I'm not too keen on the idea that I'm now supposed to watch on a laptop. If I wanted to go to that kind of trouble I wouldn't be confining myself to whatever crap was on the in-flight entertainment system in the first place.
Boeing 787 In Flight Entertainment System Security fun
71–80 of 147 posts
Re: Boeing 787 In Flight Entertainment System Security fun
#72Were the in flight entertainment touchscreens really capactive? I've found that such designs have almost exclusively been resistive. The resistive designs are cheaper, but also tend to be designed with a high threshold. The two put together makes a lot of resistive touchscreens feel sluggish. You feel like you have to mash the heck out of them to get them to act sometimes. On the upside they don't require human capac…
The guy probably has the terms mixed up.
Re: Boeing 787 In Flight Entertainment System Security fun
#73Earlier quoted context omitted.
I don't know anyone who believes those claims, which have become a kind of shared joke in the software security community.
Roberts? Yes. Shared wires? That's fact, right?
I'm simply commenting on the notion that any packet he sent an IFE caused the plane to literally, perceptibly move. I don't need or want to derive the probability of that having occurred from first principles.
Re: Boeing 787 In Flight Entertainment System Security fun
#74Awesomely entertaining (hah!) read. Very interesting, thanks. Also, welcome to every no-fly list on the planet. If you are going to find that you are increasingly seeing more scrutiny, this is why.
Re: Boeing 787 In Flight Entertainment System Security fun
#75It's really quite useful. I changed my zsh prompt a while back to show me the status of the internet connection on board, remaining time, flight number and from where to where the plane is going. https://twitter.com/mitsuhiko/status/867043286128656384
That's absolutely awesome.
Re: Boeing 787 In Flight Entertainment System Security fun
#76I wish people wouldn't do shit like this on live systems like this one. Even the port scan could have had bad consequences (especially since this person did -A). By all means explore the interesting JSON object that was downloaded and yeah I'd worry about installing random stuff on my machine. I'm not talking about crashing the plane; I'm talking about crashing the IFE and me then having to sit through 10 hours of pe…
Swissair flight 111 crashed because of a fire that started in in flight entertainment system. Although isolated it still caused a fire that caused the highest death toll for the MD11 which was considered a very safe aircraft. https://en.m.wikipedia.org/wiki/Swissair_Flight_111
It crashed due to faulty wiring in the IFE, which started an electrical fire. It could just as easily have been the coffee maker.
Re: Boeing 787 In Flight Entertainment System Security fun
#77Earlier quoted context omitted.
If anything were to happen, it definitely shouldn't affect the avionics, not even remotely, or the plane would not have had a chance of certification. Data to the less secure IFE had better flow through a unidirectional network ("data diode"), and/or use a separate set of sensors. Even if it brought down the server, it's still nothing that the flight attendants can't solve by "turning it off and back on". This kind o…
Accidents happen. Commenter below referenced Swiss Air 111: https://en.m.wikipedia.org/wiki/Swissair_Flight_111 They cite inadequate safety standards and an overheating entertainment system. It's easy to assume that government or the airlines wouldn't allow a faulty system to fly, but just like software it's those extreme edge cases that cause problems. Somehow I doubt hacking the entertainment system is comprehensiv…
This keeps getting cited on this thread. The IFE didn't simply "overheat". It had faulty wiring. The coffee maker could just as easily have caused that accident.
Re: Boeing 787 In Flight Entertainment System Security fun
#78Earlier quoted context omitted.
Thank you for this comment. I for one would be pretty pissed if a "hacker" decided to crash my/or my kids entertainment on a long flight. There is definitely a need for this type of work, but doing so in a 50,000 lb brick floating a few miles above the ground isn't an atmosphere I am comfortable with, especially if I am present...
If anything were to happen, it definitely shouldn't affect the avionics, not even remotely, or the plane would not have had a chance of certification. Data to the less secure IFE had better flow through a unidirectional network ("data diode"), and/or use a separate set of sensors. Even if it brought down the server, it's still nothing that the flight attendants can't solve by "turning it off and back on". This kind o…
> definitely shouldn't affect the avionics
No, and the flaw you're busy exploiting also definitely shouldn't be there.
(Yes, the IFE is probably airgapped. Probably.)
Re: Boeing 787 In Flight Entertainment System Security fun
#79Earlier quoted context omitted.
If anything were to happen, it definitely shouldn't affect the avionics, not even remotely, or the plane would not have had a chance of certification. Data to the less secure IFE had better flow through a unidirectional network ("data diode"), and/or use a separate set of sensors. Even if it brought down the server, it's still nothing that the flight attendants can't solve by "turning it off and back on". This kind o…
> definitely shouldn't affect the avionics No, and the flaw you're busy exploiting also definitely shouldn't be there. (Yes, the IFE is probably airgapped. Probably.)
Since when are web servers DO-178 certified?
Re: Boeing 787 In Flight Entertainment System Security fun
#80Beside a scan is good or bad, how would they go about finding the source? There wont be an IT officr at landing collecting logs/mac address from any wireless card. I've scanned those systems many times and nothing ever happened - i am just pointing out to the issue that catching a real attacker it is hard not just technically but in practice
Also, don't use a typical *nix terminal that looks all hackerish (black background, green font, something like that). Someone non technical is bound to notice that, even if out of the corner of their eye.