> I did a port scan on the System Control Unit
Scanning during flight is not really responsible at all.
Boeing 787 In Flight Entertainment System Security fun
21–30 of 147 posts
Re: Boeing 787 In Flight Entertainment System Security fun
#22Earlier quoted context omitted.
So what does that say about the wisdom of port scanning a machine your life is currently depending on?
If that plane ever plans to enter US or EU airspace, there is a literal air-gap between the IFE and the flight systems.
Then how is it showing the flight metrics?
I wouldn’t guess they would add double sensors for all that information.
Or did you mean well protected, instead of literal air gap?
Re: Boeing 787 In Flight Entertainment System Security fun
#23Reading through the post it didn't seem like he found any security issues. Their map has javascript variables which isn't a security issue. It doesn't seem like SCU had many open ports. It was running a relatively new version of Linux.
Re: Boeing 787 In Flight Entertainment System Security fun
#24I wish people wouldn't do shit like this on live systems like this one. Even the port scan could have had bad consequences (especially since this person did -A). By all means explore the interesting JSON object that was downloaded and yeah I'd worry about installing random stuff on my machine.
I'm not talking about crashing the plane; I'm talking about crashing the IFE and me then having to sit through 10 hours of people who didn't bring a book.
Re: Boeing 787 In Flight Entertainment System Security fun
#25Earlier quoted context omitted.
It's borderline; if something bad happens (and bad things definitely can happen from portscanning, especially embedded systems), you'll be on the hook for it.
"you'll be on the hook for it." Particularly if something goes terribly wrong and you're on the plane.
Nothing you do to the IFE is going to take down the plane.
Re: Boeing 787 In Flight Entertainment System Security fun
#26Earlier quoted context omitted.
If that plane ever plans to enter US or EU airspace, there is a literal air-gap between the IFE and the flight systems.
Then how is it showing the flight metrics? I wouldn’t guess they would add double sensors for all that information. Or did you mean well protected, instead of literal air gap?
One way connection of some kind? Its not an air gap but may functionally work the same way.
Re: Boeing 787 In Flight Entertainment System Security fun
#27Were the in flight entertainment touchscreens really capactive? I've found that such designs have almost exclusively been resistive. The resistive designs are cheaper, but also tend to be designed with a high threshold. The two put together makes a lot of resistive touchscreens feel sluggish. You feel like you have to mash the heck out of them to get them to act sometimes. On the upside they don't require human capac…
I imagine they meant resistive, however newer planes do have capacitive screens now.
Re: Boeing 787 In Flight Entertainment System Security fun
#28Earlier quoted context omitted.
"you'll be on the hook for it." Particularly if something goes terribly wrong and you're on the plane.
Nothing you do to the IFE is going to take down the plane.
In theory the IFE and avionics are separated by firewalls. Some things like the PA system are often on the IFE side, and hacks for panasonic IFE have included impersonating the pilot announcements and stuff.
In practice I wouldn't expect the firewalls to be particularly well tested or complete or configured correctly, and it may be possible for an attacker to DOS the firewall and impact the other systems, and possible for the attacker to penetrate the firewall and so on.
Re: Boeing 787 In Flight Entertainment System Security fun
#29I wish people wouldn't do shit like this on live systems like this one. Even the port scan could have had bad consequences (especially since this person did -A). By all means explore the interesting JSON object that was downloaded and yeah I'd worry about installing random stuff on my machine. I'm not talking about crashing the plane; I'm talking about crashing the IFE and me then having to sit through 10 hours of pe…
Thank you for this comment. I for one would be pretty pissed if a "hacker" decided to crash my/or my kids entertainment on a long flight. There is definitely a need for this type of work, but doing so in a 50,000 lb brick floating a few miles above the ground isn't an atmosphere I am comfortable with, especially if I am present...
Re: Boeing 787 In Flight Entertainment System Security fun
#30Earlier quoted context omitted.
If that plane ever plans to enter US or EU airspace, there is a literal air-gap between the IFE and the flight systems.
Then how is it showing the flight metrics? I wouldn’t guess they would add double sensors for all that information. Or did you mean well protected, instead of literal air gap?
Optoisolators are a prolific and an extremely cheap electrical component that performs the "air-gap" functionality.