3 ms·

British Airways Entertainment System Chat App Crash (2019)

16 points by Etheryte 6y ago

sawaruna 6y ago
>The vulnerable application is the interactive chat application that allows to send messages to other passengers. A bit of a side note here, but does anyone actually use this? I remember seeing it on an ANA flight and thought it was a funny feature. I suppose the intent is to message someone you know if you happen to be seated far away, but the thought of sending random unsolicited messages to any seat (assuming there isn't something to prevent this, e.g. message receiving is off by default unless you allow specific seat numbers) is a bit fun / odd. 'Seat 24B here, anyone else can't sleep?'
- senectus1 6y ago
  imagine being able to broadcast "This flight is da-bomb" or "Who's up for mile high club?" yeah not a good plan...
- numpad0 6y ago
  Yeah I don’t understand it either, though it seems a standard feature. Maybe it makes sense for large groups? Or maybe it’s a ping tool for maintenances?
- toomanybeersies 6y ago
  From memory (at least on some implementations), you need to enter the booking reference for whoever is sitting at the seat you're trying to chat to.
  - sawaruna 6y ago
    Figures there would be some obstacle.
- thiscatis 6y ago
  I tried to use it once and it's basically pointless. Having the Air Chat app is a way better way do this (mesh / peer 2 peer bluetooth and wifi chat).
jojobas 6y ago
Reminds me of that time when a guy hacked a plane: https://edition.cnn.com/2015/05/17/us/fbi-hacker-flight-computer-systems/index.html https://edition.cnn.com/2015/05/17/us/fbi-hacker-flight-comp...
kjaftaedi 6y ago
What a bizarre write up. Crashing a single program on your own workstation isn't a "Denial of Service attack" I mean you might be denying yourself service, but you could just as easily pour coffee on your equipment.
toomanybeersies 6y ago
I really don't see how this is a vulnerability or a denial of service attack, any more than hitting my laptop with a hammer is a denial of service attack. Maybe it's a buffer overflow, but that's at best an educated guess from the author.
- saagarjha 6y ago
  I’d be surprised if it was a buffer overflow, most applications aren’t using unsafe languages in that way these days. I would guess some sort of memory exhaustion.
nbevans 6y ago
What happened here was... he was copy pasting the text to grow its size exponentially. After about 20 or so copy pasting cycles, the UI of the chat app became unresponsive on the UI thread (because of the copy paste operation it was handling) and some watchdog process decided the chat app needed to be terminated because it was unresponsive for longer than a configured time span. This isn't a vulnerability and doesn't warrant a CVE - the system was operating normally. That's my take anyway. Thoughts?
- saagarjha 6y ago
  Getting a CVE is fairly easy, you can generally just show up with any sort of bug in a production system and more often than not they’ll give you one.

16 points by Etheryte 6y ago

>The vulnerable application is the interactive chat application that allows to send messages to other passengers. A bit of a side note here, but does anyone actually use this? I remember seeing it on an ANA flight and thought it was a funny feature. I suppose the intent is to message someone you know if you happen to be seated far away, but the thought of sending random unsolicited messages to any seat (assuming there isn't something to prevent this, e.g. message receiving is off by default unless you allow specific seat numbers) is a bit fun / odd. 'Seat 24B here, anyone else can't sleep?'

senectus1 6y ago
imagine being able to broadcast "This flight is da-bomb" or "Who's up for mile high club?" yeah not a good plan...
numpad0 6y ago
Yeah I don’t understand it either, though it seems a standard feature. Maybe it makes sense for large groups? Or maybe it’s a ping tool for maintenances?
toomanybeersies 6y ago
From memory (at least on some implementations), you need to enter the booking reference for whoever is sitting at the seat you're trying to chat to.
- sawaruna 6y ago
  Figures there would be some obstacle.
thiscatis 6y ago
I tried to use it once and it's basically pointless. Having the Air Chat app is a way better way do this (mesh / peer 2 peer bluetooth and wifi chat).

jojobas 6y ago

Reminds me of that time when a guy hacked a plane: https://edition.cnn.com/2015/05/17/us/fbi-hacker-flight-computer-systems/index.html https://edition.cnn.com/2015/05/17/us/fbi-hacker-flight-comp...

kjaftaedi 6y ago

What a bizarre write up. Crashing a single program on your own workstation isn't a "Denial of Service attack" I mean you might be denying yourself service, but you could just as easily pour coffee on your equipment.

toomanybeersies 6y ago

I really don't see how this is a vulnerability or a denial of service attack, any more than hitting my laptop with a hammer is a denial of service attack. Maybe it's a buffer overflow, but that's at best an educated guess from the author.

saagarjha 6y ago
I’d be surprised if it was a buffer overflow, most applications aren’t using unsafe languages in that way these days. I would guess some sort of memory exhaustion.

nbevans 6y ago

What happened here was... he was copy pasting the text to grow its size exponentially. After about 20 or so copy pasting cycles, the UI of the chat app became unresponsive on the UI thread (because of the copy paste operation it was handling) and some watchdog process decided the chat app needed to be terminated because it was unresponsive for longer than a configured time span. This isn't a vulnerability and doesn't warrant a CVE - the system was operating normally. That's my take anyway. Thoughts?

saagarjha 6y ago
Getting a CVE is fairly easy, you can generally just show up with any sort of bug in a production system and more often than not they’ll give you one.