The FAA, Bananas, and Computer Security: Hacking Planes with Cell Phones

Hugo Teso recently reported on some pretty serious flaws in the security for airplane flight systems and pilot displays. He reports that using an Android device and some custom-written code, he was able to provoke actions by the flight systems and feed the pilot incorrect information. The Register has a pretty good summary of what Teso discussed.

In an interview with Forbes, Teso reported:

“You can use this system to modify approximately everything related to the navigation of the plane. That includes a lot of nasty things.”

Fortunately, The Register tells us:

Federal Aviation Administration and the European Aviation Safety Administration have both been informed and are working on fixing the issue.

That would seem to be an appropriate response to a flaw like that. You would really hate to think about al Qaeda sending a bunch of wackos with cell phones onto flights. And I don't think the FAA would seriously be able to take away peoples' cell phones on flights. Dealing with Alec Baldwin alone would stretch the resources of most Federal agencies.

Fortunately, the FAA has taken swift action to alleviate any concerns the flying public might have about some new-found sense of competency in that agency. The FAA reports that there is no real problem because the hack did not work when they tested it against a "flight certified" configuration.

The idea of "defense in depth" appears to have soared right past these people. If there is a problem in a component of an overall system, FIX IT.

Here's hoping that the FAA manages to stumble across a clue in between meetings about whether or not to allow people to bring fully-functioning bananas on planes.

Update

The app that Teso used is only effective against simulators. That does not mean that there is not an issue that needs to be resolved. The H Security reports that:

Teso says that the ACARS communication with a plane can be implemented locally via a software-defined radio system or globally via one of the two major ACARS providers, ARINC and SITA. The researcher added that a vulnerability would need to be found with the providers.

The manufacturer, Honeywell, is investigating to see to what extent the vulnerabilities in the PC product used in simulators are also applicable to hardware-based implementations used on planes.

Other media outlets, like Computerworld, are reporting on the differences between the PC simulator hardware and the hardware-based implementations. My opinion remains the same as it did earlier; problems need to be fixed. Working exploits depend on chaining problems together; a good security posture depends on removing as many links from the chain as possible.

Barton, Climate Change, and the GOP War on Science Continues

This week's shot from the GOP War on Science came from Texas representative Joe Barton. In a statement full of both confusing analysis and an even more confusing metaphor, Barton explained that the Great Flood was an example of climate change as well as an example of why there was no need to manage climate change.

Leave aside the whole question of the historicity of the Great Flood and the Noah legend. Assuming that the flood was historical, and assuming that it was an example of what happens under climate change, wouldn't that be an argument to try to avoid global warming? Unless he is proposing that we start building really big boats.

Now let's go back to the question of the historicity of the Great Flood. There is an interesting hypothesis that the Great Flood legend comes from the flooding of the Black Sea basin during the global warming at the end of the last ice age. Maybe Barton heard this story and assumed that there was actually scientific evidence for the whole legend, including the giant boat that still wasn't big enough to hold the dinosaurs.

Just for fun, here is another classic bit of "scientific" evidence regarding climate change. Lunar volcanoes, anyone?

Social Security, Chained CPI and the Obama Budget

The Obama budget appears to mirror the proposals that Obama had previously put forward for a so-called "Grand Bargain" to reduce the deficit. It includes proposals for closing tax loopholes, increasing taxes (mostly on wealthy individuals), and it includes some proposals for spending cuts.

One of the centerpieces of proposed cost reductions in Social Security, probably by limiting cost of living increases to a less generous definition of inflation, known as the "chained CPI."

The current measure, known as "CPI-W," calculates inflation by following the increase in a "shopping basket" of common purchases. Chained CPI is similar, but it takes into account the sorts of substitutions that consumers might make in response to increasing prices.

Other measures of inflation are also possible, such as indexing Social Security payments to growth in the Gross Domestic Product (GDP), a measurement of the overall economy. Or payments can be indexed to the growth in the median worker's wages.

Social Security Trust Fund

A common refrain by the AARP and others is that Social Security is "solvent." By this, they mean that the money in the "Social Security Trust Fund" will continue to fund benefits to the 2030s or so. In fact, the "trust fund" consists of what amounts to IOUs, as the Unified Budget allowed the Federal Government to mask the true size of the budget deficit by borrowing agains future taxpayers' payments.

In effect, the next generation of taxpayers will need to be double-taxed, to pay both the normal pension payments and additional taxes to pay for the deficit that was financed by raiding the trust fund.

The realization that the Baby Boom generation effectively financed deficit spending at the cost of the generation that will have to pay their social security is sometimes referred to as "generational theft".

Other Options

There are other options for achieving Social Security savings.

One is to adjust the so-called "primary insurance amount" (PIA) formula to give less of a benefit to upper-income earners. Social Security payments are progressive in the sense that payments are not proportional to taxes paid into the system, but further adjustments to the formula can result in cost savings that disproportionately affect upper income earners.

Another is to use so-called "progressive price indexing" (PPI), in which upper income earners are indexed differently than lower income earners.

Nobody Plays Politics Better than the NRA

The Week reports on how the NRA's political mobilization has succeeded even in the wake of the mass shooting at Sandy Hook.

Most Americans support common sense types of gun control, such as background checks at gun shows. But bolstered by the cash and cutthroat reputation of the NRA, gun expansionists have beaten off all attempts to expand federal gun regulations. In many cases, like the riders to the budget to reduce the Federal Government's ability to track gun violence, the NRA has actually decreased controls on gun sales.

NOTE (10 April 2013): An deal may be in the works to allow increased background checks during gun show sales and gun sales through other venues.

What does it mean to be Christian?

Lost Christianities book is one of my favorite books about religious history. The author integrates information from several different sources in an engaging tour of what it meant to be a Christian in the first few centuries AD.

New techniques and new document finds have completely re-written what we thought we knew about the history of Christianity. It turns out that the Christian ecosystem was much richer and more diverse than most people understand. The variety of different beliefs held among people who called themselves "Christian" is staggering. Fortunately, new documentary evidence illuminates what these people believed, and what sorts of books they considered to be scripture.

Ehrman also explains the history of the more traditional books in the canon. The New Testament takes on additional life once you understand the history behind each of the books.

GOP Efforts at Voter Suppression Continue

The GOP is continuing its efforts at voter suppression with the recent veto override in Arkansas. Governor Beebe correctly called this law an expensive solution to a non-existent problem.

Nobody is fooling anybody. These laws have nothing to do with stopping voter fraud. There have been no reputable results showing a problem with voter fraud by people who come to the polls on voting day. Everyone admits that fraud is much easier to carry out with mail-in ballots, but the GOP has made no moves to tighten up on absentee balloting, because they believe that they have an advantage among those ballots.

Book Review: "Bailout" by Barofsky

Barofsky has a unique perspective on what unfolded in the series of bailouts following the 2008 economic meltdown. He had the responsibility for overseeing the disbursement of an unprecedented amount of money at a phenomenal velocity. In this extraordinarily readable memoir, Barofsky explains some of the roots of the financial collapse and doesn't hesitate to call out powerful interests for their part in destabilizing the financial system.

Given the urgency of the situation and the speed of the response, it would have been impossible for anyone to prevent fraud. And fraud did occur, as Barofsky points out in this book. But with all the handicaps Barofsky's team faced, they did a remarkable job keeping the bailout as clean as they did.

Barofsky also points out the importance of reform in our financial institutions, how little has been done, and the role that money played in influencing the lack of response. His criticism is on point when pointing out the weaknesses in our financial infrastructure. And since the "too big to fail" companies have continued to grow larger while engaging in the same risky behavior as before, we will be condemned to repeat our recent history again.