Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Boeing 787 In Flight Entertainment System Security fun

btr.pm

Post reply on HN
Print view View original

31–40 of 147 posts

Re: Boeing 787 In Flight Entertainment System Security fun

#31

Post by evan_ »

WhitneyLand wrote: post #22
throwawayjava wrote: post #11

Earlier quoted context omitted.

If that plane ever plans to enter US or EU airspace, there is a literal air-gap between the IFE and the flight systems.

Then how is it showing the flight metrics? I wouldn’t guess they would add double sensors for all that information. Or did you mean well protected, instead of literal air gap?

I don't know enough about airplanes to know if it would be unencrypted but they radio all of that same data to the ground in some way, could the IFE system just passively listen to that broadcast?

Re: Boeing 787 In Flight Entertainment System Security fun

#32

Post by d_somewhere »

S_A_P wrote: post #29
jgrahamc wrote: post #24

I wish people wouldn't do shit like this on live systems like this one. Even the port scan could have had bad consequences (especially since this person did -A). By all means explore the interesting JSON object that was downloaded and yeah I'd worry about installing random stuff on my machine. I'm not talking about crashing the plane; I'm talking about crashing the IFE and me then having to sit through 10 hours of pe…

Thank you for this comment. I for one would be pretty pissed if a "hacker" decided to crash my/or my kids entertainment on a long flight. There is definitely a need for this type of work, but doing so in a 50,000 lb brick floating a few miles above the ground isn't an atmosphere I am comfortable with, especially if I am present...

You're sitting in a chair in the sky.

https://www.youtube.com/watch?v=oTcAWN5R5-I

Re: Boeing 787 In Flight Entertainment System Security fun

#33

Post by mikeash »

kylegordon wrote: post #12
theWatcher37 wrote: post #8

Earlier quoted context omitted.

So what does that say about the wisdom of port scanning a machine your life is currently depending on?

Do you honestly believe your life depends on the stability of an in flight entertainment computer?

If your fellow passengers found out who killed the movies in the middle of a long flight... in this particular case, yes, it might.

Re: Boeing 787 In Flight Entertainment System Security fun

#34

Post by Faaak »

WhitneyLand wrote: post #22
throwawayjava wrote: post #11

Earlier quoted context omitted.

If that plane ever plans to enter US or EU airspace, there is a literal air-gap between the IFE and the flight systems.

Then how is it showing the flight metrics? I wouldn’t guess they would add double sensors for all that information. Or did you mean well protected, instead of literal air gap?

GPS + external sensors for pressure, wheels, …

Re: Boeing 787 In Flight Entertainment System Security fun

#35

Post by susi22 »

tptacek wrote: post #25
duxup wrote: post #19

Earlier quoted context omitted.

"you'll be on the hook for it." Particularly if something goes terribly wrong and you're on the plane.

Nothing you do to the IFE is going to take down the plane.

229 dead from an overheated entertainment system: https://en.wikipedia.org/wiki/Swissair_Flight_111

Re: Boeing 787 In Flight Entertainment System Security fun

#36

Post by jgrahamc »

S_A_P wrote: post #29
jgrahamc wrote: post #24

I wish people wouldn't do shit like this on live systems like this one. Even the port scan could have had bad consequences (especially since this person did -A). By all means explore the interesting JSON object that was downloaded and yeah I'd worry about installing random stuff on my machine. I'm not talking about crashing the plane; I'm talking about crashing the IFE and me then having to sit through 10 hours of pe…

Thank you for this comment. I for one would be pretty pissed if a "hacker" decided to crash my/or my kids entertainment on a long flight. There is definitely a need for this type of work, but doing so in a 50,000 lb brick floating a few miles above the ground isn't an atmosphere I am comfortable with, especially if I am present...

Oh, I agree. There's definitely a need for this type of thing. The work of white hats is essential.

Re: Boeing 787 In Flight Entertainment System Security fun

#37

Post by richrichardsson »

kevin_b_er wrote: post #20

Were the in flight entertainment touchscreens really capactive? I've found that such designs have almost exclusively been resistive. The resistive designs are cheaper, but also tend to be designed with a high threshold. The two put together makes a lot of resistive touchscreens feel sluggish. You feel like you have to mash the heck out of them to get them to act sometimes. On the upside they don't require human capac…

I've often thought the genius who thought it was a good idea to put a crappy low sensitivity touchscreen directly behind my head needs to be kicked squarely in the nuts, repeatedly.

Re: Boeing 787 In Flight Entertainment System Security fun

#38

Post by jonathanstrange »

willvarfar wrote: post #28
tptacek wrote: post #25

Earlier quoted context omitted.

Nothing you do to the IFE is going to take down the plane.

In theory the IFE and avionics are separated by firewalls. Some things like the PA system are often on the IFE side, and hacks for panasonic IFE have included impersonating the pilot announcements and stuff. In practice I wouldn't expect the firewalls to be particularly well tested or complete or configured correctly, and it may be possible for an attacker to DOS the firewall and impact the other systems, and possibl…

I find this hard to believe. I always thought that IFE and avionics are on separate machines and run over different internal networks and wires. But I'm also not a Boeing engineer.

Can someone confirm the above post?

Re: Boeing 787 In Flight Entertainment System Security fun

#39

Post by HalfTOXIC »

willvarfar wrote: post #28
tptacek wrote: post #25

Earlier quoted context omitted.

Nothing you do to the IFE is going to take down the plane.

In theory the IFE and avionics are separated by firewalls. Some things like the PA system are often on the IFE side, and hacks for panasonic IFE have included impersonating the pilot announcements and stuff. In practice I wouldn't expect the firewalls to be particularly well tested or complete or configured correctly, and it may be possible for an attacker to DOS the firewall and impact the other systems, and possibl…

Do you have source on panasonic IFE hacks? Sounds interesting.

Re: Boeing 787 In Flight Entertainment System Security fun

#40

Post by tptacek »

susi22 wrote: post #35
tptacek wrote: post #25

Earlier quoted context omitted.

Nothing you do to the IFE is going to take down the plane.

229 dead from an overheated entertainment system: https://en.wikipedia.org/wiki/Swissair_Flight_111

Nothing you do to the IFE is going to take down the plane.
Post reply on HN