the 787 Dreamliner is Boeing's new mid-sized jet, which will seat between 210 and 330 passengers, depending on configuration.

Boeing says it has taken more than 800 advance orders for the new plane, which is due to enter service in November 2008. But the FAA is requiring Boeing to demonstrate that it has addressed the computer-network issue before the planes begin service.

According to the FAA document published in the Federal Register (mirrored at Cryptome.org), the vulnerability exists because the plane's computer systems connect the passenger network with the flight-safety, control and navigation network. It also connects to the airline's business and administrative-support network, which communicates maintenance issues to ground crews.

The design "allows new kinds of passenger connectivity to previously isolated data networks connected to systems that perform functions required for the safe operation of the airplane," says the FAA document. "Because of this new passenger connectivity, the proposed data-network design and integration may result in security vulnerabilities from intentional or unintentional corruption of data and systems critical to the safety and maintenance of the airplane."

The information is published in a "special conditions" document that the FAA produces when it encounters new aircraft designs and technologies that aren't addressed by existing regulations and standards.

An FAA spokesman said he would not be able to comment on the issue until next week.

Boeing spokeswoman Lori Gunter said the wording of the FAA document is misleading, and that the plane's networks don't completely connect.

Gunter wouldn't go into detail about how Boeing is tackling the issue but says it is employing a combination of solutions that involves some physical separation of the networks, known as "air gaps," and software firewalls. Gunter also mentioned other technical solutions, which she said are proprietary and didn't want to discuss in public.

"There are places where the networks are not touching, and there are places where they are," she said.

Gunter added that although data can pass between the networks, "there are protections in place" to ensure that the passenger internet service doesn't access the maintenance data or the navigation system "under any circumstance."

She said the safeguards protect the critical networks from unauthorized access, but the company still needs to conduct lab and in-flight testing to ensure that they work. This will occur in March when the first Dreamliner is ready for a test flight.

Gunter said Boeing has been working on the issue with the FAA for a number of years already and was aware that the agency was planning to publish a "special conditions" document regarding the Dreamliner.

Gunter said the FAA and Boeing have already agreed on the tests that the plane manufacturer will have to do to demonstrate that it has addressed the FAA's security concerns.

"It will all be done before the first airplane is delivered," she said.

Loveless said he's glad the FAA and Boeing are addressing the issue, but without knowing specifically what Boeing is doing, it is impossible to say whether the proposed solution will work as intended. Loveless said software firewalls offer some protection, but are not bulletproof, and he noted that the FAA has previously overlooked serious onboard-security issues.

"The fact that they are not sharing information about it is a concern," he said. "I'd be happier if a credible auditing firm took a look at it."

Special conditions are not unusual. The FAA publishes them whenever it encounters unusual issues regarding a plane's design or performance in order to communicate on record that it expects the manufacturer to address the issue. It's then up to the manufacturer to demonstrate to the FAA that it has solved the problem. Gunter said the FAA has issued eight special conditions on the Boeing 787, but that not all of them pertain to the plane's computer systems.

787 woes prompt United Airlines to drop planned new route

New Boeing 787 pıctures


s another delay to Boeing's 787 Dreamliner looms, United Airlines has postponed the start of service from Houston to Auckland, New Zealand, the first North American flight slated to feature the groundbreaking jet.

The new United had planned to begin those flights on Nov. 16, initially under the brand of merger partner Continental Airlines, said Julie King, spokeswoman for the Chicago-based carrier. But with uncertainty shrouding the 787's commercial debut, the world's largest airline decided to push back its New Zealand expansion to 2012.

Boeing's 787 figures large in overseas initiatives at United, which is headed by former Continental Chief Executive Jeff Smisek and which plans to absorb Continental as it integrates operations at the two carriers over the next two years.

If it lives up to expectations, the Dreamliner would burn 20 percent less fuel than other midsize jets but boast the range of far-larger aircraft: 7,650 to 8,200 nautical miles. That would enable carriers to bypass hubs and directly connect city pairs, like Auckland and Houston, that wouldn't generate enough passenger traffic to fill jumbo jets.

But the continued production woes to the highly touted jet are forcing some carriers to scramble. Continental, which merged with United on Oct. 1, was slated to take delivery of six 787s next year, and the two carriers have 50 of the aircraft on order combined.

Boeing 787 Dreamliner pictures

Aircraft manufacturer Boeing yesterday launched its new commercial jet, the 787 Dreamliner.

Here are interior and exterior photos of the plane, which is the “world’s first mostly composite” passenger jet and which promises to be quieter and more fuel efficient than other jets. All images and caption texts are courtesy of Boeing.

Here are interior and exterior photos of the plane, which is the “world’s first mostly composite” passenger jet and which promises to be quieter and more fuel efficient than other jets. All images and caption texts are courtesy of Boeing.

Above: “The Boeing 787 Dreamliner will have wider seats and aisles, a spacious architecture, innovative LED lighting, big bins, more space and the largest windows available.”

Above: “At 19-inches tall and 10.3-inches wide, the windows on the Boeing 787 Dreamliner are dramatically larger than those on any other commercial aircraft flying today. Extending above seatback height, the windows offer a view of the horizon to passengers seated anywhere in the cabin. The electrochromatic windows require no shades and can be darkened at the touch of a button.”

Above: “The interior designers for the Boeing 787 Dreamliner understand fully that first impressions can be everlasting. Therefore, they’ve designed a larger, more open entryway with sweeping arches that immediately direct the eye upward.”

Above: “Illuminated by arrays of light emitting diodes, both the brightness and the color of the sky-like cabin ceiling can be controlled in flight by the crew. Flight attendants can give passengers a sense of daylight when desired, and when they want to help passengers rest, simulate a beautiful nighttime sky.”

Boeing 787 Dreamliner pictures

Boeing 787 Dreamliner pictures

EVERETT, Wash., July 08, 2007 — Today, Boeing [NYSE: BA] officially debuted the technologically advanced and environmentally progressive 787 Dreamliner in a celebration attended by employees, airline customers, supplier partners and government and community officials.

The 787 Dreamliner Premiere was broadcast live in nine different languages via satellite to more than 45 countries and webcast via www.boeing.com and www.newairplane.com. Distinguished journalist and best-selling author Tom Brokaw served as the master of ceremonies for the event.

Approximately 15,000 people attended the Premiere at the Everett, Wash., final assembly factory. More than 30,000 participated via two-way satellite into the event in Everett from Japan, Italy and locations in the United States. As many as 90 other locations around the globe involving 787 customers, partners and many Boeing employees also chose to download the event live or watch it pre-recorded and host their own viewing event.

In all, the 787 Premiere potentially reached 100 million or more viewers, making it one of the largest corporate TV and Internet broadcasts in history.

“This has been a wonderful and exciting day to celebrate this breakthrough airplane with our customers, employees, supplier partners and our communities,” said Scott Carson, Boeing Commercial Airplanes president and CEO. “We are gratified that the 787 has been so strongly validated in the marketplace by our customers. Their response is proof that the Dreamliner will bring real value to our airline customers, passengers and the global air transportation system.”

The Boeing 787 Dreamliner, the world’s first mostly composite commercial airplane, will use 20 percent less fuel per passenger than similarly sized airplanes, produce fewer carbon emissions, and will have quieter takeoffs and landings.

“Our journey began some six years ago when we knew we were on the cusp of delivering valuable technologies that would make an economic difference to our airline customers. In our business, that happens every 15 or so years, so we have to get it right,” said Mike Bair, Boeing Commercial Airplanes vice president/general manager of the 787 program. “I am so proud of the men and women of Boeing and of our partner employees in the 70 companies that have brought this airplane to the passengers of the world.”

Following the premiere, the first 787 Dreamliner will be completed in the Everett factory – including the installation of final systems elements, interiors and flight test equipment. First flight of the airplane is expected in late August or September. A total of six airplanes will be included in the flight test program, which will conclude in May 2008 with the certification of the airplane followed shortly by the first delivery of a 787 to ANA.