Slashdot Mirror
Aircraft Entertainment Systems Hacks Are Back (threatpost.com)
Reader msm1267 writes: Researchers at IOActive today disclosed vulnerabilities in Panasonic Avionics In-Flight Entertainment Systems that were reported to the manufacturer close to two years ago. The flaws could be abused to manipulate in-flight data shown to passengers, or access personal information and credit card data swiped at the seat for premium entertainment or Internet access. Given that the firmware is customizable and used by dozens airlines in hundreds of aircraft models, the researchers said it's almost impossible to determine whether the vulnerabilities no longer exist across the board. IOActive said that segmentation between aircraft control and information services that oversee avionics and operational control of a plane should isolate these vulnerabilities to passenger entertainment domains. Whether an attacker could cross those domains and affect critical avionics systems would depend on specific devices and configurations, IOActive said, given that a physical path could exist that connects those systems through satellite communications terminals that provide in-flight updates to critical systems. The concern is that whether in some configurations, IFEs would share access to these devices and provide the physical path an attacker would need to reach critical systems. As for the vulnerabilities in passenger systems, IOActive said there is a lack of authentication and encryption between an on-board server and clients at passenger seats. This could allow an attacker on board to send commands to the IFE system to manipulate what's displayed to passengers, or read payment card data swiped at seats.
So anyone can access the _MAKE_AIRPLANE_CRASH_ API call!
Again these hacks are fun but not scary at all. the Infotainment system has NO CONNECTION tot he avionics.
Do not look at laser with remaining good eye.
With the way a lot of these plane systems work these days, it could be a way to download a lot of "free" movies and music.
Peter predicted that you would "deliberately forget" creation 2000 years ago...
IOActive said that segmentation between aircraft control and information services that oversee avionics and operational control of a plane should isolate these vulnerabilities to passenger entertainment domains.
That may have been true on older models, but Boeing got an exception to the separation rule for the 787. What's worse, the primary authentication method used to provide 'security' is a protocol that filters packets based on MAC addresses. So you can't plug your own gizmo into an avionics bus. But if you can trick the passenger entertainment units into generating bogus air data (for example), bad stuff can happen.
Have gnu, will travel.
The majority of planes I fly on seldom even have electric outlets to plug in your laptop. I'm usually on the single-class (cattle-class / steerage-class) flights where nobody has anything. I'm not important enough to be on the long haul flights where people expect more than a bag of peanuts and half a can of soda.
Not saying that I like it that way, just that apparently I have less to worry about as a result.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
He tried to show them they were exploitable, they kicked him off a plane and charged him with a bunch of nonsense and they haven't done anything to really fix the problem.
Get him back to One World Labs where they can stop this nonsense.
Please?
Place something witty here
the 21st century in the first place? I have my notebook and my smartphone with me.
Instead a dorky display and a headset provide better a normal WiFi. Besides a WiFi router weighs only about 300 grams, instead of a ton of hundreds of displays, and a WiFi router costs only a couple of hundred instead of millions for this System, which later ends up in the price of our air-tickets.
Add to this the cost of additional fuel to carry these displays. Why would I want to pay for the fuel to carry these displays when I have already three HD screens with me anyway?
Whilst I've worked with Panasonic Avionics , and they are not the info section "A" team...
The IFE systems are essentially air gapped already as a mandatory requirement by regulatory agencies - ACARS is basically an RSS feed to the IFE system and anything other than that is separate again. IFE has no in the air satellite connection on any deployments I've seen .
This is the digital equivalent of hacking a highway sign to say rude words.
What about hacking the display of in-flight data to show the plane going a different direction? Maybe a message that the plane has been hijacked? No need to bring down the plane with code if you can get the passengers to break into the cockpit and do it.
I eat only the real part of complex carbohydrates.
Now, I haven't travelled on a US airline since 2000, and even then they were worse than any other I've travelled with. If they got even worse, I can certainly understand the complaints, but all I can say is perhaps people should try an airline outside the US. They might just regain some hope for air travel.
I recall seeing the list of best airlines, and if I remember correctly the highest rated US airline was in the 40'th position or something like that. If I wasn't on mobile right now I'd find the link.
Whilst I've worked with Panasonic Avionics , and they are not the info section "A" team...
The IFE systems are essentially air gapped already as a mandatory requirement by regulatory agencies - ACARS is basically an RSS feed to the IFE system and anything other than that is separate again. IFE has no in the air satellite connection on any deployments I've seen .
This is the digital equivalent of hacking a highway sign to say rude words.
Just because it's mandated doesn't mean engineers weren't ordered to ignore that mandate. See: Volkswagen.
That might be a little paranoid but air safety authorities don't know the meaning of the word paranoid.
However you can do a lot of damage with just a message, like sowing mass panic. If you've ever seen a stampede inside a barn you can imagine what it's like. People aren't much smarter than cows on aircraft in my experience and if they're all told the plane has been hijacked I can see mass panic starting.
Calling someone a "hater" only means you can not rationally rebut their argument.