[August 11] - Boeing 747s receive critical software updates over 3.5" floppy disks

[Deleted member 3812]

The Verge and The Register is reporting that Boeing 747s actually has a 3.5-inch floppy disk drive installed in the plane that's used to install critical updates to the avionics systems:

Boeing 747s still get critical updates via floppy disks

Security researchers get a rare look at the 747s avionics systems

www.theverge.com

August 11, 2020

Boeing's 747-400 aircraft, first introduced in 1988, is still receiving critical software updates through 3.5-inch floppy disks. The Register reports that security researchers at Pen Test Partners recently got access to a British Airways 747, after the airline decided to retire its fleet following a plummet in travel during the coronavirus pandemic. The team was able to inspect the full avionics bay beneath the passenger deck, with its data center-like racks of modular black boxes that perform different functions for the plane.

Pen Test Partners discovered a 3.5-inch floppy disk drive in the cockpit, which is used to load important navigation databases. It's a database that has to be updated every 28 days, and an engineer visits each month with the latest updates.

While it might sound surprising that 3.5-inch floppy disks are still in use on airplanes today, many of Boeing's 737s have also been using floppy disks to load avionics software for years. The databases housed on these floppy discs are increasingly getting bigger, according to a 2015 report from Aviation Today. Some airlines have been moving away from the use of floppy discs, but others are stuck with engineers visiting each month to sit and load eight floppies with updates to airports, flight paths, runways, and more.

Click to shrink...

Pen Test Partners: Boeing 747s receive critical software updates over 3.5" floppy disks

Industry binning old aircraft is an opportunity for aviation infosec

www.theregister.com

Pen Test Partners: Boeing 747s receive critical software updates over 3.5" floppy disks

Click to shrink...

 

[GoldenEye 007]

?

As long as the data is good, I wouldn't really care. You'd be shocked at how many critical systems are based on older technology in a variety of applications.

 

[ElectricBlanketFire]

Is this one of those situations where it sounds worse than it really is? Asking sincerely.

 

[Relic]

I almost see the logic in this. I'd wager even a simple USB implementation is 100x more complicated than a floppy implementation.

 

[Jedi2016]

Those planes are all ancient, and there's really no reason to update hardware like that. As long as the update happens, I don't suppose it really matters.

 

[sangreal]

As long as they are doing crc checks or something, who cares? Less of a security nightmare than USB would be too

 

[Strafer]

Can they play Doom tho?

 

[spam flakes]

Seems fine to me.
And yeah, if it's less of a security issue than USB, then that's good

 

[batfax]

"If it ain't broke..."

 

[Merv]

Spoiler

Don't copy that floppy.

 

[Deleted member 4783]

Stowage UwU




Yeah, I know it's a real word. But it really seems like it's a UwU version of "storage"

 

[Flandy]

Can they play Doom tho?

Click to shrink...

Install Doom on the plane!

 

[Lulu]

HAHA BOOMER 747. THOSE THINGS ARE SO FRIGGIN OLD LMAO

 

[carlsojo]

Isn't it like way harder to hack that kind of hardware?

 

[StudioTan]

Isn't this more secure since it's harder to get floppy discs?

 

[Y2Kev]

Like these are clearly not 747-8s, which themselves are End of Life'd. So I don't think this is a big deal.

 

[Forerunner]

Isn't it like way harder to hack that kind of hardware?

Click to shrink...

Yes, it's one of the reasons why we still use them with nukes.

https://www.washingtonpost.com/news/the-switch/wp/2016/05/26/the-real-reason-america-controls-its-nukes-with-ancient-floppy-disks/

 

[TitlePending]

So it can play Oregon Trail....?

 

[Nezacant]

"Security through obscurity"

 

[Hollywood Duo]

Makes sense give how ancient these things are. We saw how well those brand new Boeing planes went...

 

[Transistor]

Diskette stowage

 

[Lumination]

Don't fix what ain't broke. Imagine hackers trying to smuggle a virus on 20 floppies.

 

[Bleu]

who cares.
you don't want those things to be updated remotely anyway, you'd want it to require physical access.
So, why not floppies, it's probably more resilient than an optical drive, and much safer than any usb or other connector thing, you can't fry/sabotage a unit with a faulty floppy.

 

[MikeHattsu]

The last BA 747 was delivered in 1999, so yeah.

The first USB flash drives was released in 2000.

 

[Spring-Loaded]

Not sure I'd want Boeing trying to upgrade anything tbh, so I'll stick with the floppy disk

Stowage UwU




Yeah, I know it's a real word. But it really seems like it's a UwU version of "storage"

Click to shrink...

lmao.

 

[nullref]

The 747 is old. As long as the software can fit on floppies and data integrity can be verified (which you'd have to do with any form of storage regardless), this doesn't matter.

 

[JoJo'sDentCo]

This is a silly article. These planes are old and the tech works. Big whoop.

 

[RadzPrower]

The biggest issue with this system is floppy diskette supply.

Otherwise, it's a system that's perfectly functional and even lightly secured by the fact it's not a common interface anymore. That and USB absolutely SUCKS in terms of security. Any sort of wireless connection I would consider similarly insecure as well.

 

[Dennis8K]

But can it run Microsoft Flight Simulator 2020?

 

[Lonestar]

 

[Ashhong]

I work in the avionics industry and yea, some systems are very outdated like the example above. Some airlines just refuse to retire or update the system due to costs. They still work fine

 

[shazrobot]

I think a lot of people would be astounded how many systems run on "ancient" hardware like this.

 

[Van Bur3n]

We could maybe update a couple of other things.

 

[7threst]

Is this really surprising? Lot's of military systems are updated the same way. Also, I personally still user floppies on my MPC, my Roland MC-300, my workstation etc.

 

[Dakkon]

Is this one of those situations where it sounds worse than it really is? Asking sincerely.

Click to shrink...

It shouldn't sound worse at all in the first place, storage is storage it doesn't matter to the end consumer how the data gets there as long as the data gets there lol.

It's actually a good thing overall, it's a lot harder to hack a floppy disk than it is to hack a USB stick or anything connected to the internet because, y'know, most people don't have floppy disk drives.

The article is just really dumb. Our entire nuclear defense system still uses floppy disks and everything has been fine for ages now. The system works.

 

[Deleted member 3812]

Why would the use of 3.5-inch floppies for critical security updates make the news in 2020 if this is common?

 

[Forerunner]

Why would the use of 3.5-inch floppies for critical security updates make the news in 2020 if this is common?

Click to shrink...

because they want your clicks

 

[Culex]

I'm more concerned why we still use fax machines!

 

[VariantX]

Honestly, it might be at least pretty secure because no one's really messes with these things in the mainstream sector.

 

[MikeHattsu]

But can it run Microsoft Flight Simulator 2020?

Click to shrink...

It's the reverse, MSF2020 can run it:

Of potential interest to researchers who don't have access to a spare 747 for a spot of pentesting is the new Microsoft Flight Simulator. Due for release in just over a week, the latest version of the classic sim franchise will include and support the use of ARINC 429-compatible navigation datasets, of the exact same type loaded into the 747 on a 3.5" floppy.

Click to shrink...

 

[Relix]

Lol. Do people know most of their banking still goes through mainframes and COBOL?

 

[Dakkon]

Why would the use of 3.5-inch floppies for critical security updates make the news in 2020 if this is common?

Click to shrink...

Because they want clicks from people who don't know any better, just like most low tier unimportant news.

 

[MikeHattsu]

Because they want clicks from people who don't know any better, just like most low tier unimportant news.

Click to shrink...

The actual video is interesting though. Looking at all the technical bits of the 747.

 

[Kittens McMittens]

It's being used to update navigation databases. I'd be surprised if updates to that are more than a couple of megabytes uncompressed, so would fit nicely on a 1.44MB floppy. The reason why they use them is simple: the system was certified in 1988, when floppies were common. Why would you update a certified safety-critical system for no reason?

Edit: apparently it's 8 floppies. That's still not that bad, and the point still stands.

 

[Deleted member 3812]

It's the reverse, MSF2020 can run it:

Click to shrink...

That's really interesting and cool.

 

[impingu1984]

Better than ota updates I suspose

 

[nded]

If it ain't broke.

 

[The Albatross]

Makes sense. A lot of the 747 fleet was built in the hay day of the 80s and 90s of cheap gas, built with technology components from that era. Hell this is probably safer than a lot of new systems that are more easily hackable with modern technology. Imagine if your 747 could get service updates OTA?

 

[VariantX]

If it ain't broke.

Click to shrink...

Think thats why alot of companies that have been around for a while still keep shit on Cobol even all these years later. Its stable and it works and they're terrified of converting it to a new language.

 

[Squirrel Killer]

But can it run Microsoft Flight Simulator 2020?

Click to shrink...

Yeah, right. The 747s are so old the front windshields are only 640x480.