Who's the guy in the in-flight entertainment system?(anders.io)
anders.io
Who's the guy in the in-flight entertainment system?
https://anders.io/whos-the-guy-in-the-in-flight-entertainment-system/
15 comments
Interestingly enough this is the reason why planes really arn't safe security wise.
Just about every other industry has to worry about Compsec researchers busting in and screaming that the end is nigh. But not airplanes. You even try touching one of them and you will be in for quite a ride through the joys of bureaucracy.
It's the basis of QA, your customers will use your product in ways you never intended. It could go on to say that through your customers misuse of the product you will be able to make your product better.
But with planes, the intended use gets so much more critical and the number of people who test it gets incredibly low. If these systems aren't tested, errors wont be found. And one day someone is going to hook up to a plane and try to bring it down. And it is because of this lack of use outside of intention that an attacker will be successful.
Obviously, I never want to be on a plane next to a security researcher plugged into the aircraft, but I think the secrecy around aircraft is their biggest vulnerability. A solution that would work somewhat counter intuitively would be parking a plane at LAS this summer for all the Black Hat and DEF CON attendees to play with. The resulting publications would without a doubt revolutionize aircraft security.
EDIT:Just fixing some grammar here and there.
Just about every other industry has to worry about Compsec researchers busting in and screaming that the end is nigh. But not airplanes. You even try touching one of them and you will be in for quite a ride through the joys of bureaucracy.
It's the basis of QA, your customers will use your product in ways you never intended. It could go on to say that through your customers misuse of the product you will be able to make your product better.
But with planes, the intended use gets so much more critical and the number of people who test it gets incredibly low. If these systems aren't tested, errors wont be found. And one day someone is going to hook up to a plane and try to bring it down. And it is because of this lack of use outside of intention that an attacker will be successful.
Obviously, I never want to be on a plane next to a security researcher plugged into the aircraft, but I think the secrecy around aircraft is their biggest vulnerability. A solution that would work somewhat counter intuitively would be parking a plane at LAS this summer for all the Black Hat and DEF CON attendees to play with. The resulting publications would without a doubt revolutionize aircraft security.
EDIT:Just fixing some grammar here and there.
In-flight entertainment system is barely connected to the important parts of the airplane, if at all.
Future HN headline:
Hackers Remotely Kill a Boeing during Flight - With Me in It
Hackers Remotely Kill a Boeing during Flight - With Me in It
Last week I would have sworn the same was true of cars.
We hope.
I have read that before, sounds like something a sales person would say. I have never seen a proper source for the statement.
And even so if the screen in-front of every passenger did then started to spew a bunch of boot logs and generally behave strangely. I beet people would become quite scared.
And even so if the screen in-front of every passenger did then started to spew a bunch of boot logs and generally behave strangely. I beet people would become quite scared.
[deleted]
I noticed the unmistakable X Windows "X" cursor and gray loading screen on an in-flight entertainment system that crashed on me. I think it was Virgin America, one of their early flights after they launched.
The Delta in-flight entertainment systems also (at least as of a couple years ago) seem to be Linux-based. I had one crash and reboot spontaneously while I was using it, and was greeted by a couple Tux logos and a verbose Linux 2.4 boot process when it came back up.
I used to freelance at one of the big two major IFE manufacturers. Their systems are a bit of a hodgepodge of platforms. Currently, the dominant platform is Linux, running either a) a QT based GUI or b) a HTML based GUI.
But most new planes coming off the ground today are moving to Android based systems, since they have many advantages - it's much easier to get content like games and apps, and cheaper to engineer and develop for.
One of the problems with IFE systems today is that both A380 and 787 deliveries have been significantly delayed - often the IFE hardware is just sitting in a warehouse for several years waiting for the plane to catch up to it. So by the time the plane finally is delivered to the customer the IFE system may already be 4-5 years out of date.
But most new planes coming off the ground today are moving to Android based systems, since they have many advantages - it's much easier to get content like games and apps, and cheaper to engineer and develop for.
One of the problems with IFE systems today is that both A380 and 787 deliveries have been significantly delayed - often the IFE hardware is just sitting in a warehouse for several years waiting for the plane to catch up to it. So by the time the plane finally is delivered to the customer the IFE system may already be 4-5 years out of date.
I helped someone sitting next to me on a flight deal with the fact that the touchscreen wasn't calibrated, you had to move your finger around and see where the cursor ended up, then start to translate your pokes a few inches. ;d
The In-App restarted on my Virgin Atlantic flight (About two months ago) and it was linux
Several years ago, on a transatlantic flight, I observed some strange behavior in a game when I specified a high score name with some special characters. I noticed it would crash and exit back to 'home'.
I tried to hack at it by specifying the semicolon and such, but could not get it to do more.
I observed they had it at least mildly secure - it would not accept input for some special characters when typed; they would simply not appear on the screen within the game. But clearly there are holes in these. Without more information on the construction it was not trivial though.
I tried to hack at it by specifying the semicolon and such, but could not get it to do more.
I observed they had it at least mildly secure - it would not accept input for some special characters when typed; they would simply not appear on the screen within the game. But clearly there are holes in these. Without more information on the construction it was not trivial though.
But as it is on an airplane traveling 900km/h 10 000m in the air. I dont feel like poking at stuff that is connected to the stuff that is keeping me and the other passengers alive.
Also it i don't feel like speeding life in prison.
But those things don't exactly feel like top quality stuff. They feel more like something that than be crashed and taken over in 20 minutes using a teensy++ and a Linux laptop.