1. COPYRIGHT © 2015 THE BOEING COMPANY ARINC 820 Security Derek Schatz, CISSP Boeing Commercial Airplanes Presented at ARINC CSS Meeting in Sevilla October 28, 2015

2. COPYRIGHT © 2015 THE BOEING COMPANY Approach Security input to A820 based on early strawman version of doc Very preliminary inputs based on initial understanding of functionality and some security best practices Future revisions of security guidance may justify a fuller analysis based on ARINC 811

3. COPYRIGHT © 2015 THE BOEING COMPANY Understanding of WIU Role(s) Part of Wireless Distribution System, interface unit for CWAPs Media server for streaming to pax devices Level E system

4. COPYRIGHT © 2015 THE BOEING COMPANY Potential Risks The WIU will be directly exposed to passengers via the CWAPs. Lack of CWAP authentication makes attack attribution difficult. Content providers (e.g. movie studios) will require that content stored on the WIU in the (optional) Media Store be adequately protected against piracy.

5. COPYRIGHT © 2015 THE BOEING COMPANY Potential Risks, cont’d If payment information is collected for streaming content, the WIU may be subject to Payment Card Industry (PCI) requirements for protection of Personally Identifiable Information (PII), including credit card numbers. Airline and airframe manufacturers’ reputations for safe and secure aircraft would be damaged in the event of a breach of the WIU. Any exposed services accessible from the cabin can provide an additional attack path.

6. COPYRIGHT © 2015 THE BOEING COMPANY Potential Risks, cont’d Being likely based on COTS software components, the WIU web portal may provide a significant attack surface that will be challenging to keep up to date with the latest patches. Vulnerabilities in the web portal could allow defacement of the web pages, implanting of malware to infect passenger devices, implanting of malware to intercept passenger data, or uploading of alternate content such as pornography. The media load port in the cabin may provide a passenger-accessible attack path.

7. COPYRIGHT © 2015 THE BOEING COMPANY Potential Risks, cont’d An interface to the CSS to enable passenger control of reading lights and attendant call buttons could enable an attacker to activate these en masse in the cabin, causing distraction to the cabin crew. The interface to the IFES and/or BOSS provides a potential path for theft of offboard Internet access service. Any use of ARINC 429 interfaces other than ones implemented as ‘read-only’ may enable attack against airplane avionics systems.

8. COPYRIGHT © 2015 THE BOEING COMPANY Recommended Controls The WIU’s attack surface should be minimized, i.e. no management interfaces exposed, other ports and services closed off. The WIU should be able to generate security log events. Examples: –Authentication events –Data loads –Network IDs of connected devices –Firewall events –Record enough to enable reconstruction of attacks

9. COPYRIGHT © 2015 THE BOEING COMPANY Recommended Controls The Media Store file system should prevent uncontrolled access to media files. The Web Portal should not store any Personally Identifiable Information (PII) of users The WIU should reload a clean software image from firmware at each power-up. Firmware should only be writeable from the maintenance port while in maintenance mode.

10. COPYRIGHT © 2015 THE BOEING COMPANY Recommended Controls Media should only be loadable while the CWAP interfaces are down. The Web Portal should be protected by a web application firewall function that only passes whitelisted packet types. The Web Portal and Media Store should have a means of detecting the presence of non- whitelisted content in the filesystem.

11. COPYRIGHT © 2015 THE BOEING COMPANY Recommended Controls The Web Portal and Media Store should have a means of detecting and preventing streaming of unauthorized content. The WIU should detect and prevent improper commands being sent via the passenger service interface. The WIU should implement a stateful packet filter (firewall) function on the BOSS and IFES interfaces.