ARINC 820 Security Derek Schatz CISSP Boeing Commercial

Approach • Security input to A 820 based on early strawman version of doc • Very preliminary inputs based on initial understanding of functionality and some security best practices • Future revisions of security guidance may justify a fuller analysis based on ARINC 811 COPYRIGHT © 2015 THE BOEING COMPANY

Understanding of WIU Role(s) • Part of Wireless Distribution System, interface unit for CWAPs

Potential Risks • The WIU will be directly exposed to passengers via the CWAPs. • Lack of CWAP authentication makes attack attribution difficult. • Content providers (e. g. movie studios) will require that content stored on the WIU in the (optional) Media Store be adequately protected against piracy. COPYRIGHT © 2015 THE BOEING COMPANY

Potential Risks, cont’d • If payment information is collected for streaming content, the WIU may be subject to Payment Card Industry (PCI) requirements for protection of Personally Identifiable Information (PII), including credit card numbers. • Airline and airframe manufacturers’ reputations for safe and secure aircraft would be damaged in the event of a breach of the WIU. • Any exposed services accessible from the cabin can provide an additional attack path. COPYRIGHT © 2015 THE BOEING COMPANY

Potential Risks, cont’d • Being likely based on COTS software components, the WIU web portal may provide a significant attack surface that will be challenging to keep up to date with the latest patches. • Vulnerabilities in the web portal could allow defacement of the web pages, implanting of malware to infect passenger devices, implanting of malware to intercept passenger data, or uploading of alternate content such as pornography. • The media load port in the cabin may provide a passenger-accessible attack path. COPYRIGHT © 2015 THE BOEING COMPANY

Potential Risks, cont’d • An interface to the CSS to enable passenger control of reading lights and attendant call buttons could enable an attacker to activate these en masse in the cabin, causing distraction to the cabin crew. • The interface to the IFES and/or BOSS provides a potential path for theft of offboard Internet access service. • Any use of ARINC 429 interfaces other than ones implemented as ‘read-only’ may enable attack against airplane avionics systems. COPYRIGHT © 2015 THE BOEING COMPANY

Recommended Controls • The WIU’s attack surface should be minimized, i. e. no management interfaces exposed, other ports and services closed off. • The WIU should be able to generate security log events. Examples: – – – Authentication events Data loads Network IDs of connected devices Firewall events Record enough to enable reconstruction of attacks COPYRIGHT © 2015 THE BOEING COMPANY

Recommended Controls • The Media Store file system should prevent uncontrolled access to media files. • The Web Portal should not store any Personally Identifiable Information (PII) of users • The WIU should reload a clean software image from firmware at each power-up. • Firmware should only be writeable from the maintenance port while in maintenance mode. COPYRIGHT © 2015 THE BOEING COMPANY

Recommended Controls • Media should only be loadable while the CWAP interfaces are down. • The Web Portal should be protected by a web application firewall function that only passes whitelisted packet types. • The Web Portal and Media Store should have a means of detecting the presence of nonwhitelisted content in the filesystem. COPYRIGHT © 2015 THE BOEING COMPANY

Recommended Controls • The Web Portal and Media Store should have a means of detecting and preventing streaming of unauthorized content. • The WIU should detect and prevent improper commands being sent via the passenger service interface. • The WIU should implement a stateful packet filter (firewall) function on the BOSS and IFES interfaces. COPYRIGHT © 2015 THE BOEING COMPANY