Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Boeing 787 In Flight Entertainment System Security fun

btr.pm

Post reply on HN
Print view View original

111–120 of 147 posts

Re: Boeing 787 In Flight Entertainment System Security fun

#111

Post by dkersten »

mulmen wrote: post #108
Godel_unicode wrote: post #101

Earlier quoted context omitted.

If your software can't handle nmap it has no business being on any network anywhere ever. This mentality is where a lot of our current security problems come from, from IoT to critical infrastructure to ATMs, etc. Developers can't imagine someone would ever do anything nefarious on their "closed" network, so they don't bother doing more than cursory security. Then the internet shames anyone who tries to demonstrate h…

That doesn't justify putting other people's lives at risk. Testing on a live system without permission is still irresponsible.

"lives at risk" is a bit of a stretch. They might take down the IFE and people might be bored, but they won't take the plane down. The telemetry data is read-only (the hardware is physically isolated and transmission one way -- systems that need write access are isolated from the ones that only need read access, and have to go through a slew of certification processes).

(I work on IFE and avionics)

Re: Boeing 787 In Flight Entertainment System Security fun

#112

Post by jordz »

ricardobeat wrote: post #97
tlb wrote: post #88

Earlier quoted context omitted.

Lots of things have faulty wiring, but they keep working as long as their power draw is under some limit. Drawing excess power is a common result of software going into an infinite loop, which is a possible outcome of security probes. Half the bugs I notice in Chrome, I notice because my laptop fan starts running.

A CPU overheating is still completely different from the wiring or other components heating up. It is entirely monitored, can throttle itself or shut down through OOB controls. It's more likely for your plane to be hit by a falling unicorn than you being able to burn something up just by the power of `while (1)`.

This genuinely made me laugh out loud.

Re: Boeing 787 In Flight Entertainment System Security fun

#113

Post by lordlimecat »

blincoln wrote: post #16
t90fan wrote: post #5

Earlier quoted context omitted.

Scanning can lead to arrest in some places. In the UK for example, the computer misuse act says that using any tool with the intent of accessing a system (without actually doing so, let alone doing so successfully) is an offence.

It could easily be interpreted as a CFAA violation in the US as well. I'm a professional pen tester, and there's no chance I'd port-scan any system on an aircraft without permission.

It's almost like theres a reason every computer security class and every scanning software written has a disclaimer saying "NEVER SCAN A SYSTEM WITHOUT AUTHORIZATION".

Re: Boeing 787 In Flight Entertainment System Security fun

#114

Post by Godel_unicode »

zero_one_one wrote: post #68

There's a lot of posts mentioning that a scan shouldn't cause any trouble, however there's no way of knowing how the services are configured on the other end, or how they are set up to respond to certain packet types, or how the server will respond to certain data within those packets if said data does not conform to expected lengths etc. A lot of assumptions are made that non-conforming data will be ignored in a clo…

I think you're reading that incorrectly. The way I have interpreted those posts (including my own) is to say that if nmap can crash your software you should a) know that and b) not release it.

In 2017, you absolutely have a reasonable expectation that network systems are safe to nmap. You might be wrong, but that's a completely reasonable assumption.

Re: Boeing 787 In Flight Entertainment System Security fun

#115

Post by dkersten »

S_A_P wrote: post #56
bonzini wrote: post #42

Earlier quoted context omitted.

If anything were to happen, it definitely shouldn't affect the avionics, not even remotely, or the plane would not have had a chance of certification. Data to the less secure IFE had better flow through a unidirectional network ("data diode"), and/or use a separate set of sensors. Even if it brought down the server, it's still nothing that the flight attendants can't solve by "turning it off and back on". This kind o…

I agree that, in theory, at least the avionics shouldn't be accessible from the IFE. I am sure there is a rigorous protocol for making sure this is properly secured and certification for airworthiness. I think the parent comment was more making the point that we don't need a flight full of people scanning ports for fun and profit, and the consequences of doing so are unknown and could lead to things like no wifi or I…

> I am sure there is a rigorous protocol

The "rigorous protocol" is one-way hardware diodes. The telemetry simply cannot physically travel the other way.

Now, of course, there can always be mistakes. Certification is supposed to catch that, but of course, that isn't fool proof either.

Re: Boeing 787 In Flight Entertainment System Security fun

#116

Post by dkersten »

tptacek wrote: post #58
willvarfar wrote: post #43

Earlier quoted context omitted.

You or I would have completely different sets of wires. Sadly, it seems they usually share wires and are separated by firewalls. There's been lots of CCC and defcon talks about hacking in-flight systems. Googling "panasonic ife hack" gets plenty of hits, as does "Chris Roberts" who is a hacker who has made some pretty big claims about actually really hacking planes in flight and other stupid things. And there are art…

I don't know anyone who believes those claims, which have become a kind of shared joke in the software security community.

Nobody in the office here (I work on IFE & avionics software) believes those claims either.

Re: Boeing 787 In Flight Entertainment System Security fun

#117

Post by FTA »

netsharc wrote: post #7

The decompression flag is interesting, I would've poked around the Javascript to see if that flag is ever read. If they were thorough, the web frontend would show a red screen with words like "Decompression! Put on your oxygen mask!" Otherwise, passengers could be so distracted with the electronic entertainment that they might not notice that it got very breezy all of a sudden...

Looks like decompression is checked for in a function that catches behavior for DECOMPRESSION, PA, and WEIGHT ON WHEELS (no entertainment on ground when heavy devices should be stored):

https://github.com/x8BitRain/InFlightEntertainment-Scoot787/...

which then weaves through various functions similar to the above states. So I think your guess is on track!

Re: Boeing 787 In Flight Entertainment System Security fun

#118

Post by _0w8t »

dkersten wrote: post #111
mulmen wrote: post #108

Earlier quoted context omitted.

That doesn't justify putting other people's lives at risk. Testing on a live system without permission is still irresponsible.

"lives at risk" is a bit of a stretch. They might take down the IFE and people might be bored, but they won't take the plane down. The telemetry data is read-only (the hardware is physically isolated and transmission one way -- systems that need write access are isolated from the ones that only need read access, and have to go through a slew of certification processes). (I work on IFE and avionics)

Is this still true with 787? [1] indicates that it uses virtual links that are not physically separated.

[1] - https://en.m.wikipedia.org/wiki/ARINC_429

Re: Boeing 787 In Flight Entertainment System Security fun

#119

Post by 0xffff2 »

emodendroket wrote: post #71

I'm not too keen on the idea that I'm now supposed to watch on a laptop. If I wanted to go to that kind of trouble I wouldn't be confining myself to whatever crap was on the in-flight entertainment system in the first place.

I'm not too keen on having a screen I don't control ( and never use anyway) in front of me for an entire flight. I hate being shown ads, and the only place I still regularly encounter them are airplane IFE systems I can't turn off during certain phases of the flight, and poorly chosen gas stations. Interestingly neither of those used to be significant sources of advertising.

Re: Boeing 787 In Flight Entertainment System Security fun

#120

Post by sangnoir »

qubex wrote: post #81
jgrahamc wrote: post #24

I wish people wouldn't do shit like this on live systems like this one. Even the port scan could have had bad consequences (especially since this person did -A). By all means explore the interesting JSON object that was downloaded and yeah I'd worry about installing random stuff on my machine. I'm not talking about crashing the plane; I'm talking about crashing the IFE and me then having to sit through 10 hours of pe…

Maybe he did it as the plane was coming in to land? When else do you think he might have access to such a system?

He did it during the cruise, according to the flight status JSON he got. Also, takeoff and landing are the most dangerous periods for air travel.
Post reply on HN