Live data from Hacker News

Boeing 787 In Flight Entertainment System Security fun

btr.pm

141–147 of 147 posts

Re: Boeing 787 In Flight Entertainment System Security fun

#141
post #57

Earlier quoted context omitted.

So we're supposed to just take your word for it, in the face of contradictory evidence?

You don't have to go any further than the Wikipedia article the previous commenter provided to see that no evidence has been provided for how sending packets to an IFE could take down a plane.

Fair enough, but lack of evidence in this one case is not evidence that IFE systems are invincible. That's quite an extraordinary claim.

Re: Boeing 787 In Flight Entertainment System Security fun

#142
Some domestic Chinese airlines I have flown sidestep most IFE problems completely. As you enter the plane, you are issued a sturdy, fully charged Android tablet computer that is fully loaded with entertainment content. You return the tablet as you exit the aircraft. If something is going wrong with your tablet they give you a fresh one.

So many good things with this approach: cost, easy upgrades, no complicated certification or hardening needed.

I have no idea why no other airlines use this method, it seems so much easier to me.

Re: Boeing 787 In Flight Entertainment System Security fun

#143
post #95

Earlier quoted context omitted.

During a pentest?

What about this write-up leads you to believe that a pentest ever has (or will (on purpose)) happened??

If there was a penetration test, do you think Boeing would publish unpatched vulnerabilities in their own product?

Re: Boeing 787 In Flight Entertainment System Security fun

#144
post #140

Earlier quoted context omitted.

The protection lies between that bus and the TCP/IP stack of the IFE. Data can go one way, and several feet of certification documents are there to ensure that.

A stack of paper on the ground is of little comfort to me in the sky. If there is a physical (TCP/IP!) connection between two systems there is a potential for communication between them. No amount of certification will ever make that as secure as an air gap.

There are hardware diodes.

There is no physical way to write through those.

Re: Boeing 787 In Flight Entertainment System Security fun

#145
post #140

Earlier quoted context omitted.

The protection lies between that bus and the TCP/IP stack of the IFE. Data can go one way, and several feet of certification documents are there to ensure that.

A stack of paper on the ground is of little comfort to me in the sky. If there is a physical (TCP/IP!) connection between two systems there is a potential for communication between them. No amount of certification will ever make that as secure as an air gap.

As parent said, communication on the avionics side happens on a specialized bus, to which the entertainment side has read access only, enforced either through hardware or through highly-certified software (Common Criteria EAL6 or even EAL7) on the secure side.

Re: Boeing 787 In Flight Entertainment System Security fun

#146

Earlier quoted context omitted.

Electrical safety airgapping and information security airgapping are different, and entirely unrelated. If data can pass from one side to the other it's not airgapped (from an infosec perspective).

Fiber needs transmitter and receiver transducers. If each side has only one of those, data can literally flow only in one direction. So it's still infosec-airgapped in the other.

No, data diodes are a different (but related) concept. An airgap implies no information transfer, either in or out. Use an airgap when information leakage must be stopped (as well as remote attacks), use a data diode when information can be released but you need to stop remote attacks.

Fiber optic connections aren't required, anything with separate transmit and receive lines can be turned into a data diode (as long as the protocols used permit it). RS232 null modem cables with the RX lines disconnected are a classic.

Re: Boeing 787 In Flight Entertainment System Security fun

#147

It's really quite useful. I changed my zsh prompt a while back to show me the status of the internet connection on board, remaining time, flight number and from where to where the plane is going. https://twitter.com/mitsuhiko/status/867043286128656384

Very cool. I saw that you handle Lufthansa as well, now.

Tiny nitpick:

In my understanding, ETA denotes a point in time, e.g. 22:50h, that is the estimated time at which you arrive. (Absolute)

If you want to specify a duration in this context, i.e. how much longer until arrival, e.g. 0:53h for another 53 minutes until arrival, you'd speak of the ETE (estimated time enroute). (Relative)

See (in German) e.g. https://de.wikipedia.org/wiki/Estimated_time_of_arrival

tl;dr: use "ete" instead of "eta"

Post reply on HN