start	end	text
6880	14440	Hello and welcome to my talk here at the Aerospace Village at DEF CON SIGMODE.
14520	20300	MITM, the mystery in the middle. My name is Matthew Gaffney and I'll be taking you through
20680	30120	an introductory level talk about the Aircraft Information Systems Domain, also known as the AISD.
31240	38380	We'll be covering through these topics throughout the 50 minutes or so talk today,
39060	42860	covering most of it on EFBs, if I'm honest.
43720	46780	So, why the mystery?
47480	54740	So, the reason I call it the mystery in the middle was due to the lack of public information
54740	61500	I could find about the AISD when I started my journey into aviation cybersecurity
62360	68240	several years ago. I could find lots out about hacking avionics systems,
68240	73700	IFE and all about their weaknesses, but very little about the AISD.
74300	79620	So, that's the reason, the main reason for the talk today is to try and improve knowledge and
79620	85640	awareness of this part of the aircraft and generate the healthy discussion about security
86060	94880	within. So, logically, the AISD sits in between the Aircraft Control Domain and the Passenger
94880	100460	Information and Entertainment Systems Domain, both known as the ACD and the PIESD.
101280	107400	And essentially, what makes an aircraft, what's known as E-enabled.
107480	114100	And E-enabled means that it will integrate, the aircraft will integrate with the airline
114100	121340	IT systems to provide significant cost savings to the business. What it does is it allows remote
121340	127580	maintenance and uploading of software updates, which is a key time saver, especially when you
127580	134540	consider that previously, if you wanted to update the firmware on a module, you'd have to remove it,
134540	137760	send it away, in the meantime, put in a replacement,
138540	142400	then get the old unit back with the new firmware and swap it over.
144280	152440	So, being able to upload new software remotely without having to remove modules or LRUs,
153560	157080	is a considerable cost and time saving for an airline.
158320	166840	It also allows the airline to download logs, both operational logs and security.
167440	173960	So, for airlines, the AISD is the most important part to get right for the business. At least,
173960	180680	that's my view of it. An airline cannot have much influence on how the ACD is constructed.
180680	187100	Maybe a small amount of customization, but not very much at all. It's heavily regulated,
187100	194140	it's heavily dependent on certifications, which are long, expensive and time consuming.
194520	200060	So, the AISD is where the airline, the operator, really has to get it right.
201740	207680	But there's lots of challenges in doing that. There's, across all aviation, not just
207680	212500	enabled aircraft, there's a lot of older technology that gets reused.
212820	219400	And it's not really a surprise, because if it works and it meets the requirements, why change
219400	227120	it? Certifying new modules is expensive and time consuming as well. So, the older modules
227760	233140	that are still fit for purpose will be reused a lot, because it's cheaper to modify them
233140	241420	or to use the old ones. What this also means, though, is that when threats change over time,
241420	247040	these older modules can be attacked in new ways nobody thought about when they were conceived.
247260	255760	We're seeing this with avionics hardware today, but we are not really thinking about this when
255760	263120	it comes to the AISD, and maybe we should. When I say we have new risks to manage, what I mean is,
263140	271140	engineering now needs to consider cyber and infosec risks. Infosec teams now need to
271140	276020	understand and consider engineering. Traditionally, these are two areas of the business that have
276020	282280	been completely isolated. And it has allowed engineering to operate in its own little bubble,
283320	292440	which has led to engineering not following infosec policy 100%. And you see examples of bad
292440	297640	practice, such as post-it notes with passwords, or even passwords being written into procedure
297640	302820	documentation, because it's easier to operate that way when you're an engineer than it is to
302820	310660	use a password manager or to remember the password off by heart. At the same time, IT and infosec
310660	315440	are implementing systems for engineers to use without fully understanding the constraints of
315440	321780	engineering. They don't always have really good 3G connection on board an aircraft. They don't
321780	331340	always have time to be able to learn new systems in depth. What they do have is very
332240	339840	pressured time constraints in order to get aircraft back on the line, because all the time spent
339840	349620	being fixed is money. But when IT comes along and comes along and implements a new IT system,
349620	355020	say for example they don't have single sign-on, all of a sudden that engineer, instead of 20
355020	359340	passwords to remember, they now have 21. And then we ask the question, why are they writing down
359340	366580	passwords? So understanding the constraints and the difficulty of engineering can go a long way
366580	374050	to improving the security posture of an airline. And operators really need to get these departments
374050	381070	working together in harmony. When dealing with engineering and e-operations, you cannot bring
381070	385790	the corporate information or cyber security mentality and templates to the party. They just
385790	391370	won't work. You're dealing with an area of the business which historically has not been great
391370	398190	with cyber. So you have to go slow. One thing that's on your side though, as an InfoSec person,
398190	403930	is that aircraft engineers love processes and procedures. Oh boy, do they love it.
404750	409010	Before you can even touch an aircraft on the ground, you must have a job card which outlines
409010	417830	the steps engineers must take for each task. So if you can bring influence to these procedures
417830	426510	to improve security, that's half the battle won. And then finally, I should probably explain that
426510	431790	last comment on the slide. This is my humble opinion and I know many would disagree,
432270	437990	but I feel that when looking at aviation security, hackers should not focus entirely on avionics.
439010	445450	Although the ACV and the avionics have a number of well-documented and technical weaknesses,
445450	453310	it does have a very effective physical security model. You can only access the avionics bay from
453310	458390	outside the aircraft. So when the aircraft is in flight, not even the pilots can get to it.
458450	464610	So only the engineers on the ground can do that. And if you're going to try to get access airside
464610	470330	for legitimate reasons, you know how difficult it would be to get airside for illegitimate reasons.
474490	481870	Also, there's usually only one network interface between the ACV and the AISD, and I'm talking
481870	488230	about aircraft that are fully compliant with ARINC 821 here. But this separation is normally
488230	495150	implemented with protections such as a firewall or even a data diode. And sometimes we also
495150	503090	base that network communication on proprietary protocols, not on TCPIP. So if you can get into
503090	507610	the ACV, yes, you can inflict a lot of damage, but gaining that access either through physical
507610	514710	or technological means would be extremely difficult. And if you can go to that level,
515230	521030	if you can get physical access to an aircraft, why go hacking? You know, you can do something
521030	528850	much more nefarious with a much greater guarantee of success if that's what you wanted to do.
529830	535490	So for me, instead, the aircraft information systems domain has multiple touch points ranging
535990	543810	from the airline network, Wi-Fi, even the internet and the cabin. And these attack scenarios are much
543810	548970	more traditional and realistic for hacking. Okay, it's not sexy. You can't control the
551290	556300	aircraft control services from the AISD. You can have other effects on the aircraft,
557130	562250	effects which may impact operations. And if you know what you were doing,
562250	569920	you could modify some of the data presented to pilots. So
573000	578960	manufacturer challenges. So I explained the challenge about technical debt. And the reason
578960	590700	for that is that airworthiness timescales are huge. And they encourage, or they almost force
592100	596940	manufacturers to really think about what they're going to reuse and what they have to rebuild from
596940	602120	scratch. Because those brand new modules are really expensive to get certified.
603560	611000	Challenges from the operator are very different and in many ways are quite significant.
612300	619020	The key one is they have zero visibility of the manufacturer's risk assessment. So when
619020	625820	the manufacturer is designing and building an aircraft, they perform extensive and detailed
626350	629610	risk assessments to mitigate system vulnerabilities.
632180	638420	They will mitigate many of these issues themselves, but they will also transfer some
638420	646020	to the operators. And this is communicated in a number of ways, such as security handbooks or
646020	652720	ANSOGs, depending on which manufacturer you're dealing with. But no operator will get to see
652720	660680	details of the original vulnerability or the risk assessment. So despite the quality of this
660680	666500	manufacturer guidance, these recommendations which come down, there's no real mechanism
666500	673340	for the operator to assess the effectiveness of implemented controls. And this can,
673340	678540	and from what I've seen, probably does lead to gaps in the cybersecurity protections
678540	682240	of e-enabled aircraft at the operator level.
684340	691580	When you think about it, airlines are heavily reliant on legacy IT systems. For example,
691580	698520	many use at the core of their business, a TPF system, which handles all of the real-time
698520	704500	transactions. It's not a traditional operating system. It is based on technology that was
704500	714360	released in 1979. To program it, it's done in hexadecimal. It's just not what we would,
714360	719960	people of my generation, would consider a traditional operating system. But it handles
719960	726740	transaction messages one-to-one at an extremely high volume and extremely high speed.
727320	732180	And what that does is make sure that the same seat isn't booked twice by separate transactions
732180	737940	milliseconds apart. And there's nothing out there on the market that can really
737940	747620	replicate that right now. Also, airlines, over time, have grown and have added new systems
747620	754900	on top of the old systems. And until quite recently, this may have been done without
754900	760100	consideration of all the risks. In fact, some of them would have been done before cybersecurity
760100	769140	was really a thing. So some may not have followed good practice, such as network segregation.
771560	776780	Airlines also operate 24-7. And that means that outages are very costly.
778200	785740	When an airline IT system goes down, aircraft stop. They just cannot take off because they
785740	789360	haven't got the information for the pre-flight.
791060	796020	So any introduction of a new system that could have an impact on operations is
799200	804420	risk managed to the nth degree. And there's a lot of risk avoidance going on when these new
804420	810300	systems are put in place. Either that, or you just throw resources at it to make sure that
810300	813700	if something does go wrong when you introduce a new system,
813700	817160	that the impacts are mitigated as much as possible.
818700	824700	What it does mean is that over time, airlines can become quite flat in their networks. And
824700	829580	what that means is if the perimeter is at a breach, it's very easy for an attacker to then pivot
830540	839880	inside the networks. So where regulators fit in. So speaking from a European perspective,
840760	847740	there's some really positive steps going on right now in the critical national infrastructure
847740	855440	sphere of which aviation forms a part. And maturity in cyber security, aviation cyber
855440	861320	security is growing slowly and gathering momentum. Or at least it was before COVID.
861320	868360	It was the last time I was really involved. From what I've seen, the UK CAA is growing the
869320	874920	cyber oversight function in a very positive way. And rather than just setting out a framework
874920	880980	and directing airlines to comply, they are working closely with operators instead,
880980	885980	guiding them and helping them through their assure process, which is really good to see.
885980	894780	So going back to this gap in the risk assessment, could the regulator help bridge that gap?
895340	899660	The issue is sharing the risk assessments with operators as they are highly sensitive.
900460	906500	Maybe some trusted government bodies could be given more details on the risks and help guide
906500	911540	operators on the effectiveness of their controls without passing on that sensitive detail.
912460	918420	If we can't trust the government, what about the aviation ISAC? Although they are a member
918420	924320	organization, most of the large operators and manufacturers are members. Could this be another
924320	931420	suitable mechanism to do the same thing? Whatever happens, I feel something does need to be done.
931420	941410	Otherwise, pardon the pun, airlines could be flying blind. So here is a rather simplified
941410	950720	overview of a E-enabled aircraft. This diagram is based on compliance to the ARIC-821 protocol.
951670	955500	And as you can see, we've got the three main domains,
955500	960260	the aircraft control domain, the aircraft information systems domain,
960260	963360	and the passenger information and entertainment systems domain.
964720	971940	The AISD, as well as being a main communications hub or hosting a main communications hub,
971940	977820	will host the electronic flight bag if it's a class two. If it's a class two, the EFB will sit
977820	984560	in the avionics. More on that later. Some aircraft have their flight standard panel, or FAP,
984560	992560	connected in the AISD. And there's also occasionally printers, maintenance terminals,
993360	999680	which can be USB or Ethernet port, depending on what kind of device you're using, if you're using
999680	1007800	just a straight up USB as a tool, or if you're using a portable data loader. And those maintenance
1007800	1013680	ports are used as a backup for the IPSET panels that sit between the aircraft and the ground
1013680	1024520	system. So these IPSET tunnels are really well... the security is excellent. So they are managed
1025040	1030840	from mostly on board, but the ground systems are involved in the keying of the aircraft.
1031560	1042560	And there's... I'll talk a bit more about PKI later on. What we do have is the EFBs,
1042560	1049540	if they are connected to the AISD, they will often route traffic to the internet through
1049540	1059380	the IPSET panel, through the DMZ and out into the internet, which is usually for software updates,
1059380	1064620	and it's usually a very restricted set of websites where the EFBs can go.
1065480	1069600	That is usually done on the ground as well, because if you imagine, if this is happening
1069600	1074800	during the flight phase, you have the latency of the SATCOM connection down to the ground
1074800	1083940	systems through the DMZ and out to the internet. So the response time on that in flight would be
1084640	1093380	pretty long, but on the ground it's manageable. One thing to note as well is sometimes in
1093380	1101580	enabled aircraft, instead of having a SATCOM in the AISD, there is an option whereby the
1101580	1110180	manufacturer offers the operator the ability to use the passenger SATCOM connection. Remember,
1110180	1115280	this SATCOM connection, the passenger name, does not go through this IPSET panel here,
1115280	1119540	it goes off through the service provider's network.
1120840	1128240	And one option that some manufacturers are offering to operators is that the
1130180	1137520	information system domain here can connect to the ground systems, but through the same SATCOM here,
1137520	1144260	and that is quite advantageous in terms of cost. The more you use SATCOM, the cheaper it is.
1144260	1150440	So if you have two connections, that's going to cost you quite a bit of money. If you have one,
1150440	1155480	yes, you're going to be paying for more data, but because prices come down with volume,
1155480	1163100	you'll actually pay less overall. What I have seen though is quite promising that when this
1163100	1171000	is implemented, the connection from the AISD into the SATCOM is through a separate VLAN.
1171000	1177000	So essentially that's a mini network segregation on its own there, and that data is not accessible
1177000	1186010	from the IFE or the cabin Wi-Fi. So moving on to my favorite subjects, electronic flight bags.
1186630	1192410	So these have been a revolution for pilots. As the name suggests, they replaced the large and
1192410	1200670	cumbersome and often heavy bags which were used by pilots to carry paper-based manuals.
1201750	1209910	These bags would often weigh more than 25 kilos, and as well as being difficult to maneuver,
1209910	1216690	they also contributed to physical injuries of pilots as well. Moving those bags around the cabin,
1216690	1222710	around the cabin, around the cockpit, sometimes led to shoulder injuries because of their weight.
1224690	1228910	Depending on the type of EFB, they can perform a variety of functions,
1228910	1237710	including a documentation reference library. A type B can perform what's known as performance
1237710	1244170	calculations. These give V1, VR, V2 speeds, all that kind of stuff. These are important for pilots
1244170	1252190	to know. Enroute navigation, if you have a GNSS feed into the EFB. And if you have the relevant
1252190	1258070	connections, access to NOTAMs, weather information, and the ability to do fuel calculations as well.
1258990	1265310	Some operators also include bespoke applications that sit on the EFB, and these might be used to
1265310	1272430	complement airline operation systems, so long as they reach the relevant approvals. But they will
1272430	1281350	also help achieve the overall goal of EFBs, which is not just a reduction of paper inside the cockpit,
1281350	1286870	but also faster access to information, which helps lower turnaround times and reduce workload
1286870	1294510	in the cockpit. And non-pilots may not understand the importance of that last part.
1294570	1300810	Many incidents of pilot error cite cockpit workload as either the main or as a contributing
1300810	1307970	factor. So this makes EFBs not just an effective tool in reducing costs, but they also help you
1307970	1316090	fly safely. Hardware categories have different names, depending on which regulator you sit under
1316090	1323430	and how long you've been in the business. They're often used together, so I've included both here
1323430	1330650	as some general characteristics. So a Class 1 or portable EFBs, they're often small devices
1331510	1339790	and double up as corporate devices at the same time. Think of a small EFB, a small iPad with
1339790	1345170	no connectivity to the aircraft. They're then considered like a paired personal electronic
1345170	1353370	device and as such they must be stowed to take off, taxi and land. Class 2, these can be
1353370	1362630	pilots or plane attached EFBs. These connect to the AISD with usually a one-way feed of data from
1362630	1369450	the avionics. They can be integrated with the cockpit displays and their build is the responsibility
1369450	1376850	of the operator. Quite often they are small laptops with operating systems such as Windows
1377450	1382510	and then the manufacturer will provide the software which runs on top of that
1382510	1390150	and connects the systems on board the AISD. It's worth mentioning that Class 2 EFBs have
1390150	1395710	very different threat profiles depending on whether they are plane or pilot attached.
1396630	1401590	So while plane attached EFBs are considered part of the minimum equipment list or NEL
1402190	1407350	and tracked as an aircraft part, they're always under the control of the airline with coordinated
1407350	1414870	and tracked movements between locations. Pilot attached EFBs are not. They enter and exit the
1414870	1420090	cockpit when the pilot enters or leaves the aircraft. They are very likely to connect to
1420090	1427030	all sorts of networks in hotels, cafes and airports so that the pilot can update software,
1427030	1431970	navigation databases, notams, read corporate emails or even surf the internet.
1434150	1442510	So you can see how the plane attached EFB has a very different threat matrix to that of a
1442510	1447490	pilot attached one who may be anywhere in the world using insecure Wi-Fi.
1450060	1458760	And then finally, I've included Class 3 for completeness because Class 3 don't really form
1458760	1464360	part of the AISD, but they are an EFB. So they are integrated into the aircraft control domain
1464920	1472000	and they have no connectivity outside of that. The build is the responsibility of the manufacturer,
1472000	1475480	but it is maintained by the operator. And what I mean by that is
1475480	1481280	that the hardware is fixed. The hardware cannot be changed. There may be software updates over
1481280	1486780	time, but these are provided to the operator who then have the responsibility of maintaining
1486780	1494660	the vibration. Class 3 EFBs are certified as part of the avionics. So the operator has next to no
1494660	1499640	ability to make changes unless they wish to go through the trouble and expense of recertifying.
1499640	1506600	And even though EFBs, Class 3 EFBs sit in the AISD, the ones I've seen are logically separated
1506600	1511480	from the core avionics. And you have to interface through many different modules before you can
1511480	1518840	bridge a gap between the control surfaces and the EFB. So attacking a Class 3 EFB to affect
1518840	1523120	an aircraft in flight is still not that straightforward.
1525340	1531000	Software categories. So Type A, really simple. They're just used for the storage and display
1531000	1536920	of documents only. And like I said, these are typically Class 1. Class is PEDs and they get
1536920	1544720	put away during the critical phases of flight. Type B applications, this is where it starts
1544720	1553100	getting more fun. So like I said, they can perform performance calculations and they may actually
1553100	1560400	access the internet on the ground and in flight. And they may be able to receive one-way data
1560400	1565540	from the avionics. They are also the most common EFB software type I have seen.
1567180	1574620	It's worth mentioning that Class 1 and Class 2 EFBs are built by the operator. And as such,
1574620	1579700	they are not the responsibility of the manufacturer. Even though they may provide
1579700	1585480	some or all of the software that runs on the device, it is up to the operator to ensure that
1585480	1591780	they are working securely. For EFBs running Type B software, this is where things can get a bit
1591780	1597980	blurred. According to regulations, any vulnerabilities in the software that could affect
1597980	1604100	the operation of EFB software, regardless of who coded it, is the responsibility of the operator
1604100	1610860	to mitigate. At the same time, details of any vulnerabilities do not seem to be passed on to
1610860	1618320	the operator, just a series of recommendations for EFB security. Now these recommendations are
1618320	1628000	really good, but as we'll come on to later, I don't feel they go far enough. Type C applications can affect
1628000	1634880	the control of the aircraft in flight. So this is the really juicy part. Essentially, they can send
1634880	1644780	data to the avionics. However, at the moment of going to press with this presentation, there are
1644780	1651180	no current approvals that exist for Type C applications that I am aware of. I have seen
1651180	1659060	future offerings from some manufacturers about having a bi-directional connection between the EFB
1659060	1665600	and the flight management system which sits in the avionics. However, I have not enough detail there
1665600	1676590	to give you the information about it. As I touched on on a previous slide, regulators provide operators
1676590	1683570	with cyber security recommendations. Recommendations are also given by the manufacturers, but I feel
1683570	1690470	that even when you combine these two sources, this advice does not go far enough. By that, I mean that
1690470	1696530	there is a lack of detail in what to consider and measures to take. When it comes to regulatory
1696530	1701610	documentation, security appears to be the poor cousin, with the majority of the document dedicated
1701610	1709050	for physical characteristics and user interface design. The wording is also quite willowy and
1709050	1713850	lacking in detail. It is certainly an area where I think there is a lot of room for improvement.
1716840	1723340	Also, because implementing EFB security is the responsibility of the operator, some manufacturers
1723880	1729700	appear to use this as a green light for poor implementations of technology, which on their own
1729700	1736800	would be considered zero security by design. Instead, the security is designed to be assured
1736800	1741360	by the inherent assumption that the operator's networks will never be compromised,
1741360	1748080	or that malware will never find its way onto an EFB. Kind of like passing the security hot potato.
1750080	1756320	At the same time, operators are not directly informed of any vulnerabilities, instead given
1756480	1763680	a set of recommendations to implement. Unless the operator discovers any weaknesses, they would be
1763680	1771380	unaware of the risks involved. And if they were aware of the risks, I'm more than certain that
1771380	1782630	they would have targeted controls to them based on what they knew. Overall though,
1783290	1790870	the recommendations given by some manufacturers are pretty good, although I feel there could be
1790870	1796910	more detail in certain areas. I would like to share the document names and references with you.
1796910	1803250	However, I am heavily constrained by NDA, as well as manufacturer efforts to protect IP. So I'm not
1803250	1809110	allowed to give you these names, even though doing so would be for the benefit of any operators
1809110	1818960	watching. And I cannot move on without briefly talking about class three or integrated EFBs.
1818960	1825740	And even though they don't form part of the AISD, there are some use cases here which
1825740	1832900	highlight a really important issue when it comes to technical debt.
1833600	1838600	So like I said before, the hardware is fixed and the software updates come from the manufacturer.
1838760	1845360	So to an operator, it may seem a very attractive prospect in terms of time and cost to get an EFB
1845360	1853000	running. However, this category of EFB is not without its issues. And an example is an aircraft
1853000	1860820	which I love, which is the Dreamliner. Having flown it many, many times, albeit not that long
1860820	1866220	ago, I only started flying it about three years ago, I actually adore this aircraft. It is great
1866220	1874260	to fly on as a passenger. But many Dreamliners have, especially the ones that first were
1875360	1882300	brought to market, have Windows XP operating system integrated in the EFB which sits in the
1882300	1888920	avionics. And this is a fact which gets a lot of surprise look from InterSec and IT professionals.
1889480	1900760	But hang on. Remember, the 787 was designed in 2002-2003. Back then XP was king and would be for
1900760	1906960	many years to come. The type approval and first flight for this aircraft was in 2009.
1907880	1915180	Vista was available, but come on, Vista? Who would have changed? So when that aircraft was first
1915180	1923160	went to market, it was delivered with EFP-EP4, developed using Windows XP.
1924740	1931380	EP5 is available now, which uses Windows 10. However, not only do the upgrades come with a
1931380	1938180	huge cost in terms of the units, but also a huge cost in terms of downtime and recertification of
1938180	1945990	the avionics because it's a hardware change as well as a software change. So this kind of explains
1945990	1955630	the issue of technical debt using more modern examples. Of course, we all think that an EFP
1955630	1964190	on board a brand new modern state-of-the-art aircraft should be the most recent stable version
1964190	1969410	of an operating system. But even in the timelines that we're talking about here, which are very
1969410	1978290	small, we're seeing out-of-date operating systems being used in critical systems because of these
1978290	1984630	timelines. And this issue is not limited to one manufacturer. I just brought up Boeing because of
1984630	1992750	the knowledge I have of the BP-4, BP-5 versions and the operating systems. And it's not even
1992750	1998010	limited to EFBs. It is all across the aircraft. I just wanted to discuss the technology trap. So
1998010	2003890	those who may not fully understand why we see old tech in these brand new modern state-of-the-art
2003890	2012910	aircraft. But it is interesting to think that the first Boeing 787s still have 20 years of life
2012910	2020810	left in them or more. And when they come to end of life, will they still be running BP-4 with XP?
2020810	2028410	I think some will. And we'll see. If Ken is still... Ken from Pentest Partners is still
2028410	2035290	climbing around aircraft in breakers yards in 2040, then he may come across Windows XP
2035290	2042050	inside the avionics, which will be a really, really cool thing to see him play with.
2043830	2048610	But if you haven't seen their videos, they have some great walkthrough talkthroughs on 747s,
2048610	2052970	which are going through the scrapyard today. And they also have older videos on their blog
2053490	2061330	about dismantling old IFE systems a couple of years ago, which have 386 hardware inside them.
2061370	2064510	And these are aircraft that were only dismantled a few years ago.
2066210	2070950	So remember I said that in-air aircraft are flying data centers with half of it on the ground?
2070950	2077470	Well, this is the other half. Ground systems. And they're used for keying and re-keying the PKI
2077470	2083670	on the aircraft. They're used, like I said, for the key thing is the uploading of LSAPs and FLS
2084160	2091050	to upgrade software modules on board the aircraft. A major, major time saver. But they also use for
2091050	2098330	configuration changes, downloading of logs, and as a conduit for ESP connections. And this is done
2098330	2105190	with some software provided by the manufacturer in a client-server relationship. The idea is that the
2105190	2110990	operator would implement a Windows server, which runs the server software, and then the client
2110990	2119980	would be installed on the engineer's laptop. The PKI on board the enabled aircraft is typically
2119980	2125800	used to protect the VPN connection between the aircraft and the ground systems. It is also used
2125800	2132020	to digitally sign the software that gets uploaded. So integrity checks can be done before it is
2132020	2139040	installed in the aircraft. And this is one area that manufacturers seem to have gotten right with
2139040	2143280	the latest enabled aircraft. At least the two main manufacturers in the world.
2144300	2149400	While I do not have a PhD in cryptography, or anything higher than a BSc in any subject for
2149400	2154820	that matter, the PKI implementations I have seen are simply excellent. And that shows the
2154820	2163890	manufacturers are learning from previous issues. And that's great to see. As well as EFBs, I think
2163890	2169330	ground systems require special consideration when it comes to security control implementation.
2171010	2176610	The E-enabled aircraft being sold on the market today are truly excellent. Whether you're a pilot
2176610	2181290	or a passenger, they are fantastic creations and a true credit to the teams involved in their
2181290	2187310	development and manufacture. However, the same cannot be said of some of the supporting software.
2188090	2193090	Some of the software distributed with modern aircraft is quite old, and they were likely
2193090	2197230	coded at a time when there was very little consideration given to secure DevOps, or even
2197870	2204910	cybersecurity at all. It seems that the approach back then was, so long as it works, it's fine.
2206090	2214770	And that has led to some very insecure software being used with modern day aircraft.
2215650	2220970	However, I'm seeing positive movements in this area. There are new versions of EFB and ground
2220970	2225950	system software being developed today, which should be available in a few years' time,
2225950	2230990	and that is going through what appears to be a sensible and secure approach to software development.
2231350	2234990	So time will tell what comes out from that, but again, it's another positive move.
2237720	2242620	As with EFB software, how many operators have looked at the ground system software
2243620	2249760	from an attacker's perspective? Have they looked for weaknesses? Have they found any,
2249760	2254500	and then combined this with the threat model and overlaid on the existing network architecture?
2254940	2262920	Remember, like I said, a lot of airline networks have any, if at all, any segregation. So
2263520	2269140	if the corporate network was compromised, could someone pivot into the ground systems and put
2269140	2277240	your aircraft at risk? Also, conversely, could this software, at any weaknesses you identify,
2278400	2285020	introduce new attack vectors or vulnerabilities in your systems, which could then be used
2285020	2290940	to pivot into the corporate network? These are things that operators really need to consider and look at.
2292520	2297900	Now, I have seen some manufacturers and third parties offer ground systems,
2298180	2304540	a ground system service hosted in the cloud. And now, while I understand moving to the cloud is not
2304540	2308940	the silver side of the bullet for any organization, although some seem to think it is,
2308940	2314300	from my experience, these cloud solutions are normally put together very well from a security
2314300	2321440	perspective. They also permit creative design in methods to mitigate weaknesses in the software.
2321920	2328380	So, for example, if you had issues with the client software that would sit on the
2329560	2336020	engineer's laptop, and you didn't want that interaction with the server going across the
2336020	2342600	network, then what you could look at is putting both the server and the clients in separate
2342600	2349620	lockdown enclaves inside a cloud solution, then implement a VDI to host the client's interface
2349620	2356200	through a secure HTML5 web front end. And that gives you lots of opportunities to customize the
2356200	2362680	security according to your threats and risks, and all sorts of other opportunities as well.
2362980	2369480	So, these are certainly ideas that we're looking at, because the software that's available today
2369480	2374960	doesn't seem to be that good, but some of the cloud's offerings are.
2378540	2385300	Flight attendant panels. So, these are interesting from a cyber perspective. So,
2385300	2391520	anyone that deals with industrial control systems will know that these are essentially
2391520	2398000	what's known as a HMI, a human-machine interface. And these are used for lighting, air control,
2398000	2403760	announcements, door status, lighting, emergency buttons, and they might also have bespoke
2403760	2409580	features that the airline will implement. They can also be used for maintenance and
2410860	2422430	for uploading FLS, LSAPs, and for downloading logs if the maintenance port is unavailable.
2424110	2433480	So, why do FAPs have a security focus? Well, like any HMI, especially those ICS implementations,
2433480	2438340	they're typically an easy target, especially those with a USB port.
2440820	2446500	I did some research on FAPs, and while some are directly connected to both the AISD
2446500	2451220	and the PIESD in e-enabled aircraft, there are none which have a connection
2452140	2460520	to the ACD or avionics anymore. Not that I can see anyway. That said, I did raise concern
2460520	2466000	about the possibility of a passenger inserting a USB stick loaded with malware
2466600	2470440	into the FAP USB port, and what that would mean.
2472160	2476900	So, the team I was in started asking the manufacturer some very probing questions,
2476900	2481520	and to their credit, the manufacturer provided a highly detailed and impressive response,
2481520	2486740	and it was actually done in person due to the sensitivity of the content. But what they showed
2486740	2492900	us were that the technical controls to protect the ACD from the FAP were very robust. However,
2492900	2498380	when asked the further questions, it seemed that the AISD was considered almost expendable
2498380	2504400	in the malware onboard scenario. When asked about that, the response was that the AISD
2505240	2510780	can be entirely functioning and it will not affect the airworthiness, which can be interpreted as
2510780	2515700	the AISD can be riddled with malware, and the aircraft can still be operated legally.
2516800	2523780	Fine, I thought. However, that got me thinking to the operational side, and I wondered how many
2523780	2528960	pilots, knowing that an aircraft is infected with malware, yet still legal to fly, would actually
2528960	2535280	fly it. What if, as an attacker, my goal was not to take control of the aircraft, but to affect
2535280	2545140	the operations of an airline as a coordinated extortion or blackmail attack? Now, everyone in
2545140	2555320	industry knows, regardless of the airline, that this USB port is off-limits, even to crew. Yet,
2555320	2560080	I have spoken to Cabot crew from multiple airlines, and they have confirmed that they are told this
2560080	2566140	in training. However, everyone in the industry also knows that this port is used extensively
2566710	2571800	to charge crew devices, both official and personal, in spite of the rules.
2572360	2577480	I have also seen passenger devices being charged in the FAP as the USB port in their seat wasn't
2577480	2582320	working, and it was actually the crew who had done this as a courtesy to the passenger.
2583660	2589200	So, what is clear from this is that, while people know there is a risk,
2589200	2593480	it is clear the awareness training isn't working. Not all the time, anyway.
2596620	2602880	I thought it important to also include some detail on some of the more general issues I have found,
2602880	2609760	and I must state again, I am heavily bound by NDA, but I have reached out for advice
2609760	2615440	and agreed parameters of what I can divulge here prior to this talk.
2617160	2624040	So, one team I was in had been working on the security design of their ESDs,
2624040	2628900	and we had planned project milestones to ensure that build documentation was accurate,
2628900	2635220	and the device was built according to design. A lot of work had gone into locking the operating
2635220	2640840	system down. It was Windows-based, and this is where I had a lot of extensive experience
2640840	2646460	and knowledge. So, this is where I focused my attention. I knew that we had a pen tester who
2646460	2650420	was going to look at it from the perspective of an ass hacker, and oversee my work,
2650420	2655500	so I left the software alone. This is the manufacturer-provided software.
2656060	2664500	I had naively assumed that this software would be fine, or at least not too bad.
2666300	2671220	When it came to the pen test, I knew the build was solid, so I was surprised when on day two
2671220	2678560	of the test, day two of the five-day test, Andrew, the pen tester, called. Now, anyone that deals with
2678560	2683620	pen tests know that if they call you prior to the planned end date and it isn't a question,
2683620	2690760	then it's bad juju. Andrew had not only found an API that was completely unprotected,
2690760	2695820	there was no authentication, there was no encryption, but had written some code,
2695820	2703140	but also written some code to exploit it. I was quite shocked, so I sent a message to the
2703140	2708140	manufacturer straight away, and received a response that this was not a vulnerability,
2708140	2717970	but in fact a feature. All I can say is that when I repeated this response to my colleagues,
2717970	2724330	jaws across the room dropped to the floor. I took a step back and realized that in order to make
2724330	2729090	the manufacturer understand, I had to do more analysis. Now, back when I was in the British
2729090	2735010	army, I was taught to analyze attack scenarios by asking, so what, until you reach the answer.
2735410	2739150	So I took the same approach with Andrew's code and turned the dial to 11.
2740610	2743830	I found every single parameter I could.
2744750	2751270	At the end, it would not have taken much to turn that resulting code into a very feasible malware
2751270	2758610	for EFBs. I spoke with flight operations, pilots, and InfoSec, and demonstrated the rather trivial
2758610	2769500	attack. Everyone I spoke to agreed that this was bad. So, despite this feedback, which included a
2769500	2775560	dossier of potential outcomes which I had compiled from pilots and operations feedback,
2775560	2780860	the only action taken by the manufacturer was to reduce the attack surface.
2781920	2786880	They replied, in their opinion, the scenarios I had described were not feasible,
2786880	2792680	and the whole vulnerability was dismissed. Now, it wasn't like I was proposing aliens would come
2792680	2798680	down and attack planet Earth, although 2020 isn't over yet. One threat which they dismissed as
2798680	2805960	unrealistic was the insider threat. Now, I found that really strange because this threat was on
2805960	2810580	the operator's risk register, and I had been asked specifically to consider this threat
2810580	2815280	when giving my updates to high-level security boards.
2818440	2825440	Consequently, sometime later, however, I was informed that the software in question was
2825440	2831520	going through a complete lifecycle upgrade, and that the project would include not just a secure
2831520	2837920	DevOps approach, but security milestones with qualifiers as well. Now, I cannot take full credit
2837920	2844560	for that change because I know that somebody had moved into a new role covering the security of
2844560	2851440	such software, which means that they had already knew that there were issues, and that they were
2851440	2859020	moving to close the gap when I had spoken about this issue with the API. And I know this person
2859020	2862640	from my dealings with the manufacturer, and I'm very confident he will do good work.
2866130	2870570	Further investigations I've made on other aircraft have uncovered examples of the same
2871390	2878690	unprotected API. Different APIs, but unprotected all the same. And these are inside the AISD,
2879750	2884710	so they are accessible from the EFB, they're accessible from other systems on board.
2885490	2889690	And despite going through the responsible disclosure route as an independent researcher,
2889690	2895230	I was not only dismissed for making unrealistic assumptions, but I had to fight for updates.
2896330	2901390	Now, the assumption I made was based on a proposed commercial offering from the manufacturer,
2901390	2905410	coupled with their own API documentation, detailing how it would work.
2906990	2912770	Yet it was still considered unrealistic. Now, they may have made a separate assessment themselves,
2912770	2918230	and started going down a different, more secure pathway for the release of this new functionality,
2918230	2923390	which would be great. But I was not made privy to the details, so I have to say that for now,
2923390	2927910	I don't know. If I do find out more, I will certainly update you.
2929910	2935190	So hopefully that has given you a sufficient introduction into a network domain that is often
2935190	2940630	overlooked by security researchers, but which has a lot of juicy issues that need to be addressed.
2941030	2946590	Like I said, attacks on the avionics are really interesting, but getting access to them to
2946590	2953270	exploit vulnerabilities is pretty difficult. While the AISD may not be as sexy or interesting
2953270	2957130	on the surface, when you scratch a bit deeper, there's a lot to decipher.
2958890	2962410	Touchpoints, while still quite difficult to exploit, are more accessible,
2963050	2967830	considered more traditional to an attacker. And this means everyone from cabin crew,
2967830	2972270	to engineers, flight ops, and infrasec, all have an important role to play
2972270	2975810	in securing e-enabled aircraft at the operator level.
2978430	2985810	Some advice I'd give to operators is, do not take the security of provided software for granted.
2986250	2989210	Now, so I'm not talking about FLS and LSAPs here, what I'm talking about
2989210	2995770	is the software that is provided to connect to your aircraft, so the EFBs, the ground systems, etc.
2997150	3001910	Even the most modern aircraft today have some very basic vulnerabilities in the code.
3002170	3007550	What is more worrying for me is that this software will achieve some kind of approval,
3007550	3015950	in spite of these weaknesses. So don't assume because they have approvals that they are 100%
3015950	3022450	secure. Make sure you perform some kind of assurance on software and systems, either
3022450	3027630	using your internal teams, or if you don't have the skills in-house, hire an external
3028190	3034230	expert or pen tester. It may be costly, but having an aircraft AOG for several weeks while you
3034230	3041070	investigate a cyber attack, and have to replace all the onboard FLS or LSAPs, could probably cost
3041070	3048870	you a lot more. Security in the operations is not the realm of one department alone.
3049350	3053690	The multiple business areas that make up the operations require that InfoSec understand
3053690	3059790	aviation and what cyber risks actually mean to aircraft. InfoSec also need to make sure
3059790	3067110	that engineers and other business areas understand the risk context. It is a two-way street.
3067610	3071530	I've seen that some operators have implemented a multi-discipline groupings,
3071530	3077130	which handle these challenges. They're often called a cyber computer cell, which is a really
3077130	3086030	cool name to have on your CV, just a little hint there. So these groupings often have at least
3086030	3091330	one board member, and they combine knowledge and experience from multiple departments,
3091330	3094950	and they ensure that issues are tackled in the best possible way for the business.
3095210	3098790	From what I hear, they are extremely effective, and I would certainly recommend
3098790	3102610	that you, if you don't have one already implemented in your business,
3102610	3105450	and you operate a unit of aircraft, that you certainly look into it.
3106910	3110790	And I suppose it finally goes without saying that you must involve your regulators as much as you
3110790	3117410	can. They have access to the right people, the information, and the frameworks, with the right
3117410	3123090	advice and the right guidance to guide you through difficult scenarios. So make sure you engage them
3123090	3127360	as much as you can. And if you don't get satisfactory results from your regulators,
3128870	3134410	sure, pop me a line. I can certainly help where I can. But finally, I'll sign off with a small
3134410	3140010	piece of advice for operators. If you have someone in your organization who is as effective and
3140010	3146210	competent an engineer as they are with InfoSec and cybersecurity, my advice would be to make
3146210	3151530	sure that person never leaves your business. I'm not an engineer. I was lucky I had access to
3152170	3160290	excellent engineers who were able to communicate to me exactly what the problems were,
3160290	3167410	and to better understand systems so I could evaluate the risk. At the same time, these
3167410	3173090	engineers were... they have a high level of intelligence engineers, so they could understand
3173090	3177250	what I was telling them. And together we worked really well. But if you can incorporate that into
3177250	3185030	one person, that's a very valuable asset indeed. So that's the end of your presentation. Hopefully
3185030	3191170	that's enough information to whet your appetites in the AISD. There is a lot more there. I have to
3191170	3197410	cram it into 50 minutes. So I will be available for questions in a session in the Discord channel
3197410	3202450	from where you linked to this presentation. Please head over there and join in the discussion.
3202750	3207970	Alternatively, you can grab me on Twitter or my website. There's an email link you can get on me.
3207970	3211610	And I hope to speak to you all soon. Take care.