How to 0wn a 787 Dreamliner

Anyone who's spent any time working on publicly accessible networks will be aware of the importance of segregation: you keep the public parts of the 'net separate from the private parts. Sadly, nobody bothered to tell Boeing this simple rule.

The company is due to launch the new 787 Dreamliner jet in November 2008, and one of the much-hyped features is in-flight wireless Internet access. Pretty cool, to be able to check your Slashdot rating at 30,000 feet.

The designers at Boeing have made a bit of a boo-boo with this wonderful plan, however: the publicly accessible 'net gateway is also connected to, and shares infrastructure with, the in-flight computer. As in: the control, navigation, and communication infrastructure is connected to the public WiFi cell. A great move, guys. As if that wasn't enough, the system also hooks in to the operating airline's administrative network.

While the public and private parts have a firewall between them, it's not unheard of for firewalls to be hacked. Even the best firewall isn't as secure as physical disconnection, and it's clear that the only reason Boeing decided to join the two systems together was to save money on the network infrastructure within the plane.

Mark Loveless, network security analyst at Autonomic Networks, is suitably worried. As early as 2006 he was alerting people to this sort of thing in a presentation called Hacking the Friendly Skies, in which he warns “This is serious. This isn't a desktop computer. It's controlling the systems that are keeping people from plunging to their deaths. So I hope they are really thinking about how to get this right.”

The US Federal Aviation Authority isn't taking these reports lightheartedly, either. In a report available on the FAA website it claims that the design of the system “allows new kinds of passenger connectivity to previously isolated data networks connected to systems that perform functions required for the safe operation of the airplane”, and says that “Because of this new passenger connectivity, the proposed data-network design and integration may result in security vulnerabilities from intentional or unintentional corruption of data and systems critical to the safety and maintenance of the airplane.” The FAA is demanding that Boeing addresses these issues in an eight-point “special conditions” document which, if not met, could mean that the mid-sized jet doesn't get approved for use in the US.

Lori Gunter, a Boeing spokesperson, said the company is employing a number of solutions that should appease the regulators including increased (though still not complete) physical isolation and software-based firewalls. Gunter admits that “"There are places where the networks are not touching, and there are places where they are,” but claims “there are protections in place” to protect critical systems from unauthorised tampering.

Boeing will be conducting in-flight testing of the newly hardened system in March of this year. Let's hope we don't have to run a story about airborne spam, hey?

Is this enough to keep your palmtop in your pocket during a flight, or do you fancy the idea of a remote-control jet? Discuss over in the forums.