Live data from Hacker News

Boeing 787 In Flight Entertainment System Security fun

btr.pm

11–20 of 147 posts

Re: Boeing 787 In Flight Entertainment System Security fun

#11

Earlier quoted context omitted.

I had a projector firmware freeze up hard on me during a port scan. There is some risk there.

So what does that say about the wisdom of port scanning a machine your life is currently depending on?

If that plane ever plans to enter US or EU airspace, there is a literal air-gap between the IFE and the flight systems.

Re: Boeing 787 In Flight Entertainment System Security fun

#12

Earlier quoted context omitted.

I had a projector firmware freeze up hard on me during a port scan. There is some risk there.

So what does that say about the wisdom of port scanning a machine your life is currently depending on?

Do you honestly believe your life depends on the stability of an in flight entertainment computer?

Re: Boeing 787 In Flight Entertainment System Security fun

#13

Earlier quoted context omitted.

I had a projector firmware freeze up hard on me during a port scan. There is some risk there.

So what does that say about the wisdom of port scanning a machine your life is currently depending on?

It would probably not harm the aircraft but would be bad enough if it freezes the entertainment system for all passengers. If the ~300 other people on board find out that you're the one responsible for their boredom on a 10 hour flight, you won't have a great time.

Re: Boeing 787 In Flight Entertainment System Security fun

#14
post #7

The decompression flag is interesting, I would've poked around the Javascript to see if that flag is ever read. If they were thorough, the web frontend would show a red screen with words like "Decompression! Put on your oxygen mask!" Otherwise, passengers could be so distracted with the electronic entertainment that they might not notice that it got very breezy all of a sudden...

This is actually a good idea. Or at least activate the PA system and stop videos. Not sure how easy it is to notice masks falling down if you wear noise cancelling headphones and look down on your tablet.

Re: Boeing 787 In Flight Entertainment System Security fun

#16
post #5
post #3

Earlier quoted context omitted.

Scanning should be fine; trying to access them becomes dubious; bruteforcing the login could lead to arrest.

Scanning can lead to arrest in some places. In the UK for example, the computer misuse act says that using any tool with the intent of accessing a system (without actually doing so, let alone doing so successfully) is an offence.

It could easily be interpreted as a CFAA violation in the US as well. I'm a professional pen tester, and there's no chance I'd port-scan any system on an aircraft without permission.

Re: Boeing 787 In Flight Entertainment System Security fun

#17
post #3
post #2

> I did a port scan on the System Control Unit Is that still white hat? Did they also check to see if the cockpit door is locked?

Scanning should be fine; trying to access them becomes dubious; bruteforcing the login could lead to arrest.

I wondered the same. Right or wrong some equipment does not respond well (lockup, reset...) to port scanning.

Re: Boeing 787 In Flight Entertainment System Security fun

#18
post #14
post #7

The decompression flag is interesting, I would've poked around the Javascript to see if that flag is ever read. If they were thorough, the web frontend would show a red screen with words like "Decompression! Put on your oxygen mask!" Otherwise, passengers could be so distracted with the electronic entertainment that they might not notice that it got very breezy all of a sudden...

This is actually a good idea. Or at least activate the PA system and stop videos. Not sure how easy it is to notice masks falling down if you wear noise cancelling headphones and look down on your tablet.

I imagine it would tangle onto your hair or you'd notice the confusion around you ?

Re: Boeing 787 In Flight Entertainment System Security fun

#19
post #6
post #2

> I did a port scan on the System Control Unit Is that still white hat? Did they also check to see if the cockpit door is locked?

It's borderline; if something bad happens (and bad things definitely can happen from portscanning, especially embedded systems), you'll be on the hook for it.

"you'll be on the hook for it."

Particularly if something goes terribly wrong and you're on the plane.

Re: Boeing 787 In Flight Entertainment System Security fun

#20
Were the in flight entertainment touchscreens really capactive? I've found that such designs have almost exclusively been resistive. The resistive designs are cheaper, but also tend to be designed with a high threshold. The two put together makes a lot of resistive touchscreens feel sluggish. You feel like you have to mash the heck out of them to get them to act sometimes. On the upside they don't require human capacitance to work, just screen pressure.
Post reply on HN