▲ 122 points
back
99 comments
one that's routinely within reach of maintenance workers or other airport and airline staff between flights
You already trust them (as well as the pilots) every time with your flight.
With the low pay and ever-worsening working conditions, I'd be more worried about oversights/negligence than intentional sabotage (which sometimes happens all the way at manufacturing stage - see the Boeing door incident).
Unfortunately, that is unlikely to get media coverage because the solution would be to respect and pay workers more, a severe crime in a late-stage capitalistic society.
> the solution would be to respect and pay workers more
Not to worry, they're furiously working on an alternative which will ensure no worker must ever be respected or paid ever again!
because the solution would be to respect and pay workers more,
They're already quite well-paid (and so are pilots). In fact the operating margins of airlines are infamously thin, so unless you want plane tickets to be several times their current price, it won't work.
https://www.theguardian.com/business/2025/mar/06/avalon-airp...
That trust was what led to this incident where someone just walked into the airplane dressed as a maintainence worker and nobody stopped him.
Also pilot suicide isn't something new and the aviation world has tried to come up with several regulations to ensure it doesn't happen even though we completely trust pilots on a normalative basis.
> That trust was what led to this incident where someone just walked into the airplane dressed as a maintainence worker and nobody stopped him.
O, it can be even worse, when you realize its a 30 year old problem ...
During the 1998 television show Schalkse Ruiters, presenters Bart De Pauw and Tom Lenaerts dressed in fake pilot uniforms. They bypassed security at Brussels Airport (Zaventem), entered a Boeing cockpit, and left undetected to expose safety flaws
The TV show got cancelled not long after this incident because of pollical backlash.
The show had a reputation of finding security flaws (like being able to transfer money from people bank accounts) and other issues, but the airport one was the end of the show.
People loved the show, as it forced companies, ... make changes to their processes that they normally never did. They even did follow-up episodes to see if the companies actually made changes.
Bit of public shaming to fix security issues... worked great. Until the show was cancelled. The number one rated show of the country ... Yea, there was absolute no correlation between its cancellation and the airport incident. Really ;)
> Also pilot suicide isn't something new and the aviation world has tried to come up with several regulations to ensure it doesn't happen
As AI171 has shown, turning the engines off on rotation does it reliably and there’s nothing that the other pilot or regulations can do to prevent it.
You conveniently left out the part where he walked through a hole in the airport fence.
Airfields are expected to be secure areas. If you can walk through a hole in a fence there's issues.
Remember a guy stole an entire airplane a few years ago (RIP Sky King). Airplanes don't have ignition keys.
Are these the same maintenance workers that have access to even more sensitive parts of the airplane like the avionics compartment and its miles of wiring?
Wait until they find out your mechanic has unfettered access to your car's OBD port when you hand them the keys. They could install a COIN SIZED device on the CAN bus and you'd never know.
Some people do this voluntarily in exchange for a discount on their insurance.
There's literally millions of people driving newfangled EVs where the car manufacturer has full remote access to their vehicle and can upload software however and whenever they like.
I forgot only the nefarious ones wear yellow reflective vests and earmuffs.
> Wait until they find out your mechanic has unfettered access to your car's OBD port when you hand them the keys
Surprise! “They” did find this out and UN155/156 regulate a bunch of protections against local “attackers,” often to the detriment of right to repair.
There's literally millions of people driving newfangled EVs where the car manufacturer has full remote access to their vehicle and can upload software however and whenever they like.
This part has been beyond baffling to me. The last thing I want, is to hit the brakes in my car, and suddenly they're less/more sensitive, due to an update the night before, and it really does matter especially on snow/ice. And such updates happen.
I also don't want a perfectly good, 100% working car to suddenly degrade in experience because "Wups! Sorry! Last update broke <whatever>, we'll update within the month to fix!". It's just pure, unbridled dumb.
I recently bought a car, and the dealer tried to sell me an extended warranty. What? It's under a full warranty right now, and yes, my region has very strong warranty and anti-lemon laws. But my point is, they kept saying "there's a lot of complex and expensive electronics in this car, you're going to need an extended warranty".
Um, what? Hello? You just explained that the car breaks down a lot because it's complex? So complex that there are more frequent, highly expensive issues?
How is that a plus?
If a car is "too complex" to roll out the assembly line, without needing updates to modules on a monthly basis for years, it's the opposite of positive. I've had multiple BCM(body control module) updates, updates to every single module in the car. There shouldn't be enough code to cause issues here, it should be simple, simple, simple.
But it's not.
It's complex and difficult to make bug free.
And that makes me oh so very comfortable as I drive down the road.
> less than a minute, that hardware implant can be fitted into a port accessible via a hatch on the exterior of the plane
Just as with computers, as the saying goes, if you have physical access to the device then all bets are off. The tricky part is getting that physical access in the first place...
Of course. Doesn’t mean we should leave the root password written down on a post-it next to the hardware. It sounds strange that such a privileged port has no authentication.
Getting security to work reliably in such scenarios can be hard. And your customer really don't want their up to hundred million in cost pieces of equipment sit there doing nothing because maintenance is unable to do something with it.
Much simpler just to instruct to physically secure the conduit around... Even better if that is already approved and demanded process.
It is not that simple, atleast in the automotive industry _today_. Atleast here in EU.
Every component is analyzed from a cyber security perspective. Many components needs tampering protection - while others need not. This includes replacing components with malicious ones.
It is not logical at all and a stupid regulation. But it is not as simple as you can do what you want if you have physical access.
I have little faith any of it would stop someone who was a) devoted, b) prepared, and c) had physical access for a reasonable time.
It’s still worth doing because the vast, vast majority of people will fail at a or b without even reaching c.
That’s sort of less so with planes, though. You don’t generally decide to take out a plane without being dedicated at the very least.
Well, the EU, being very much dictated by Germany, who have a large car industry, has a vested interest in making sure that if people want to have a better car they pay for a better one new rather than upgrade with an aftermarket chip.
> Just as with computers, as the saying goes, if you have physical access to the device then all bets are off
This is far less true than it used to be, though, and it seems reasonable to expect that aircraft become as secure as Macs.
A huge part of the security of Macs is that the security domain is a single chip. Hard to do with an airplane which is inherently a physically-distributed system.
But what if the device contained an explosive?
The connector shown in the article is apparently the 24-pin connector known as the Open Maintenance Connector (OMC). It's located in the electronics and equipment bay under the nose of the Boeing 737 NG and 737 Max.
I say "apparently" as I had Gemini identify the port from the image.
The OMC provides direct access to key avionics data networks, including the ARINC 429 buses that link the pilot's Flight Management Computer (FMC) to the Multi-Function Control and Display Unit (MCDU).
It’s not actually called the OMC. That was a generic name used in the paper in lieu of naming the precise connector.
I started my career proper as a junior network engineer for a regional British airline (British Midland, since subsumed by BA) in 2001, just before 9/11 continuing for 3 years until mid 2004. Throughout that time, I held an airside pass at LHR that allowed me to get pretty much anywhere I liked, apart from the taxiways and runways of course.
This was pretty standard for most staff - once you’re airside, there were not many restrictions about getting down under the ramp or anywhere around an aircraft on a stand.
Never was this illustrated better than the final homecoming of a BA Concorde in late 2003, when a whole load of staff from different roles across the airport all piled out onto the edge of the apron to wave it home.
A junior IT bod in a high-vis touching something on the outside of an aircraft ? Wouldn’t stand out to anyone watching a CCTV feed. Maybe the other ramp staff would notice, but if you timed it right…
What I’m trying to say is that physical access to aeroplanes even at a place like LHR was pretty much open to anyone who holds an airside pass.
You'd have to build many more barriers and gates to stop that, which would be awkward for baggage systems, fuelling, and general maintenance.
The question is more - how hard is it to get airside without a pass?
I once went in through the main arrivals exit doors at Heathrow. I'd forgotten something so I went in, got it, came out again.
It was a stupid thing to do, but I wasn't arrested, stopped, or anythinged.
This was before 9/11 so I doubt you could do it today. But even so.
Interesting take on things - of course “outside” airside was protected by locked doors, so passengers couldn’t just wander onto the apron… but all you’ve got to do to get outside these days is to book with the sort of airline that’s too cheap to pay for a proper stand and makes you walk to the plane (and accidentally walk the wrong way, etc)…
Another question on my mind is - how hard is it to land a job with an airside pass nowadays if your intention is to just get physical access to an aeroplane ? Pretty easy back then. Not sure about now…
Tangential story. I used to work for one of Australia's 'Big 4' banks. One night I was working in one of the 2 'tier 1' DCs. The place was chock-full of ancient kit. Old mainframes. Tape drives. Nothing in a locked cabinet: this was a room from the 1960s, still active in 2007. I remember it being very beige.
It occurred to me that the catastrophe I could have caused simply by ripping out as many cables as I could see would have been … if not a mini-recession, certainly the sort of thing that moved markets.
Yeah yeah, redundancy and backups. I knew the infrastructure. It wouldn't have worked, not for weeks anyway.
To be in said room, I had undergone a cursory police check.
It’s crazy how much trust there was prior 9/11. I’m wondering if it’s the same nowadays if you get to a certain position or if everything is perfectly compartmentalised
> In their paper, the researchers outline a range of fixes for the vulnerability they've uncovered, starting with removing the connector in the vulnerable port altogether, or plugging it with epoxy.
If you can safely disable the port completely, that implies the port is not needed to begin with. Is that really true? What's the purpose for it?
Probably diagnostics and debugging.
> the company may not in fact implement any such update to their systems for years to come, given how rarely commercial airplanes are redesigned.
Boeing commercial airplanes are constantly updated. As long as the airplane is in service, Boeing retains a team of engineers that update parts as needed. If FAA review is needed, this will of course take longer.
BTW, anyone with access to the internals of an airplane could potentially sabotage it. Sadly, all people with access need to undergo a security check.
Sadly?
Actual paper for those interested: https://cseweb.ucsd.edu/~savage/papers/UsenixSec26-429.pdf
Why coin sized, you can fit a gps tracker in a grain of rice-size pellet, why not a phone card.
Still too big, I’d like it to fit on the tip of a needle.
...so they built an equivalent of OBDII reader for planes, and it worked just the same as ones for cars? Interesting but not as scary as the title may suggest.
“researchers aren't revealing which port they targeted on the 737, nor are they releasing some details of how their hacking device is able to spoof commands to the plane's computers”
Bro. You put “429 interceptor” on the PCB. You’re just fucking on the ARINC 429 bus.
Also, this exists as a commercial product (in some ways): https://www.astronics.com/wireless-electronic-flight-bags-we...
There's already a dongle on the market hooked in some 737s that gives you WiFi access to the 429 and 717 busses through the same port...
EDIT (again): Oh come on, the paper says they went into the Open Maintenance Connector through the E&E bay through the nose gear. C'moooon.
Double-triple edit: Also - ARINC 429 is kinda fun. You can do things like take old glass cockpit hardware and work it into your flight simulator by just feeding the cockpit hardware simulated 429 messages over the wire from your flight sim.
Here's some 737 instruments being driven from FSX: https://www.youtube.com/watch?v=RtTJiU-vArs
For folks who might be interested to know more;
ARINC defines a series of standards for Avionics Systems and Communications - https://en.wikipedia.org/wiki/ARINC
ARINC 429 is the most widely used data bus standard for aviation. Electrical and data format characteristics are defined for a two-wire serial bus with one transmitter and up to 20 receivers. The bus is capable of operating at a speed of 100 kbit/s. - https://en.wikipedia.org/wiki/ARINC_429
PS: HN, I'm really fucking getting tired of being punted to the absolute bottom of every fucking post, even when I post actually decent fucking content for once. Parent comment at +5 points and it's parked all the way at the dead bottom next to the greys. I get locked out for over a month with a half-ass "sorry, your account was flagged as spammy" excuse from dang and then still get punted into the bottom as if I'm too spammy.
https://archive.md/3fpga
HN should have a rule like what does some reddit subs do.
Either outright ban paywalled articles, or if not then either an archived link should be posted alongside, or the whole text of the article should be copy pasted as a comment
Who do you expect to pay for journalism?
From the HN FAQs:
Are paywalls ok?
It's ok to post stories from sites with paywalls that have workarounds.
In comments, it's ok to ask how to read an article and to help other users do so. But please don't post complaints about paywalls. Those are off topic. More here.
I think a lot of these links are being shared via the browser extension, but yes I agree they should do something about this.
Reader mode gave me full access
..I feel like I shouldn't bookmark this post, given the invasive "social media checks" in the so-called Free World :')
> “Our technical experts are confident that the layers of protection in place on the airplane, including within the system design and the operating environment, provide sufficient mitigation to significantly limit the feasibility and risk of real-world attacks,” the statement reads.
So "We don't expect hackers to figure it out"
>So "We don't expect hackers to figure it out"
People