Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Boeing 787 In Flight Entertainment System Security fun

btr.pm

Post reply on HN
Print view View original

121–130 of 147 posts

Re: Boeing 787 In Flight Entertainment System Security fun

#121

Post by SilasX »

tptacek wrote: post #77
everdev wrote: post #54

Earlier quoted context omitted.

Accidents happen. Commenter below referenced Swiss Air 111: https://en.m.wikipedia.org/wiki/Swissair_Flight_111 They cite inadequate safety standards and an overheating entertainment system. It's easy to assume that government or the airlines wouldn't allow a faulty system to fly, but just like software it's those extreme edge cases that cause problems. Somehow I doubt hacking the entertainment system is comprehensiv…

This keeps getting cited on this thread. The IFE didn't simply "overheat". It had faulty wiring . The coffee maker could just as easily have caused that accident.

Yeah, but that's sort of the rub, isn't it? It's faulty wiring that won't, in practice, overheat unless you overload the server with (say) a port scan.

So yes, the aircraft is supposed to be robust against any trickery with the entertainment system. And indeed, it's 100% their fault for installing the wiring in a way that would overhead under load.

It's still pretty irresponsible to risk taking down the aircraft like that to check for a vulnerability!

Re: Boeing 787 In Flight Entertainment System Security fun

#122

Post by zero_one_one »

Godel_unicode wrote: post #114
zero_one_one wrote: post #68

There's a lot of posts mentioning that a scan shouldn't cause any trouble, however there's no way of knowing how the services are configured on the other end, or how they are set up to respond to certain packet types, or how the server will respond to certain data within those packets if said data does not conform to expected lengths etc. A lot of assumptions are made that non-conforming data will be ignored in a clo…

I think you're reading that incorrectly. The way I have interpreted those posts (including my own) is to say that if nmap can crash your software you should a) know that and b) not release it. In 2017, you absolutely have a reasonable expectation that network systems are safe to nmap. You might be wrong, but that's a completely reasonable assumption.

I agree with you, that the expectation is reasonable, however in the real world this is not always the case. I totally agree that the systems should be tested for this, and if not they shouldn't be in a live environment.

However I draw the line when an unauthorized actor accesses a live system to prove a point, rather than going through proper procedures with absolutely no knowledge of the potential outcomes of his or her actions. This isn't white hat by any stretch of the imagination, and is incredibly reckless.

Re: Boeing 787 In Flight Entertainment System Security fun

#123

Post by alkonaut »

dx034 wrote: post #13
theWatcher37 wrote: post #8

Earlier quoted context omitted.

So what does that say about the wisdom of port scanning a machine your life is currently depending on?

It would probably not harm the aircraft but would be bad enough if it freezes the entertainment system for all passengers. If the ~300 other people on board find out that you're the one responsible for their boredom on a 10 hour flight, you won't have a great time.

Has anyone taken a 10h flight where the IFE was not rebooted due to some problem?

Agree the IFE could crash, but can't see how there is even a remote risk to critical systems, or any risk to the IFE that isn't solved by (yet another) reboot of it.

Re: Boeing 787 In Flight Entertainment System Security fun

#124

Post by rconti »

kevin_b_er wrote: post #20

Were the in flight entertainment touchscreens really capactive? I've found that such designs have almost exclusively been resistive. The resistive designs are cheaper, but also tend to be designed with a high threshold. The two put together makes a lot of resistive touchscreens feel sluggish. You feel like you have to mash the heck out of them to get them to act sometimes. On the upside they don't require human capac…

Oh man, I was on a recent Austrian 767 trans-atlantic flight where they use a touchscreen (capacitive, I suppose) for the seat controls. Where did they put it? Right under where your forearm would go. There was no visual confirmation for hitting the buttons, which mean it was virtually impossible to tell if your seat was doing what you wanted it to do when you 'pressed' the buttons, but then it would randomly do stuff you DIDN'T want it to do just while you're sitting there.

I took to leaving my phone on top of the seat controls, but even then seemed to have weird gremlins.

I'm not sure who designed that, but it was.. not smart. Poor design, poor implementation.

Re: Boeing 787 In Flight Entertainment System Security fun

#125

Post by alkonaut »

zero_one_one wrote: post #68

There's a lot of posts mentioning that a scan shouldn't cause any trouble, however there's no way of knowing how the services are configured on the other end, or how they are set up to respond to certain packet types, or how the server will respond to certain data within those packets if said data does not conform to expected lengths etc. A lot of assumptions are made that non-conforming data will be ignored in a clo…

Irresponsible and stupid perhaps, but a lot of exaggeration here too.

I'd say the absolute worst case scenario is that the IFE crashes and must be restarted. Not a great result but not a plane crash and not a 10h flight without IFE either.

Re: Boeing 787 In Flight Entertainment System Security fun

#126

Post by nsxwolf »

tptacek wrote: post #76
sschueller wrote: post #46

Earlier quoted context omitted.

Swissair flight 111 crashed because of a fire that started in in flight entertainment system. Although isolated it still caused a fire that caused the highest death toll for the MD11 which was considered a very safe aircraft. https://en.m.wikipedia.org/wiki/Swissair_Flight_111

It crashed due to faulty wiring in the IFE, which started an electrical fire. It could just as easily have been the coffee maker.

Well, imagine a fire due to faulty wiring that is accidentally triggered by some hack. Maybe absurd but not impossible. Why mess with any in-flight system?

Re: Boeing 787 In Flight Entertainment System Security fun

#127

Post by kakwa_ »

InTheArena wrote: post #94
sschueller wrote: post #46

Earlier quoted context omitted.

Swissair flight 111 crashed because of a fire that started in in flight entertainment system. Although isolated it still caused a fire that caused the highest death toll for the MD11 which was considered a very safe aircraft. https://en.m.wikipedia.org/wiki/Swissair_Flight_111

The MD-11 is considered a safe aircraft, because almost all airliners are very very safe. comparatively to the Airbus and Boeign equivalent, it is not viewed as a particularly safe aircraft, as it was derived from the DC-10 (which had a epically bad reputation). while a lot of the issues with the DC-10 were fixed, there longer length of the plane caused issue.s

Actually, it was not that safe. To reduce fuel consumption, Douglas used a quite small tail for an aircraft that size.

Consequently the MD-11 has to land at high speed which makes it prone to catastrophic bounced landing like the 2 Fedex crashes.

Also, it was not produced for very long (compared to other aircrafts from Boeing or Airbus) and the fleet was either retired or converted to freighters quickly by airlines.

Re: Boeing 787 In Flight Entertainment System Security fun

#128

Post by tcdent »

porsupah wrote: post #102
mseebach wrote: post #82

Earlier quoted context omitted.

I remember about 20 years ago, you could crash any Windows computer you had the IP address of by sending a particularly crafted package to a certain port. Oh, those were the days.

Port 139, maybe? http://insecure.org/sploits/windows.OOB.DOS.html

Also, ping of death:

http://insecure.org/sploits/ping-o-death.html

Re: Boeing 787 In Flight Entertainment System Security fun

#129

Post by bonzini »

SilasX wrote: post #121
tptacek wrote: post #77

Earlier quoted context omitted.

This keeps getting cited on this thread. The IFE didn't simply "overheat". It had faulty wiring . The coffee maker could just as easily have caused that accident.

Yeah, but that's sort of the rub, isn't it? It's faulty wiring that won't, in practice, overheat unless you overload the server with (say) a port scan. So yes, the aircraft is supposed to be robust against any trickery with the entertainment system. And indeed, it's 100% their fault for installing the wiring in a way that would overhead under load. It's still pretty irresponsible to risk taking down the aircraft like…

If a port scan can overload a server, it could also be a bug in the JavaScript code that runs on the clients. Too many AJAX requests and the plane goes down? I sure hope not...

Re: Boeing 787 In Flight Entertainment System Security fun

#130

Post by bonzini »

_0w8t wrote: post #118
dkersten wrote: post #111

Earlier quoted context omitted.

"lives at risk" is a bit of a stretch. They might take down the IFE and people might be bored, but they won't take the plane down. The telemetry data is read-only (the hardware is physically isolated and transmission one way -- systems that need write access are isolated from the ones that only need read access, and have to go through a slew of certification processes). (I work on IFE and avionics)

Is this still true with 787? [1] indicates that it uses virtual links that are not physically separated. [1] - https://en.m.wikipedia.org/wiki/ARINC_429

The protection lies between that bus and the TCP/IP stack of the IFE. Data can go one way, and several feet of certification documents are there to ensure that.
Post reply on HN