Arm IDA and Cross Check: Reversing the Boeing 787's Core Network
summary
First public reverse engineering of Boeing 787 core network firmware (black‑level 2016 images) reveals multiple exploitable bugs: TFTP/FTS manager, ODLF and FSM target loader stack overflows lead to remote code execution on the VxWorks‑based CIS, weak kernel call‑gates allow arbitrary memory R/W and privilege escalation, and no compiler mitigations appear in binaries. Two internet‑facing ALS sub‑servers were discovered via Shodan. Attack paths chain from the ODN (IFE) through the CIS to the CDN enabling malicious firmware update and maintenance‑abuse scenarios.
AI-written summary · about
chapters (18)
- 0:00Introduction and agenda
- 0:54Research context
- 3:48Methodology and data
- 5:46Avionics architecture overview
- 10:53Core network components
- 13:31Attack surface analysis
- 15:36Attack scenarios
- 18:50Vulnerability exploitation
- 22:22Initial access and movement
- 24:37Firmware update vulnerabilities
- 27:41Privilege escalation
- 30:00End-to-end attack flow
- 32:04Wireless attack vectors
- 33:23External connectivity risks
- 36:56Post-exploitation actions
- 39:50Maintenance network security
- 41:43Disclosure and response
- 45:35Mitigation analysis and conclusion
related talks
27mWIFI-Important Remote Attack Surface: Threat is Expanding
39mNight of the living vulnerabilities
29mBackdooring of Real Time Automotive OS Devices
34mCoDe16; 16 Zero-Day Vulnerabilities Affecting CODESYS Framework Leading to Remote Code Execution
38m"Breaking Extreme Networks WingOS: How to own millions of..."
30mCommSec D1 - How to Find and Exploit Bugs in IoT Devices
47mBLEEDINGBIT: Your APs Belong to Us
41mfirmWar: An Imminent Threat to the Foundation of Computing