WEBVTT 00:04.840 --> 00:08.940 Hello everyone and welcome to this virtual 747-400 walkthrough. 00:09.020 --> 00:14.540 I guess one of the advantages of Defcon Safe Mode this year is that we're able to bring you things like this. 00:14.620 --> 00:24.680 But nothing beats being able to climb around and poke on a real airframe, so hopefully this gives you some insights into the avionics and some secret spaces on board this very recently retired aircraft. 00:25.480 --> 00:40.100 Ken and I work for Pentas Partners in the UK and we've been very fortunate to have access to end-of-life airframes at a breaker's yard from which we've learned an awful lot and we look forward to sharing some of these things with you, especially if you've never seen the inside of Avionics Bay before. 00:41.640 --> 00:49.420 So here we are walking upstairs to door B2 which is the second from the front on the starboard side and gives us a nice view back over the wing. 00:49.660 --> 00:52.840 The observant amongst you will probably notice there are some engines missing. 00:53.020 --> 00:58.780 There should be four but three have already been sold on as these tend to be the most expensive and sought-after components. 00:59.640 --> 01:13.820 On board now and we're straight into one of the galley areas and this will be where the ground services teams load those trolleys full of your drinks and in-flight meals, but sadly no fine dining today as the aircraft is basically pretty empty of everything except the seats. 01:16.720 --> 01:21.100 Let's firstly walk through to the back of the aircraft past the stairs to the upper deck. 01:21.300 --> 01:31.500 The 747 is truly a monster at 71 meters long, that's 230 feet, so there's plenty of space on this aircraft for a full-class cabin layout. 01:36.150 --> 01:42.290 Down here right at the back is the first of our secret areas which is in fact the crew rest area. 01:42.690 --> 01:45.730 One of two, this is primarily for the cabin crew. 01:45.990 --> 01:52.770 Through this door at the back are some vaguely comfy seats and then a small spiral stair leading up to the crew bunk area. 01:55.650 --> 01:59.190 Back up to the pointy end now and first class. 01:59.310 --> 02:06.090 As well as the back of this section is perhaps the lesser known floor access hatch down into the electrical engineering or avionics bay. 02:06.110 --> 02:09.170 You won't find this kind of access on smaller aircraft though. 02:09.430 --> 02:14.490 You can just see the outside hatch is open as well down below at the bottom of this ladder. 02:17.130 --> 02:19.890 Let's climb down into the avionics bay then. 02:31.700 --> 02:35.400 This is our main set of avionics, all neatly racked up. 02:35.620 --> 02:41.900 Each black box carries out an individual function and are called line replaceable units or LRUs. 02:42.320 --> 02:51.240 For example, here we have LRUs for cabin heating control, data management and at the bottom the three inertial reference units for navigation. 02:55.570 --> 03:06.330 Looking at the same rack from the other side, now we can see big bundles of cabling running from the back of the racks to other areas, mostly to the cockpit which is now two decks above us. 03:06.590 --> 03:16.290 Each individual LRU will have discrete cabling up to the switches or displays in the cockpit and if needed discrete cabling to any other LRUs it needs to talk to. 03:16.650 --> 03:24.650 Most of the cables carry data in the ARINC 429 protocol on this aircraft and this needs a pair for both transmit and receive. 03:24.730 --> 03:27.870 There is no network in the traditional sense to connect to. 03:27.870 --> 03:33.630 You can't just clip into a pair of wires at the back of the aircraft and gain access to all of these other LRUs. 03:33.710 --> 03:37.370 Perhaps fortunately it doesn't work like that on these older aircraft. 03:39.370 --> 03:45.450 One other little secret is that behind the LRU rack are doors leading to the forward cargo bay. 03:45.450 --> 03:54.270 The cargo and avionics bay are pressurized and although it would be pretty cold and noisy you could, in theory, use this area in flight but I really wouldn't want to. 03:54.430 --> 04:03.810 This aircraft has huge tanks of water in here now and this is because with the engines removed it would be too tail heavy when actually fall backwards without the equivalent weight. 04:05.650 --> 04:08.670 Let's take a closer look at one of these LRUs. 04:08.850 --> 04:14.850 This particular one is for the paravisual display, an indicator which shows the pilots if they're aligned on runway. 04:15.150 --> 04:19.910 They're held onto a standard size rack with a screw thread and rubber vibration mount. 04:20.250 --> 04:22.850 Some LRUs have more than one locking screw. 04:23.030 --> 04:29.290 If we pull these out we find a custom multi-pin connector on the back of the LRU for a cable breakout. 04:29.290 --> 04:32.510 This will then run off to wherever it needs to go in the cockpit. 04:33.770 --> 04:39.150 Here we have two of the units involved with ACARS which is the aircraft's data link system. 04:39.150 --> 04:48.130 The CMU acts like a router sending ACARS traffic between the various radios and the output devices like display units and printers which we'll see later. 04:49.410 --> 04:56.570 Okay let's fly those cables back upstairs via a fairly unique set of stairs to the upper deck bubble. 04:56.730 --> 05:00.250 There's a galley up here too if you remember that for later. 05:08.240 --> 05:12.600 Right at the front we find the cockpit behind the armoured doors. 05:21.700 --> 05:23.540 Here we are in the cockpit then. 05:23.660 --> 05:27.440 On the left is the captain's seat and to the right is the first officer's. 05:27.640 --> 05:32.320 There are two jump seats as well and behind me is the flight crew rest area. 05:32.620 --> 05:38.100 Just a bunk bed again and a separate toilet that they can use without going back into the passenger area. 05:38.320 --> 05:44.560 On long flights there will be three pilots or more which they rotate through so someone is always getting some rest. 05:45.120 --> 05:54.580 The Dash 400 was the first 747 with a glass cockpit in that the flight instruments are screens rather than what are termed steam driven dials and gauges. 05:55.180 --> 06:00.000 It would have been a flight engineer too but their role is now computerised for the most part. 06:00.260 --> 06:07.960 Each pilot has their own control column or yoke which is directly connected to the control services by wires, pulleys and gears on a Boeing. 06:08.260 --> 06:15.660 The centre console is mostly taken up with the multi-function control and display units, throttles and controls for the radios. 06:15.780 --> 06:20.560 They also have a primary flight display right ahead of them and a navigational display. 06:20.620 --> 06:22.060 Both are independent. 06:22.480 --> 06:38.820 In the centre are the ICAS engine indicating and crew alerting system displays which show the status of all the major systems like engines, fuel, electrics, hydraulics and also comes up with log style setting messages in yellow or red depending on severity. 06:40.340 --> 06:41.960 So let's power up. 06:42.000 --> 06:44.720 We have a single ground power unit available. 06:44.720 --> 06:49.300 We should have two really for a 747 so we need to be a bit careful on power use. 06:49.420 --> 06:54.400 By pressing the overhead button to tie in ground power 1 most things come alive. 06:54.420 --> 06:56.720 You'll notice there's definitely no key. 06:58.680 --> 07:07.520 After a few minutes the primary flight display showing the artificial horizon and flight director bars and the navigational display come up. 07:07.680 --> 07:14.940 Here I'm sat in the first officer's seat on the right so the primary flight display is on the right and the navigational display on the left. 07:19.140 --> 07:28.780 My lower ICAS display shows the electrical buses one for each engine but as you can see from the upper display we have three engines missing. 07:28.840 --> 07:34.760 The aircraft will think there's a fire as the detection loops aren't connected but obviously we're not really on fire. 07:35.220 --> 07:40.880 I can also use my MCDU to access the ACAR system that we saw downstairs in the avionics bay. 07:40.920 --> 07:45.900 There are lots of things I can do through ACARS but that's the topic for another of my talks. 07:48.260 --> 07:56.340 Also in the cockpit are some other interesting bits of avionics like this navigation database loader that still uses three and a half inch floppy disks. 07:56.780 --> 08:04.040 This database has to be updated every 28 days so you can see how much of a chore this must be for an engineer to visit each month. 08:05.460 --> 08:11.280 There is also a quick access recorder which is used for gathering lots of data about the aircraft's health. 08:11.420 --> 08:26.120 At the end of each flight or near enough an engineer will remove the PC card although this one actually has a CF to PC card converter and download the data which helps with predictive maintenance or detecting if there's been a heavy landing or tail strike for example. 08:26.120 --> 08:39.240 More and more aircraft are starting to become e-enabled which means this data is streamed in near real time back to the airlines and engine makers over SATCOM so they can have replacement parts ready and waiting for when the aircraft next lands. 08:41.420 --> 08:43.780 Now then, in-flight entertainment. 08:43.900 --> 08:54.240 There's no wi-fi on this 747 but under the stairs down from the upper deck the cabin services director has a small office and this is where the 747's IFE is driven from. 08:54.240 --> 08:59.700 There is a small touchscreen PC here which is actually running NT4. 08:59.980 --> 09:08.700 This can be used to change aspects of the system, add the day's news broadcast video, reboot seat boxes and even turn individual seat lights on and off. 09:08.940 --> 09:15.940 Above this are the digital media servers themselves which contain all the movies and so on ready to stream to each seat. 09:23.030 --> 09:29.050 There's also the boarding music and safety announcement controller which just plays off digital audio tape. 09:35.310 --> 09:43.730 There's even a little printer in here which is linked to the ACARS system so the cabin services director can print things off if they need to. 09:45.850 --> 09:48.670 And lastly, I want to leave you with a little secret. 09:48.830 --> 09:50.110 Remember the upper galley? 09:50.230 --> 09:55.750 Well, there's a lift to take catering cars between the main and the upper deck which is pretty cool. 10:01.680 --> 10:04.180 Alex, thank you for the tour of the 747. 10:04.180 --> 10:05.460 Absolutely fascinating. 10:05.460 --> 10:09.240 Now, why didn't you do this interview in the in the 747 itself? 10:09.640 --> 10:19.600 Well, yeah, we really should have done but it was a bit, you know, kind of confined in there and in the current COVID environment doing it with masks and things would have been a bit weird. 10:19.600 --> 10:23.440 So yeah, we've come back to do it in the sim. 10:23.440 --> 10:26.960 So it's our simulator rather than the the cockpit of the 747. 10:26.960 --> 10:27.740 That's fine. 10:27.740 --> 10:28.100 Great. 10:28.100 --> 10:28.740 Yeah. 10:29.140 --> 10:30.280 Safety first, right? 10:30.280 --> 10:31.240 Quite right too. 10:31.240 --> 10:41.220 Now, one of the things that I think is a bit of a game changer is the fact that so many airframes are being retired right now. 10:41.220 --> 10:43.640 What difference does that make for us as researchers? 10:43.760 --> 11:00.120 Aircraft themselves are really expensive beasts, you know, and even if you had all the will in the world, airlines and airframe manufacturers won't just let you go and pen test an aircraft because you don't really know what state you're going to leave it in. 11:00.120 --> 11:05.440 It's not like an office network where you can go and reinstall and clean things up. 11:05.760 --> 11:15.420 Recertifying avionics and whole airframes is ludicrously expensive and even if you were able to have some assurance that you've cleaned up the mess the pen tester has left. 11:15.420 --> 11:26.680 So being able to sort of do more adversarial testing of an aircraft in a flying state is not something that we really get to be able to do. 11:27.640 --> 11:45.260 So, you know, it's not a silver lining, I have to say, but one of the results of the COVID crisis is that airlines are bringing forward a lot of their programs, particularly of these larger types like the 747 and the 380s. 11:45.880 --> 11:49.580 And as a result, they're going to salvage yards. 11:49.580 --> 11:53.820 They're not really going to fly again in their current state. 11:53.820 --> 11:56.880 No one really wants 747s anymore. 11:56.960 --> 12:07.260 So yes, the avionics may get a second lease of life, but the actual aircraft themselves are unlikely to be able to fly again. 12:07.280 --> 12:10.500 And that gives us a really good opportunity to go and have a look around. 12:11.060 --> 12:13.980 Yeah, so in the past, we've looked at some airframes. 12:13.980 --> 12:17.840 I think probably the oldest one we got to have a play with was a 10-year-old A320 or so. 12:17.840 --> 12:22.160 But even then, it doesn't really represent what's coming off the production line right now, does it? 12:22.160 --> 12:30.060 So, you know, last year for Defcon for the village, we went and bought some LRUs, but even those were upwards of 20 years old. 12:30.060 --> 12:38.680 So do you think it's a game changer, the fact that we're seeing some slightly more recent kit being scrapped or decommissioned? 12:38.680 --> 12:39.520 Yeah, for sure. 12:39.520 --> 12:45.180 I mean, the 747 that we just did the video to around was 23 years old. 12:45.180 --> 12:52.460 But remember that the design life cycle of these things is 30 years. 12:52.660 --> 13:00.880 And there's a decade or more of design work that goes into an aircraft before it even goes into production, and then 20 odd years of service. 13:00.880 --> 13:07.820 So what people are designing today will still be in service in 30 years time. 13:07.820 --> 13:14.420 And it's really difficult to anticipate all of sort of future security needs and requirements. 13:14.420 --> 13:18.920 So yeah, what we've seen today is obviously not state of the art. 13:18.920 --> 13:27.780 And there are differences between 747 that we looked at and more modern aircraft like the A380 that are flying today. 13:27.780 --> 13:33.980 Big differences in the way that their avionics are set up and how the networking is done on board. 13:34.320 --> 13:39.720 Yeah, so it's important to remember that particular plane was still flying just over two, two and a half months ago. 13:39.720 --> 13:43.380 And I think I actually flew in that very plane as a passenger last year. 13:43.380 --> 13:48.740 So it is representative, it's just the scrappage programs are being accelerated. 13:48.740 --> 13:53.160 And I also went through the avionics bay actually dating the install dates for many of the components. 13:53.160 --> 13:57.460 And there's a lot of kit in there, but it's only five to 10 years old in some cases. 13:57.460 --> 14:00.040 So it's not all 23 years out of date. 14:00.040 --> 14:00.740 No, no. 14:00.740 --> 14:02.740 And a lot of it is reused. 14:02.860 --> 14:12.000 So the ground proximity warning system, for example, those LRUs are pretty much interchangeable between any aircraft. 14:12.000 --> 14:20.120 I mean, I've seen the same exact LRU make a model on the 747 as I did an Airbus A320. 14:20.260 --> 14:22.740 And they go for $20,000. 14:22.740 --> 14:26.200 I mean, it's like a tiny little box, and it's $20,000. 14:26.340 --> 14:33.240 So it shows you, you know, yes, stuff is coming off things that have been scrapped, but it is still current and flying. 14:33.320 --> 14:35.780 And it is megabucks if you want to go poke at them. 14:36.020 --> 14:40.700 So obviously, 49 carries a lot of heavy wiring as a result of it. 14:40.700 --> 14:49.980 Now, I know that the 777 used an inductively coupled bus called ARINC 629, but that was really only used in the 777 itself. 14:49.980 --> 14:54.180 More recently, we've seen a move towards AFDX or ARINC 664. 14:54.320 --> 14:57.680 How does that change the risk profile of the plane to you? 14:58.080 --> 15:03.160 So 664, and aviation loves its acronyms and numbers and stuff. 15:03.160 --> 15:09.220 So, but 664 is basically based on Ethernet. 15:09.220 --> 15:17.480 It is Ethernet with some extra quality of service layers on top to make sure that flight critical things can always talk to each other. 15:17.720 --> 15:27.520 So there is basically a fiber network around more recent aircraft like the 777X, the 787, and the A380. 15:28.000 --> 15:32.980 So there is a fiber network and everything plugs into that fiber network. 15:33.000 --> 15:49.500 And instead of these discrete black boxes that we saw on the 747, and this whole rack of individual black boxes for want of a better word, then there is basically a single compute crate. 15:49.500 --> 15:51.540 In fact, there's a pair for redundancy. 15:51.960 --> 15:54.600 But there's an A side and a B side computer. 15:55.400 --> 15:56.860 And things just run as software. 15:57.480 --> 16:08.620 So there's typically a real-time operating system like VXWorks that handles the flight critical stuff, and then there tends to be a Linux side for less important things. 16:08.620 --> 16:13.540 And things are just run as applications on these computational nodes. 16:14.300 --> 16:24.460 So that does mean it's starting to look a bit more like a traditional IT network, albeit one that's kind of hardened and more resilient in that regard. 16:24.460 --> 16:39.000 But, yeah, if you don't get things right, and I'm sure we've all seen it on office networks and traditional office firewalling, if you don't get IP tables right, then that potentially means traffic can move from one segmented zone to another. 16:39.000 --> 16:41.240 And that is true on aircraft. 16:41.360 --> 16:44.560 But obviously, you're still going to need physical access. 16:44.560 --> 16:54.140 Things that I think we noticed from looking at some navigational databases we recovered from airplanes, particularly those on floppies, is there wasn't any code signing. 16:54.140 --> 16:57.040 There wasn't any cryptographic validity. 16:57.040 --> 17:02.020 So, again, less of a problem where you're physically having to visit the plane and there's physical security in place. 17:02.020 --> 17:07.640 But as we move towards, you know, sort of the idea of updating remotely over the air, do you think that's more of a problem? 17:08.440 --> 17:24.700 Well, where manufacturers have moved to this over-the-air deployment model, they have implemented some code signing, which has brought its own problems, actually, recently, because that code validity certificate is also only valid for a month. 17:25.320 --> 17:36.340 So if you're trying to do updates onto an Airbus at the moment, you actually have to update the certificate verification list in the certificate chain before you can do anything else. 17:36.520 --> 17:43.000 So they have thought about this as they've started to make these e-enabled aircraft, for example. 17:43.160 --> 17:51.060 And on the Boeing side, there are some actual physical data interlocks on the aircraft. 17:51.060 --> 18:09.720 So although you can stage software updates and navigation updates, for example, onto the aircraft, they are held in an area until either a pilot or a maintenance engineer physically operates a key switch and selects where that software update should go. 18:09.740 --> 18:11.560 And there are other physical interlocks. 18:11.560 --> 18:17.900 So the aircraft actually has to have its weight on wheels switch closed as well. 18:17.900 --> 18:21.080 So the aircraft has to be on the ground, it can't be flying. 18:21.240 --> 18:27.620 And so one has to physically operate a mechanical switch in order to update that particular part. 18:27.620 --> 18:30.040 So there are some safeguards. 18:30.620 --> 18:41.660 But yeah, you're right, there are still a great reliance on CRCs and that kind of thing floating around in the aviation industry. 18:41.660 --> 19:03.500 And if you speak to people, there does seem to be a bit of a misunderstanding between integrity in that there is some sort of CRC magic number type thing to make sure the message or update hasn't been garbled in transmission versus actual message signing, 19:03.500 --> 19:10.840 so that you know that that software update or message has actually come from the person that says it's come from. 19:10.960 --> 19:13.680 There's a lot of connectivity being established on planes. 19:13.680 --> 19:25.200 And a particular technology I'm quite interested in is Gatelink, which is used to upload and download, for example, pasture and manifest information, but also things like movies and stuff. 19:25.200 --> 19:30.740 So someone physically doesn't have to put a CD or floppy crikey into the IFE. 19:30.740 --> 19:34.040 What other things are we seeing connected to planes on the ground? 19:34.320 --> 19:38.480 Primarily, it's the health and maintenance data of the aircraft. 19:38.480 --> 19:53.580 There's this big drive from the part of the manufacturers to have literally cloud offerings, so that you as an operator can see the status of your aircraft in real time. 19:54.120 --> 20:16.760 I mean, some of it is really cool in that they can even see how long it takes an individual valve to open or close, that if this particular valve is now taking a fraction of a second longer to open or close than it was, then maybe we need to arrange maintenance to come out and change that valve before it becomes a problem. 20:16.760 --> 20:20.440 And the aircraft requires more maintenance and more downtime. 20:20.440 --> 20:26.080 And remember that every time the aircraft is sitting on the tarmac, it's losing money for the airline. 20:26.080 --> 20:33.620 So to keep our fares down, we want to maximise how often these things are flying, but in a safe way. 20:33.620 --> 20:35.520 That picks up an interesting piece from a couple of years ago. 20:35.520 --> 20:40.660 A security researcher claimed to have accessed the thrust management computer from the inflight entertainment system. 20:40.660 --> 20:42.500 What's your view on that? 20:42.500 --> 20:45.060 Do you think that was a real issue? 20:45.060 --> 20:47.940 Or do you think perhaps the media got a bit excited about it? 20:48.040 --> 20:52.360 I think it was thoroughly investigated by everyone. 20:52.360 --> 21:00.660 And knowing the airframe manufacturers, they do genuinely take reports of this nature pretty seriously. 21:00.660 --> 21:06.780 Most of them have avionics labs where they have everything in pieces on the bench. 21:06.780 --> 21:17.860 And they often have a dedicated cyber security team that can take reports of this nature and actually go and replay them on the bench and even on real airframes if they want to. 21:17.860 --> 21:22.940 So I know it was thoroughly investigated and kind of debunked at the time. 21:24.140 --> 21:29.960 I think it was perhaps a media jumping on the story rather than the individual in that particular case. 21:29.960 --> 21:41.380 But as we briefly spoke about earlier, there is ARINC 49 flying around between the flight management system and the inflight entertainment for telling you where you are. 21:41.380 --> 21:42.980 That's just part of how it works. 21:42.980 --> 21:49.720 But that is a worldwide system and we have found that in our research. 21:49.760 --> 21:54.260 I obviously can't speak as to the exact operator and aircraft involved in that previous instance. 21:54.260 --> 22:07.140 But where we've gone and deliberately looking, we've not found at this point any two-way communication between passenger domain systems like IFE and the control domain. 22:07.240 --> 22:14.160 And there is actually this sort of DMZ almost of the information services domain that sits between the two. 22:14.160 --> 22:21.360 So to jump between essentially two layers of segregation will be tricky in my opinion. 22:21.460 --> 22:27.520 Yeah, from everything I looked at, it doesn't substantiate some of the claims that we've seen. 22:27.520 --> 22:31.400 Certainly we haven't found a way to compromise aircraft control from the IFE. 22:31.400 --> 22:34.020 It strikes me that sometimes we're looking in the wrong place. 22:34.020 --> 22:40.920 Everyone gets very excited about airplanes because they're new and unusual technologies and it's great for us inquisitive researchers. 22:40.920 --> 22:45.800 But frankly, probably the most likely area to cause disruption is going to be the ground system. 22:45.800 --> 22:51.280 So if a plane can't dispatch because the ground systems are down or the maintenance systems are down, it doesn't go anywhere. 22:51.280 --> 22:56.820 So I often think that planes get really interesting and lots of fun and I think it's great that we can help assure their security. 22:56.820 --> 23:00.480 But really you need to watch out for those ground systems, right? 23:01.180 --> 23:02.100 Yeah, definitely. 23:02.100 --> 23:19.380 I mean it just reminds me of flying out to Defcon almost a year ago and a particular airline that pretty much all of us were traveling with to Vegas had a massive outage of its passenger information system. 23:19.380 --> 23:27.020 So none of the check-in crew at the airports could scan your boarding pass and get you onto the aircraft. 23:27.020 --> 23:31.360 They were having to do it like literally pen and paper, all by hand. 23:32.000 --> 23:34.920 Thousands of people at this one airport. 23:34.920 --> 23:37.860 The queues were out of the terminal around the car park. 23:38.560 --> 23:39.900 Yeah, and this was global. 23:40.520 --> 23:46.680 That's a huge amount of disruption and cost and did a really stellar job of getting us onto the aircraft in time pretty much. 23:46.680 --> 23:52.560 But you can see just how little things like this can have a real snowball effect. 23:53.160 --> 24:04.960 So certainly before the lockdown I used to fly pretty much every single week and I don't know about you Alex, I feel very comfortable with flying, being a passenger, even fully in the knowledge of how aviation systems work. 24:04.960 --> 24:06.640 I'm very confident in their security. 24:06.640 --> 24:07.900 How do you feel about it? 24:08.260 --> 24:12.840 Yeah, I mean, I think it's really important that, you know, we're not here to scaremonger. 24:13.660 --> 24:19.100 Like any industry, there are areas of improvement and I'm pretty sure they would be the first to admit that. 24:19.100 --> 24:23.440 But do any of these deficiencies mean that it's unsafe for people to fly? 24:23.480 --> 24:24.000 No. 24:24.400 --> 24:25.520 I'm a pilot. 24:25.520 --> 24:27.600 I want to carry on flying for work. 24:28.580 --> 24:32.780 You know, I'm friends and family flying around, so I don't wish them any harm either. 24:32.780 --> 24:35.820 So no, I don't think there are any risks. 24:37.540 --> 24:38.060 Great. 24:38.060 --> 24:39.900 On that note, Alex, thank you very much. 24:39.920 --> 24:40.780 Cheers, Ken. 24:42.480 --> 24:43.900 So thanks for watching. 24:43.900 --> 24:45.400 I hope it was useful to you. 24:45.400 --> 24:48.260 If you have any comments or questions, let us know.