Skeptics Stack Exchange is a question and answer site for scientific skepticism. It only takes a minute to sign up.
Sign up to join this community
BBC reports (emphasis mine):
Planes including the Boeing 787 Dreamliner and the Airbus 350 and A380 have a single network that is used by both pilots to fly the plane and by passengers for their wi-fi connections.
Do these airlines actually use same network for both, or is it just some journalistic simplification without fully understanding technicalities?
The recent news reports are based primarily on a report from the US Government Accountability Office (GAO). See page 19:
According to cybersecurity experts we interviewed, Internet connectivity in the cabin should be considered a direct link between the aircraft and the outside world, which includes potential malicious actors. FAA officials and cybersecurity and aviation experts we spoke to said that increasingly passengers in the cabin can access the Internet via onboard wireless broadband systems. One cybersecurity expert noted that a virus or malware planted in websites visited by passengers could provide an opportunity for a malicious attacker to access the IP-connected onboard information system through their infected machines. According to five cybersecurity experts, the threat of malicious activity by trusted insiders also grows with the ease of access to avionics systems afforded by IP connectivity if proper controls, such as role-based access, are not in place.
The report doesn't get more specific about what types of attacks were analyzed.
This setup is supported by follow-up journalism by NPR and CNN.
However, in an interview with Forbes, Dr. Phil Polstra, a pilot and professor of digital forensics clarifies that despite this being the same physical network, he disagrees that this is a vulnerability:
This is a one-way communication. Even if someone were able to send information back toward the avionics, they aren’t listening for information from the in-flight entertainment systems… Since the computer doesn’t try and read information on those wires it is not likely to be useful to an attacker.
Stephen Cobb, from ESET, goes further and says that control systems are not even on the same physical network (from CBC):
Meanwhile, the flight control system, which transmits and receives signals from navigational aids such as satellites, is separated from passenger Wi-Fi through "air gapping," says ESET's Cobb.
[...]
That said, there is some confusion as to the extent to which the systems are air-gapped, says Cobb.
I find this source suspect, though, given that Cobb seems to be conflating the flight control system with the flight navigation system. Also, in the intervening paragraph, the article author considers an extra firewall a means of "air gapping", which isn't consistent with standard usage of that term. These two discrepancies make this source less reliable in my opinion.
Boeing has said that they are "employing a combination of solutions that involved some physical air-gapping of the networks as well as software firewalls" (Wired):
There are places where the networks are not touching, and there are places where they are
Regardless, even taking the GAO report at face value, whether this is the same "network" depends on what level of network you're considering. At the physical level, it appears that yes, some systems are on the same network. According to Polstra, this doesn't hold if you consider the "network" to be a higher level of abstraction.
