4

According to National Public Radio, Ruben Santamarta has reported that gear aboard airliners and accessible through on-board WiFi or in-flight entertainment equipment uses hard-coded login credentials. http://www.npr.org/blogs/alltechconsidered/2014/08/04/337794061/hacker-says-he-can-break-into-airplane-systems-using-in-flight-wi-fi?ft=1&f=1001

I understand why hard-coded credentials are bad, but I also understand the airlines' problem: they have to service hundreds of airliners at dozens of locations. At a minimum, it seems like there should be a default password, changeable by the airlines, so that, e.g. Delta could have one system-wide credential and United another. That would also allow credentials to be changed after the inevitable leaks.

My question: Is there a better approach?

  • This is my first question here. I did read every one of the suggested duplicates. If I've messed up, please be gentle! I do learn. – Bob Brown Aug 4 '14 at 20:03
  • One alternative is the combination of hardware tokens and passwords. – user49075 Aug 4 '14 at 21:28
1

We have to wait for the conference to start for more information. But my first thoughts:

  • the wifi and entertainment systems should be separated from the control systems. It should not be possible to just find a password and then control the plane (or parts of it) from you personal computer. At least make an attacker get out of their seat.
  • passwords should not be hardcoded. ever. this makes them hard to change, it causes problems when source code leaks, it exposes more people than necessary to passwords (eg code reviewers), passwords are (probably) plaintext, etc. It's just an all-around bad idea.
  • technicians should each have their own password (yes, this has to be maintained. But I would assume that there is a lot of stuff on planes that already needs maintenance, this is just one more thing to do). This way, access can be revoked on a per person basis (technician Bob might be an attacker. what then? or he might have a drinking problem and talk too much, or he might be fired one day, or he might be friends with sketchy people).
  • passwords should be changed often in irregular intervals
  • I would seriously consider one password for each technician for each plane, maybe changed daily.
  • security training of technicians. I don't know if this is happening, but it should. For example, they should be told to not ever give out their password.
  • as @Ricky Demer said, access to such critical systems should be restricted by passwords and some hardware solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.