start	end	text
4840	8940	Hello everyone and welcome to this virtual 747-400 walkthrough.
9020	13440	I guess one of the advantages of Defcon Safe Mode this year is that we're able to bring you
13440	17720	things like this. But nothing beats being able to climb around and poke on a real airframe,
17720	21960	so hopefully this gives you some insights into the avionics and some secret spaces
21960	27500	on board this very recently retired aircraft. Ken and I work for Pentas Partners in the UK
28040	32220	and we've been very fortunate to have access to end-of-life airframes at a breaker's yard
32220	36660	from which we've learned an awful lot and we look forward to sharing some of these things with you,
36660	40100	especially if you've never seen the inside of Avionics Bay before.
41640	46780	So here we are walking upstairs to door B2 which is the second from the front on the starboard side
46780	51240	and gives us a nice view back over the wing. The observant amongst you will probably notice
51240	55160	there are some engines missing. There should be four but three have already been sold on
55160	58780	as these tend to be the most expensive and sought-after components.
59640	63860	On board now and we're straight into one of the galley areas and this will be where the ground
63860	69320	services teams load those trolleys full of your drinks and in-flight meals, but sadly no fine
69320	73820	dining today as the aircraft is basically pretty empty of everything except the seats.
76720	81100	Let's firstly walk through to the back of the aircraft past the stairs to the upper deck.
81300	88420	The 747 is truly a monster at 71 meters long, that's 230 feet, so there's plenty of space on
88420	98650	this aircraft for a full-class cabin layout. Down here right at the back is the first of our
98650	105730	secret areas which is in fact the crew rest area. One of two, this is primarily for the cabin crew.
105990	110950	Through this door at the back are some vaguely comfy seats and then a small spiral stair leading
110950	120010	up to the crew bunk area. Back up to the pointy end now and first class. As well as the back of
120010	124610	this section is perhaps the lesser known floor access hatch down into the electrical engineering
124610	129970	or avionics bay. You won't find this kind of access on smaller aircraft though. You can just
129970	138170	see the outside hatch is open as well down below at the bottom of this ladder. Let's climb down
138170	156540	into the avionics bay then. This is our main set of avionics, all neatly racked up. Each black box
156540	163620	carries out an individual function and are called line replaceable units or LRUs. For example, here
163620	169180	we have LRUs for cabin heating control, data management and at the bottom the three inertial
169180	178930	reference units for navigation. Looking at the same rack from the other side, now we can see
178930	183850	big bundles of cabling running from the back of the racks to other areas, mostly to the cockpit
183850	190370	which is now two decks above us. Each individual LRU will have discrete cabling up to the switches
190370	196290	or displays in the cockpit and if needed discrete cabling to any other LRUs it needs to talk to.
196650	201070	Most of the cables carry data in the ARINC 429 protocol on this aircraft
201070	206370	and this needs a pair for both transmit and receive. There is no network in the traditional
206370	211010	sense to connect to. You can't just clip into a pair of wires at the back of the aircraft and
211010	216130	gain access to all of these other LRUs. Perhaps fortunately it doesn't work like that on these
216130	224070	older aircraft. One other little secret is that behind the LRU rack are doors leading to the
224070	229490	forward cargo bay. The cargo and avionics bay are pressurized and although it would be pretty cold
229490	235110	and noisy you could, in theory, use this area in flight but I really wouldn't want to. This aircraft
235110	240150	has huge tanks of water in here now and this is because with the engines removed it would be too
240150	247030	tail heavy when actually fall backwards without the equivalent weight. Let's take a closer look
247030	252650	at one of these LRUs. This particular one is for the paravisual display, an indicator which shows
252650	258030	the pilots if they're aligned on runway. They're held onto a standard size rack with a screw thread
258030	264530	and rubber vibration mount. Some LRUs have more than one locking screw. If we pull these out we
264530	269990	find a custom multi-pin connector on the back of the LRU for a cable breakout. This will then
269990	276410	run off to wherever it needs to go in the cockpit. Here we have two of the units involved with ACARS
276410	282490	which is the aircraft's data link system. The CMU acts like a router sending ACARS traffic between
282490	288130	the various radios and the output devices like display units and printers which we'll see later.
289410	295790	Okay let's fly those cables back upstairs via a fairly unique set of stairs to the upper deck
295790	309740	bubble. There's a galley up here too if you remember that for later. Right at the front we
309740	325020	find the cockpit behind the armoured doors. Here we are in the cockpit then. On the left is the captain's
325020	330860	seat and to the right is the first officer's. There are two jump seats as well and behind me is the
330860	336280	flight crew rest area. Just a bunk bed again and a separate toilet that they can use without going
336280	341720	back into the passenger area. On long flights there will be three pilots or more which they
341720	348040	rotate through so someone is always getting some rest. The Dash 400 was the first 747 with a glass
348040	353680	cockpit in that the flight instruments are screens rather than what are termed steam driven dials and
353680	359200	gauges. It would have been a flight engineer too but their role is now computerised for the most
359200	364560	part. Each pilot has their own control column or yoke which is directly connected to the control
364560	370440	services by wires, pulleys and gears on a Boeing. The centre console is mostly taken up with the
370440	376880	multi-function control and display units, throttles and controls for the radios. They also have a
376880	382680	primary flight display right ahead of them and a navigational display. Both are independent.
382680	388800	In the centre are the ICAS engine indicating and crew alerting system displays which show
388800	394540	the status of all the major systems like engines, fuel, electrics, hydraulics and also comes up with
394540	402680	log style setting messages in yellow or red depending on severity. So let's power up. We have
402800	407620	a single ground power unit available. We should have two really for a 747 so we need to be a bit
407620	413480	careful on power use. By pressing the overhead button to tie in ground power 1 most things come
413480	421100	alive. You'll notice there's definitely no key. After a few minutes the primary flight display
421100	428040	showing the artificial horizon and flight director bars and the navigational display come up. Here I'm
428040	432740	sat in the first officer's seat on the right so the primary flight display is on the right and
432740	443260	the navigational display on the left. My lower ICAS display shows the electrical buses one for each
443260	449440	engine but as you can see from the upper display we have three engines missing. The aircraft will
449440	454760	think there's a fire as the detection loops aren't connected but obviously we're not really on fire.
455220	460880	I can also use my MCDU to access the ACAR system that we saw downstairs in the avionics bay.
460920	465900	There are lots of things I can do through ACARS but that's the topic for another of my talks.
468260	473060	Also in the cockpit are some other interesting bits of avionics like this navigation database
473060	478100	loader that still uses three and a half inch floppy disks. This database has to be updated
478100	484040	every 28 days so you can see how much of a chore this must be for an engineer to visit each month.
485460	490540	There is also a quick access recorder which is used for gathering lots of data about the aircraft's
490540	495520	health. At the end of each flight or near enough an engineer will remove the PC card
495520	501520	although this one actually has a CF to PC card converter and download the data which helps with
501520	506120	predictive maintenance or detecting if there's been a heavy landing or tail strike for example.
506120	511120	More and more aircraft are starting to become e-enabled which means this data is streamed in
511120	516220	near real time back to the airlines and engine makers over SATCOM so they can have replacement
516220	523780	parts ready and waiting for when the aircraft next lands. Now then, in-flight entertainment.
523900	528740	There's no wi-fi on this 747 but under the stairs down from the upper deck the cabin
528740	534240	services director has a small office and this is where the 747's IFE is driven from.
534240	537740	There is a small touchscreen PC here which is actually running
538580	544600	NT4. This can be used to change aspects of the system, add the day's news broadcast video,
544600	550220	reboot seat boxes and even turn individual seat lights on and off. Above this are the digital
550220	555940	media servers themselves which contain all the movies and so on ready to stream to each seat.
563030	566190	There's also the boarding music and safety announcement controller
566190	578330	which just plays off digital audio tape. There's even a little printer in here which is linked to
578330	583730	the ACARS system so the cabin services director can print things off if they need to.
585850	590690	And lastly, I want to leave you with a little secret. Remember the upper galley? Well,
590690	595750	there's a lift to take catering cars between the main and the upper deck which is pretty cool.
601680	606500	Alex, thank you for the tour of the 747. Absolutely fascinating. Now, why didn't
606500	612240	you do this interview in the in the 747 itself? Well, yeah, we really should have done but it was
612400	617880	a bit, you know, kind of confined in there and in the current COVID environment doing it with
617880	623440	masks and things would have been a bit weird. So yeah, we've come back to do it in the sim.
623440	628740	So it's our simulator rather than the the cockpit of the 747. That's fine. Great. Yeah.
629140	637180	Safety first, right? Quite right too. Now, one of the things that I think is a bit of a game
637180	641860	changer is the fact that so many airframes are being retired right now. What difference does
641860	647020	that make for us as researchers? Aircraft themselves are really expensive beasts, you know,
647020	654620	and even if you had all the will in the world, airlines and airframe manufacturers won't just
654620	659580	let you go and pen test an aircraft because you don't really know what state you're going to
659580	665440	leave it in. It's not like an office network where you can go and reinstall and clean things up.
665760	671180	Recertifying avionics and whole airframes is ludicrously expensive and even if you were able
671180	677300	to have some assurance that you've cleaned up the mess the pen tester has left. So being able
677300	684640	to sort of do more adversarial testing of an aircraft in a flying state is not something that
684640	690760	we really get to be able to do. So, you know, it's not a silver lining, I have to say, but
690760	697280	one of the results of the COVID crisis is that airlines are bringing forward a lot of their
697280	705260	programs, particularly of these larger types like the 747 and the 380s.
705880	711680	And as a result, they're going to salvage yards. They're not really going to fly again
711680	718380	in their current state. No one really wants 747s anymore. So yes, the avionics
718960	726400	may get a second lease of life, but the actual aircraft themselves are unlikely to be able to
726400	730500	fly again. And that gives us a really good opportunity to go and have a look around.
731060	734920	Yeah, so in the past, we've looked at some airframes. I think probably the oldest one
734920	739500	we got to have a play with was a 10-year-old A320 or so. But even then, it doesn't really
739500	743800	represent what's coming off the production line right now, does it? So, you know, last year for
743800	749700	Defcon for the village, we went and bought some LRUs, but even those were upwards of 20 years
749700	755480	old. So do you think it's a game changer, the fact that we're seeing some slightly more recent kit
755480	761600	being scrapped or decommissioned? Yeah, for sure. I mean, the 747 that we
761600	769940	just did the video to around was 23 years old. But remember that the design life cycle of these
769940	776580	things is 30 years. And there's a decade or more of design work that goes into an aircraft before
776580	782700	it even goes into production, and then 20 odd years of service. So what people are designing
782700	790900	today will still be in service in 30 years time. And it's really difficult to anticipate all of
790900	798080	sort of future security needs and requirements. So yeah, what we've seen today is obviously not
798080	805000	state of the art. And there are differences between 747 that we looked at and more modern
805000	811480	aircraft like the A380 that are flying today. Big differences in the way that their avionics are set
811480	816460	up and how the networking is done on board. Yeah, so it's important to remember that particular
816460	820880	plane was still flying just over two, two and a half months ago. And I think I actually flew in
820880	826980	that very plane as a passenger last year. So it is representative, it's just the scrappage
826980	831540	programs are being accelerated. And I also went through the avionics bay actually dating the
831540	835380	install dates for many of the components. And there's a lot of kit in there, but it's only
835380	840040	five to 10 years old in some cases. So it's not all 23 years out of date.
840040	845900	No, no. And a lot of it is reused. So the ground proximity warning system,
845900	852180	for example, those LRUs are pretty much interchangeable between any aircraft. I mean,
852180	861540	I've seen the same exact LRU make a model on the 747 as I did an Airbus A320. And they go for
861540	868580	$20,000. I mean, it's like a tiny little box, and it's $20,000. So it shows you, you know,
868580	873240	yes, stuff is coming off things that have been scrapped, but it is still current and flying.
873320	875780	And it is megabucks if you want to go poke at them.
876020	881360	So obviously, 49 carries a lot of heavy wiring as a result of it. Now, I know that
882120	888700	the 777 used an inductively coupled bus called ARINC 629, but that was really only used in the
888700	895600	777 itself. More recently, we've seen a move towards AFDX or ARINC 664. How does that change
895600	902680	the risk profile of the plane to you? So 664, and aviation loves its acronyms and numbers and
902680	912280	stuff. So, but 664 is basically based on Ethernet. It is Ethernet with some extra quality of service
912280	918400	layers on top to make sure that flight critical things can always talk to each other. So there
918400	927520	is basically a fiber network around more recent aircraft like the 777X, the 787, and the A380.
928000	934340	So there is a fiber network and everything plugs into that fiber network. And instead of these
934340	944580	discrete black boxes that we saw on the 747, and this whole rack of individual black boxes for want
944580	950500	of a better word, then there is basically a single compute crate. In fact, there's a pair for
950500	957660	redundancy. But there's an A side and a B side computer. And things just run as software. So
957660	963260	there's typically a real-time operating system like VXWorks that handles the flight critical
963260	969140	stuff, and then there tends to be a Linux side for less important things. And things are just
969140	977120	run as applications on these computational nodes. So that does mean it's starting to look a bit more
977120	983980	like a traditional IT network, albeit one that's kind of hardened and more resilient in that
983980	989840	regard. But, yeah, if you don't get things right, and I'm sure we've all seen it on office networks
989840	995160	and traditional office firewalling, if you don't get IP tables right, then that potentially means
995160	1001880	traffic can move from one segmented zone to another. And that is true on aircraft. But
1001880	1006380	obviously, you're still going to need physical access. Things that I think we noticed from
1006380	1011420	looking at some navigational databases we recovered from airplanes, particularly those
1011420	1017800	on floppies, is there wasn't any code signing. There wasn't any cryptographic validity. So,
1017800	1021140	again, less of a problem where you're physically having to visit the plane and there's physical
1021140	1025900	security in place. But as we move towards, you know, sort of the idea of updating remotely over
1025900	1031320	the air, do you think that's more of a problem? Well, where manufacturers have moved to this
1031320	1037240	over-the-air deployment model, they have implemented some code signing, which has
1037240	1042980	brought its own problems, actually, recently, because that code validity certificate is also
1042980	1049840	only valid for a month. So if you're trying to do updates onto an Airbus at the moment,
1049840	1054440	you actually have to update the certificate verification list in the certificate chain
1054440	1059780	before you can do anything else. So they have thought about this as they've started to
1060320	1066560	make these e-enabled aircraft, for example. And on the Boeing side, there are some actual
1066560	1074900	physical data interlocks on the aircraft. So although you can stage software updates
1074900	1080980	and navigation updates, for example, onto the aircraft, they are held in an area until
1081640	1087720	either a pilot or a maintenance engineer physically operates a key switch and selects where that
1087720	1094100	software update should go. And there are other physical interlocks. So the aircraft actually
1094100	1099720	has to have its weight on wheels switch closed as well. So the aircraft has to be on the ground,
1099720	1104400	it can't be flying. And so one has to physically operate a mechanical switch
1105060	1112320	in order to update that particular part. So there are some safeguards. But yeah, you're right,
1112320	1120980	there are still a great reliance on CRCs and that kind of thing floating around in the aviation
1120980	1127120	industry. And if you speak to people, there does seem to be a bit of a misunderstanding between
1129760	1135660	integrity in that there is some sort of CRC magic number type thing to make sure the message
1135660	1144940	or update hasn't been garbled in transmission versus actual message signing, so that you know
1144940	1150840	that that software update or message has actually come from the person that says it's come from.
1150960	1155760	There's a lot of connectivity being established on planes. And a particular technology I'm quite
1155760	1160260	interested in is Gatelink, which is used to upload and download, for example,
1160260	1165900	pasture and manifest information, but also things like movies and stuff. So someone physically
1165900	1172480	doesn't have to put a CD or floppy crikey into the IFE. What other things are we seeing connected
1172480	1178480	to planes on the ground? Primarily, it's the health and maintenance data of the aircraft.
1178480	1187940	There's this big drive from the part of the manufacturers to have literally cloud offerings,
1187940	1193580	so that you as an operator can see the status of your aircraft in real time.
1194120	1201140	I mean, some of it is really cool in that they can even see how long it takes an individual valve
1201140	1207680	to open or close, that if this particular valve is now taking a fraction of a second longer to
1207680	1214180	open or close than it was, then maybe we need to arrange maintenance to come out and change that
1214180	1220440	valve before it becomes a problem. And the aircraft requires more maintenance and more downtime.
1220440	1225480	And remember that every time the aircraft is sitting on the tarmac, it's losing money for
1225480	1232020	the airline. So to keep our fares down, we want to maximise how often these things are flying,
1232020	1236000	but in a safe way. That picks up an interesting piece from a couple of years ago. A security
1236000	1239700	researcher claimed to have accessed the thrust management computer from the inflight entertainment
1239700	1245500	system. What's your view on that? Do you think that was a real issue? Or do you think
1245500	1251300	perhaps the media got a bit excited about it? I think it was thoroughly investigated by
1251300	1259240	everyone. And knowing the airframe manufacturers, they do genuinely take reports of this nature
1259240	1265900	pretty seriously. Most of them have avionics labs where they have everything in pieces on
1265900	1273120	the bench. And they often have a dedicated cyber security team that can take reports of this nature
1273120	1277860	and actually go and replay them on the bench and even on real airframes if they want to.
1277860	1285120	So I know it was thoroughly investigated and kind of debunked at the time. I think it was
1285120	1290640	perhaps a media jumping on the story rather than the individual in that particular case. But as
1290640	1297500	we briefly spoke about earlier, there is ARINC 49 flying around between the flight management system
1297500	1302980	and the inflight entertainment for telling you where you are. That's just part of how it works.
1302980	1310780	But that is a worldwide system and we have found that in our research. I obviously can't speak
1310780	1315700	as to the exact operator and aircraft involved in that previous instance. But where we've
1315700	1321980	gone and deliberately looking, we've not found at this point any two-way communication between
1321980	1329480	passenger domain systems like IFE and the control domain. And there is actually this sort of DMZ
1329480	1335740	almost of the information services domain that sits between the two. So to jump between
1335740	1342860	essentially two layers of segregation will be tricky in my opinion. Yeah, from everything I
1342860	1348240	looked at, it doesn't substantiate some of the claims that we've seen. Certainly we haven't
1348240	1353360	found a way to compromise aircraft control from the IFE. It strikes me that sometimes we're looking
1353360	1357340	in the wrong place. Everyone gets very excited about airplanes because they're new and unusual
1357340	1362520	technologies and it's great for us inquisitive researchers. But frankly, probably the most
1362520	1367080	likely area to cause disruption is going to be the ground system. So if a plane can't dispatch
1367080	1370840	because the ground systems are down or the maintenance systems are down, it doesn't go
1370840	1375380	anywhere. So I often think that planes get really interesting and lots of fun and I think it's great
1375380	1379940	that we can help assure their security. But really you need to watch out for those ground systems,
1379940	1387700	right? Yeah, definitely. I mean it just reminds me of flying out to Defcon almost a year ago
1388240	1395580	and a particular airline that pretty much all of us were traveling with to Vegas had a massive
1395580	1402940	outage of its passenger information system. So none of the check-in crew at the airports
1404040	1407920	could scan your boarding pass and get you onto the aircraft. They were having to do it
1407920	1415060	like literally pen and paper, all by hand. Thousands of people at this one airport. The
1415060	1421280	queues were out of the terminal around the car park. Yeah, and this was global. That's a huge
1421280	1425780	amount of disruption and cost and did a really stellar job of getting us onto the aircraft in
1425780	1432560	time pretty much. But you can see just how little things like this can have a real snowball effect.
1433160	1437060	So certainly before the lockdown I used to fly pretty much every single week and
1437060	1442820	I don't know about you Alex, I feel very comfortable with flying, being a passenger, even fully in the
1442820	1447360	knowledge of how aviation systems work. I'm very confident in their security. How do you feel about
1447360	1452840	it? Yeah, I mean, I think it's really important that, you know, we're not here to scaremonger.
1453660	1458420	Like any industry, there are areas of improvement and I'm pretty sure they would be the first to
1458420	1463440	admit that. But do any of these deficiencies mean that it's unsafe for people to fly?
1463480	1469900	No. I'm a pilot. I want to carry on flying for work. You know, I'm friends and family
1469900	1475820	flying around, so I don't wish them any harm either. So no, I don't think there are any risks.
1477540	1480780	Great. On that note, Alex, thank you very much. Cheers, Ken.
1482480	1485400	So thanks for watching. I hope it was useful to you.
1485400	1488260	If you have any comments or questions, let us know.