Hello everyone and welcome to this virtual 747-400 walkthrough.
I guess one of the advantages of Defcon Safe Mode this year is that we're able to bring you
things like this. But nothing beats being able to climb around and poke on a real airframe,
so hopefully this gives you some insights into the avionics and some secret spaces
on board this very recently retired aircraft. Ken and I work for Pentas Partners in the UK
and we've been very fortunate to have access to end-of-life airframes at a breaker's yard
from which we've learned an awful lot and we look forward to sharing some of these things with you,
especially if you've never seen the inside of Avionics Bay before.
So here we are walking upstairs to door B2 which is the second from the front on the starboard side
and gives us a nice view back over the wing. The observant amongst you will probably notice
there are some engines missing. There should be four but three have already been sold on
as these tend to be the most expensive and sought-after components.
On board now and we're straight into one of the galley areas and this will be where the ground
services teams load those trolleys full of your drinks and in-flight meals, but sadly no fine
dining today as the aircraft is basically pretty empty of everything except the seats.
Let's firstly walk through to the back of the aircraft past the stairs to the upper deck.
The 747 is truly a monster at 71 meters long, that's 230 feet, so there's plenty of space on
this aircraft for a full-class cabin layout. Down here right at the back is the first of our
secret areas which is in fact the crew rest area. One of two, this is primarily for the cabin crew.
Through this door at the back are some vaguely comfy seats and then a small spiral stair leading
up to the crew bunk area. Back up to the pointy end now and first class. As well as the back of
this section is perhaps the lesser known floor access hatch down into the electrical engineering
or avionics bay. You won't find this kind of access on smaller aircraft though. You can just
see the outside hatch is open as well down below at the bottom of this ladder. Let's climb down
into the avionics bay then. This is our main set of avionics, all neatly racked up. Each black box
carries out an individual function and are called line replaceable units or LRUs. For example, here
we have LRUs for cabin heating control, data management and at the bottom the three inertial
reference units for navigation. Looking at the same rack from the other side, now we can see
big bundles of cabling running from the back of the racks to other areas, mostly to the cockpit
which is now two decks above us. Each individual LRU will have discrete cabling up to the switches
or displays in the cockpit and if needed discrete cabling to any other LRUs it needs to talk to.
Most of the cables carry data in the ARINC 429 protocol on this aircraft
and this needs a pair for both transmit and receive. There is no network in the traditional
sense to connect to. You can't just clip into a pair of wires at the back of the aircraft and
gain access to all of these other LRUs. Perhaps fortunately it doesn't work like that on these
older aircraft. One other little secret is that behind the LRU rack are doors leading to the
forward cargo bay. The cargo and avionics bay are pressurized and although it would be pretty cold
and noisy you could, in theory, use this area in flight but I really wouldn't want to. This aircraft
has huge tanks of water in here now and this is because with the engines removed it would be too
tail heavy when actually fall backwards without the equivalent weight. Let's take a closer look
at one of these LRUs. This particular one is for the paravisual display, an indicator which shows
the pilots if they're aligned on runway. They're held onto a standard size rack with a screw thread
and rubber vibration mount. Some LRUs have more than one locking screw. If we pull these out we
find a custom multi-pin connector on the back of the LRU for a cable breakout. This will then
run off to wherever it needs to go in the cockpit. Here we have two of the units involved with ACARS
which is the aircraft's data link system. The CMU acts like a router sending ACARS traffic between
the various radios and the output devices like display units and printers which we'll see later.
Okay let's fly those cables back upstairs via a fairly unique set of stairs to the upper deck
bubble. There's a galley up here too if you remember that for later. Right at the front we
find the cockpit behind the armoured doors. Here we are in the cockpit then. On the left is the captain's
seat and to the right is the first officer's. There are two jump seats as well and behind me is the
flight crew rest area. Just a bunk bed again and a separate toilet that they can use without going
back into the passenger area. On long flights there will be three pilots or more which they
rotate through so someone is always getting some rest. The Dash 400 was the first 747 with a glass
cockpit in that the flight instruments are screens rather than what are termed steam driven dials and
gauges. It would have been a flight engineer too but their role is now computerised for the most
part. Each pilot has their own control column or yoke which is directly connected to the control
services by wires, pulleys and gears on a Boeing. The centre console is mostly taken up with the
multi-function control and display units, throttles and controls for the radios. They also have a
primary flight display right ahead of them and a navigational display. Both are independent.
In the centre are the ICAS engine indicating and crew alerting system displays which show
the status of all the major systems like engines, fuel, electrics, hydraulics and also comes up with
log style setting messages in yellow or red depending on severity. So let's power up. We have
a single ground power unit available. We should have two really for a 747 so we need to be a bit
careful on power use. By pressing the overhead button to tie in ground power 1 most things come
alive. You'll notice there's definitely no key. After a few minutes the primary flight display
showing the artificial horizon and flight director bars and the navigational display come up. Here I'm
sat in the first officer's seat on the right so the primary flight display is on the right and
the navigational display on the left. My lower ICAS display shows the electrical buses one for each
engine but as you can see from the upper display we have three engines missing. The aircraft will
think there's a fire as the detection loops aren't connected but obviously we're not really on fire.
I can also use my MCDU to access the ACAR system that we saw downstairs in the avionics bay.
There are lots of things I can do through ACARS but that's the topic for another of my talks.
Also in the cockpit are some other interesting bits of avionics like this navigation database
loader that still uses three and a half inch floppy disks. This database has to be updated
every 28 days so you can see how much of a chore this must be for an engineer to visit each month.
There is also a quick access recorder which is used for gathering lots of data about the aircraft's
health. At the end of each flight or near enough an engineer will remove the PC card
although this one actually has a CF to PC card converter and download the data which helps with
predictive maintenance or detecting if there's been a heavy landing or tail strike for example.
More and more aircraft are starting to become e-enabled which means this data is streamed in
near real time back to the airlines and engine makers over SATCOM so they can have replacement
parts ready and waiting for when the aircraft next lands. Now then, in-flight entertainment.
There's no wi-fi on this 747 but under the stairs down from the upper deck the cabin
services director has a small office and this is where the 747's IFE is driven from.
There is a small touchscreen PC here which is actually running
NT4. This can be used to change aspects of the system, add the day's news broadcast video,
reboot seat boxes and even turn individual seat lights on and off. Above this are the digital
media servers themselves which contain all the movies and so on ready to stream to each seat.
There's also the boarding music and safety announcement controller
which just plays off digital audio tape. There's even a little printer in here which is linked to
the ACARS system so the cabin services director can print things off if they need to.
And lastly, I want to leave you with a little secret. Remember the upper galley? Well,
there's a lift to take catering cars between the main and the upper deck which is pretty cool.
Alex, thank you for the tour of the 747. Absolutely fascinating. Now, why didn't
you do this interview in the in the 747 itself? Well, yeah, we really should have done but it was
a bit, you know, kind of confined in there and in the current COVID environment doing it with
masks and things would have been a bit weird. So yeah, we've come back to do it in the sim.
So it's our simulator rather than the the cockpit of the 747. That's fine. Great. Yeah.
Safety first, right? Quite right too. Now, one of the things that I think is a bit of a game
changer is the fact that so many airframes are being retired right now. What difference does
that make for us as researchers? Aircraft themselves are really expensive beasts, you know,
and even if you had all the will in the world, airlines and airframe manufacturers won't just
let you go and pen test an aircraft because you don't really know what state you're going to
leave it in. It's not like an office network where you can go and reinstall and clean things up.
Recertifying avionics and whole airframes is ludicrously expensive and even if you were able
to have some assurance that you've cleaned up the mess the pen tester has left. So being able
to sort of do more adversarial testing of an aircraft in a flying state is not something that
we really get to be able to do. So, you know, it's not a silver lining, I have to say, but
one of the results of the COVID crisis is that airlines are bringing forward a lot of their
programs, particularly of these larger types like the 747 and the 380s.
And as a result, they're going to salvage yards. They're not really going to fly again
in their current state. No one really wants 747s anymore. So yes, the avionics
may get a second lease of life, but the actual aircraft themselves are unlikely to be able to
fly again. And that gives us a really good opportunity to go and have a look around.
Yeah, so in the past, we've looked at some airframes. I think probably the oldest one
we got to have a play with was a 10-year-old A320 or so. But even then, it doesn't really
represent what's coming off the production line right now, does it? So, you know, last year for
Defcon for the village, we went and bought some LRUs, but even those were upwards of 20 years
old. So do you think it's a game changer, the fact that we're seeing some slightly more recent kit
being scrapped or decommissioned? Yeah, for sure. I mean, the 747 that we
just did the video to around was 23 years old. But remember that the design life cycle of these
things is 30 years. And there's a decade or more of design work that goes into an aircraft before
it even goes into production, and then 20 odd years of service. So what people are designing
today will still be in service in 30 years time. And it's really difficult to anticipate all of
sort of future security needs and requirements. So yeah, what we've seen today is obviously not
state of the art. And there are differences between 747 that we looked at and more modern
aircraft like the A380 that are flying today. Big differences in the way that their avionics are set
up and how the networking is done on board. Yeah, so it's important to remember that particular
plane was still flying just over two, two and a half months ago. And I think I actually flew in
that very plane as a passenger last year. So it is representative, it's just the scrappage
programs are being accelerated. And I also went through the avionics bay actually dating the
install dates for many of the components. And there's a lot of kit in there, but it's only
five to 10 years old in some cases. So it's not all 23 years out of date.
No, no. And a lot of it is reused. So the ground proximity warning system,
for example, those LRUs are pretty much interchangeable between any aircraft. I mean,
I've seen the same exact LRU make a model on the 747 as I did an Airbus A320. And they go for
$20,000. I mean, it's like a tiny little box, and it's $20,000. So it shows you, you know,
yes, stuff is coming off things that have been scrapped, but it is still current and flying.
And it is megabucks if you want to go poke at them.
So obviously, 49 carries a lot of heavy wiring as a result of it. Now, I know that
the 777 used an inductively coupled bus called ARINC 629, but that was really only used in the
777 itself. More recently, we've seen a move towards AFDX or ARINC 664. How does that change
the risk profile of the plane to you? So 664, and aviation loves its acronyms and numbers and
stuff. So, but 664 is basically based on Ethernet. It is Ethernet with some extra quality of service
layers on top to make sure that flight critical things can always talk to each other. So there
is basically a fiber network around more recent aircraft like the 777X, the 787, and the A380.
So there is a fiber network and everything plugs into that fiber network. And instead of these
discrete black boxes that we saw on the 747, and this whole rack of individual black boxes for want
of a better word, then there is basically a single compute crate. In fact, there's a pair for
redundancy. But there's an A side and a B side computer. And things just run as software. So
there's typically a real-time operating system like VXWorks that handles the flight critical
stuff, and then there tends to be a Linux side for less important things. And things are just
run as applications on these computational nodes. So that does mean it's starting to look a bit more
like a traditional IT network, albeit one that's kind of hardened and more resilient in that
regard. But, yeah, if you don't get things right, and I'm sure we've all seen it on office networks
and traditional office firewalling, if you don't get IP tables right, then that potentially means
traffic can move from one segmented zone to another. And that is true on aircraft. But
obviously, you're still going to need physical access. Things that I think we noticed from
looking at some navigational databases we recovered from airplanes, particularly those
on floppies, is there wasn't any code signing. There wasn't any cryptographic validity. So,
again, less of a problem where you're physically having to visit the plane and there's physical
security in place. But as we move towards, you know, sort of the idea of updating remotely over
the air, do you think that's more of a problem? Well, where manufacturers have moved to this
over-the-air deployment model, they have implemented some code signing, which has
brought its own problems, actually, recently, because that code validity certificate is also
only valid for a month. So if you're trying to do updates onto an Airbus at the moment,
you actually have to update the certificate verification list in the certificate chain
before you can do anything else. So they have thought about this as they've started to
make these e-enabled aircraft, for example. And on the Boeing side, there are some actual
physical data interlocks on the aircraft. So although you can stage software updates
and navigation updates, for example, onto the aircraft, they are held in an area until
either a pilot or a maintenance engineer physically operates a key switch and selects where that
software update should go. And there are other physical interlocks. So the aircraft actually
has to have its weight on wheels switch closed as well. So the aircraft has to be on the ground,
it can't be flying. And so one has to physically operate a mechanical switch
in order to update that particular part. So there are some safeguards. But yeah, you're right,
there are still a great reliance on CRCs and that kind of thing floating around in the aviation
industry. And if you speak to people, there does seem to be a bit of a misunderstanding between
integrity in that there is some sort of CRC magic number type thing to make sure the message
or update hasn't been garbled in transmission versus actual message signing, so that you know
that that software update or message has actually come from the person that says it's come from.
There's a lot of connectivity being established on planes. And a particular technology I'm quite
interested in is Gatelink, which is used to upload and download, for example,
pasture and manifest information, but also things like movies and stuff. So someone physically
doesn't have to put a CD or floppy crikey into the IFE. What other things are we seeing connected
to planes on the ground? Primarily, it's the health and maintenance data of the aircraft.
There's this big drive from the part of the manufacturers to have literally cloud offerings,
so that you as an operator can see the status of your aircraft in real time.
I mean, some of it is really cool in that they can even see how long it takes an individual valve
to open or close, that if this particular valve is now taking a fraction of a second longer to
open or close than it was, then maybe we need to arrange maintenance to come out and change that
valve before it becomes a problem. And the aircraft requires more maintenance and more downtime.
And remember that every time the aircraft is sitting on the tarmac, it's losing money for
the airline. So to keep our fares down, we want to maximise how often these things are flying,
but in a safe way. That picks up an interesting piece from a couple of years ago. A security
researcher claimed to have accessed the thrust management computer from the inflight entertainment
system. What's your view on that? Do you think that was a real issue? Or do you think
perhaps the media got a bit excited about it? I think it was thoroughly investigated by
everyone. And knowing the airframe manufacturers, they do genuinely take reports of this nature
pretty seriously. Most of them have avionics labs where they have everything in pieces on
the bench. And they often have a dedicated cyber security team that can take reports of this nature
and actually go and replay them on the bench and even on real airframes if they want to.
So I know it was thoroughly investigated and kind of debunked at the time. I think it was
perhaps a media jumping on the story rather than the individual in that particular case. But as
we briefly spoke about earlier, there is ARINC 49 flying around between the flight management system
and the inflight entertainment for telling you where you are. That's just part of how it works.
But that is a worldwide system and we have found that in our research. I obviously can't speak
as to the exact operator and aircraft involved in that previous instance. But where we've
gone and deliberately looking, we've not found at this point any two-way communication between
passenger domain systems like IFE and the control domain. And there is actually this sort of DMZ
almost of the information services domain that sits between the two. So to jump between
essentially two layers of segregation will be tricky in my opinion. Yeah, from everything I
looked at, it doesn't substantiate some of the claims that we've seen. Certainly we haven't
found a way to compromise aircraft control from the IFE. It strikes me that sometimes we're looking
in the wrong place. Everyone gets very excited about airplanes because they're new and unusual
technologies and it's great for us inquisitive researchers. But frankly, probably the most
likely area to cause disruption is going to be the ground system. So if a plane can't dispatch
because the ground systems are down or the maintenance systems are down, it doesn't go
anywhere. So I often think that planes get really interesting and lots of fun and I think it's great
that we can help assure their security. But really you need to watch out for those ground systems,
right? Yeah, definitely. I mean it just reminds me of flying out to Defcon almost a year ago
and a particular airline that pretty much all of us were traveling with to Vegas had a massive
outage of its passenger information system. So none of the check-in crew at the airports
could scan your boarding pass and get you onto the aircraft. They were having to do it
like literally pen and paper, all by hand. Thousands of people at this one airport. The
queues were out of the terminal around the car park. Yeah, and this was global. That's a huge
amount of disruption and cost and did a really stellar job of getting us onto the aircraft in
time pretty much. But you can see just how little things like this can have a real snowball effect.
So certainly before the lockdown I used to fly pretty much every single week and
I don't know about you Alex, I feel very comfortable with flying, being a passenger, even fully in the
knowledge of how aviation systems work. I'm very confident in their security. How do you feel about
it? Yeah, I mean, I think it's really important that, you know, we're not here to scaremonger.
Like any industry, there are areas of improvement and I'm pretty sure they would be the first to
admit that. But do any of these deficiencies mean that it's unsafe for people to fly?
No. I'm a pilot. I want to carry on flying for work. You know, I'm friends and family
flying around, so I don't wish them any harm either. So no, I don't think there are any risks.
Great. On that note, Alex, thank you very much. Cheers, Ken.
So thanks for watching. I hope it was useful to you.
If you have any comments or questions, let us know.