7 ms·

For those interested in the various aircraft systems for PA (public address) and aircraft status system for aircrew, I found this interesting training doc PDF o

by rx_tx 4y ago

For those interested in the various aircraft systems for PA (public address) and aircraft status system for aircrew, I found this interesting training doc PDF online [1] for the A320/321. I have been looking at section "03-010 CABIN INTERCOMMUNICATION DATA SYSTEM" It does not mention the "medical intercom jacks" in overhead bins that are mentioned at the end of the article [1]:https://caisatech.net/uploads/XXI_3_AIRBUS_H51_A320_O_CCOM_R0_13JUL2012.PDF https://caisatech.net/uploads/XXI_3_AIRBUS_H51_A320_O_CCOM_R...

bb88 4y ago
Apparently there is a compact flash card to play music and the pre-recorded announcement over the loud speakers. I wonder if someone replaced the standard announcement with a 5 hour long file with intermittent burps and groans....
- TheBlight 4y ago
  They would probably notice that but it does seem like some former passenger most likely installed something that's patched into the system. It may just be a recording from a flash drive. Or it could also be more sophisticated and patch into the wifi as well. You could also imagine it having a microphone for added hijinx but none of the interactions seem to suggest that.
  - panarky 4y ago
    I've flown American six times in the last ten days, and four of the flights had chaos with the entertainment system. No groans or heavy breathing on the PA, but flight attendants had to "reboot the system" once or twice every flight.
    - oefrha 4y ago
      I once captured the Linux boot screen of a United Boeing 737 infotainment system. Apparently I still got that photo. OCRed text for lols: video capture buffer0 40b37460 video capture buffer1 40a8dd60 wideo_capture buffer2 409e4610 geode_: gamma black+csccorrection VAL2: Registered "NSC Geode V4LZ UBI driver" as char device B1, 224 VAL2: Registered "NSC Geode V4L2 Capture driver" as char device 81, geode_v: Unknown standard VAL2: Registered "NSC Geode V4LZ Overlay driver" as char device B1, 16 Warning: loading /lib/modules/realmagichul_kernelland.o will taint the kernel: non-GPL license - Proprietary. Copyright (c) 2002 Sigma Designs Inc. All rights reserved (version 103 with proc pci dolby css macrovision sm2288 osdric_memorycheck), /lib/modules/realmagichul_kernelland.o:init_module:Invalidargument Hint: insmod errors Can be caused by incorrect module parameters, including invalid IO or IRQ parameters PCI: Setting latency timer of device 00:12.3 to 32 geodeoss: disabling PM: PM registration failed geodeoss: version 1.2.0 time 12:37:36 Dec B 2004 geodeoss: use_pm=0 check_interrupt=0 Warning: loading /lib/modules/maspcu.o will taint the kernel: no license usb.c: registered new driver pcu MAS-eFX SEB USB PCU driver version 1.01 usb.c: registered new driver usbccr usb_ccr open is being called (0xc165f000 ) <6›ccrdev.c: Adding credit card reader: input1 input1: Panasonic Avionics Corp PAC USB Keyboard/Credit Card Reader Ver. 1.01 on usb1:2.1 usbccr.c: v0.59:USB HID Credit Card Reader driver mice: PS/2 mouse device common for all mice usb.c: registered new driver pacpcu geode rev-7 pmr-03a834c4 mcr-00030250 using /dev/mtd1 /usr/app --- mount succeeded --- using /dev/mtd4 /usr/app2 --- mount succeeded ---
      - ksaj 4y ago
        Some of the time is because they have a single board computer, and only licensing the BIOS. You'll know if that's the case if after the boot, you see it purposely set the time to something arbitrary, but dating back to the 90's. To the flight entertainment, the date doesn't really matter. For the licensing however, it does. Also elsewhere in the boot, you might notice they tend to be 80486 CPU emulation boards from Cyrix. They're not fast at all, but for what they do, they don't need to be. Also, if you took video instead of a pic, there are a few interesting IP addresses might scroll by as the media program gets initialized.
      - flutas 4y ago
        > I once captured the Linux boot screen of a United Boeing 737 infotainment system. I used to work adjacent to these exact systems...they're so bad. Like, 10+ minute boot at times, or assigning multiple devices to the same IP, or the communication network just randomly dying... (and this was all in vitro testing) It was still cool to see "the rack", aka an entire planes infotainment system setup on a rolling cart including however many seat backs each plane was supposed to have. They had multiple office buildings that were essentially full of these, because each airline and deployment was different enough that they didn't want to have to reconfigure when needing to test them.
      - joezydeco 4y ago
        Oh man, the NatSemi Geode (aka Cyrix MediaGX). What a system. I'm amazed anyone got a usable Linux system out of it at all.
    - 6stringmerc 4y ago
      They might be doing that out of caution just to keep it from being exploited. Sounds like something management or the Flight Crew might decide is a band aid if one tries it and it works then everybody starts doing it. Knee jerk reaction but sounds like they’re stumped.
      - ksaj 4y ago
        If you watch the whole boot, they purposely set the date to the 90's. I think it is because they don't want to pay the license for the BIOS. You can see some text about that license scroll by as well. I've seen it often, and somewhere on an old PeeCee buried in the darkest areas of my home office, I have a video of the whole sequence.
      - nightpool 4y ago
        That's true, but there's also reports from flight attendants of it happening spontaneously before the issue was known about: https://twitter.com/xJonNYC/status/1572358118985633795 https://twitter.com/xJonNYC/status/1572358118985633795
        consumer451 4y ago
        Deeper link to video of it happening: https://twitter.com/actuallyemerson/status/1573107117254639616 https://twitter.com/actuallyemerson/status/15731071172546396...
    - docmars 4y ago
      I recently had some funny business on a United Airlines flight where the high-low chime (you hear for the seatbelt sign and landing gear, etc.) was going bonkers and chimed maybe 10 times in a row while the cabin lights faded on and off. No announcements were made by the pilot or flight attendants afterwards, and everyone was left confused. I turned to the passenger next to me and we both shrugged.
  - josu 4y ago
    If it were just one passenger it would be easy to find out who she is by cross checking passenger lists. So probably not. Maybe a coordinated 4chan-style prank.
  - bb88 4y ago
    What's interesting is that it appears that the CF card slot is only accessible behind a panel. The only people that would have access to that are likely the ground crew -- possibly doing a software update, or other maintenance on that panel.
- bemmu 4y ago
  If there is such a flash card, this sounds like the easiest explanation. Someone swapped the card with a file that starts with the real announcement, then X minutes of silence, followed by joke sounds.
  - smelendez 4y ago
    Absolutely did this in middle school music class, where there was a cassette player that usually went unused. I don’t remember the details but it was basically 10 minutes of silence and then some raunchy audio, probably NIN or Marilyn Manson (it was 1998 and we were 12).
  - joezydeco 4y ago
    Especially if the crew is used to the player stopping automatically at the end of the spiel. The attendants wouldn't suspect the player because the earlier announcement ended so why would playback still be going?
- O__________O 4y ago
  Looked at that too, but since unless I am missing something, that appears to be in the captain’s cabin based on linked document from the parent of this comment thread; which means it would not only be hard to access, but once placed, very likely be hard to recover and would have been checked too, likely even in flight while the audio continued to be heard.
- deltaray3 4y ago
  Another idea is that there is a source file that is copied onto the flash card on a regular basis and someone has hacked the source back at the office or something. Seems more likely because that wouldn't require the perpetrator to be on each flight and thus less likely to get caught. Some of these flights play music as you board the plane, could it be that this comes from music on a flash card and someone has replaced that?
xky 4y ago
There’s also this video overview of the system. https://youtu.be/0l2jUPI1fpk https://youtu.be/0l2jUPI1fpk
wildrhythms 4y ago
I'm struggling to understand how this would explain the account here: >Then the master power button up at 1L for the cabin power kept getting I pushed so it would shut off all the IFE, seat power and outlets. I had to push the button on again about 3 times inflight. Then the 2 got a call with the same groaning noise and thought it was one of us playing a joke but it wasn't us. >It certainly was freaking all of us and the passengers. They wanted off the plane as bad as we did. The 2 be FAs said they had been on the plane the other day and the same thing happened. I had a visual on each FA when the noise would come over the PA and one time when the FO was doing a break so unless the captain was playing a long sick, joke I don't have an explanation. https://twitter.com/xJonNYC/status/1572358118985633795 https://twitter.com/xJonNYC/status/1572358118985633795 Any ideas?
- culi 4y ago
  > Then the master power button up at 1L for the cabin power kept getting I pushed so it would shut off all the IFE I can't even get passed the first sentence of this. What does any of this mean?
  - saryant 4y ago
    1L is the forward-most door on the port (left) side. IFE is in flight entertainment.
  - iudqnolq 4y ago
    Uninformed guess: "The master [public address system] power button [located] up by [seat] 1L kept getting pushed so it would shut off all the IFE [(inflight entertainment)]" This makes sense, because for safety reasons all the entertainment is paused when they use the public address system.
    - thaumasiotes 4y ago
      > for safety reasons all the entertainment is paused when they use the public address system. It's more common for the entertainment to be muted without being paused. I assume that's as a convenience to the passengers.
w-ll 4y ago
My best guess its an unfunny "Easter Egg" that triggers after something like 5,000 hours of uptime. I think I remember some bug in Boeing or some other system that they need to actually be rebooted every 100 days.
- exmadscientist 4y ago
  I'm one of those people who thinks easter eggs are great, and miss the days when you had a decent chance of coming across one in a program or game. The FAA does not agree with that. The FAA probably thinks that easter eggs in avionics software are a crime. And I agree with that position! Aviation, medical, military, and any other critical software should not contain easter eggs, and it should be an offense to knowingly include one. Stuff like this (even though it's probably not an easter egg) is a great example why. Just imagine the cost to patch this if it's widespread... and it has to be patched, because this one can literally kill people if you don't fix it (think spooked flight crews making rushed or generally poor decisions if you don't think this is potentially lethal).
  - _zzaw 4y ago
    Reminds me of when a security researcher discovered that, in addition to some serious security flaws, certain Siemens PLCs had monkeys hidden in their firmware: https://arstechnica.com/information-technology/2011/08/serious-security-holes-found-in-siemens-control-systems-targeted-by-stuxnet/ https://arstechnica.com/information-technology/2011/08/serio... According to the researcher who found it, "they didn’t think it was very funny.” I love easter eggs myself—classic Apple software in particular had a lot of these, and I really miss finding them—but they're admittedly a risk. I remember one obscure Easter egg in Mac OS 7.6 that occasionally caused crashes at boot time after displaying a bizarre message about how "bluets and granola bars / make a chewy snack". Cute, but probably not something Apple wants to be getting customer support requests about. As far as the topic at hand, I don't believe these weird noises are an Easter egg, either. I'd guess it's a recording patched in somehow by someone who works for the airline.
    - exmadscientist 4y ago
stickfigure 4y ago
A bit of searching for airplane medical communications jacks turned up this picture: https://aviation.stackexchange.com/questions/12776/how-are-the-medical-communication-headset-sockets-on-some-airliners-used https://aviation.stackexchange.com/questions/12776/how-are-t... Jacking into that would not be inconspicuous.
- morsch 4y ago
  Could that pick up a transmission from a device designed to emit RF stored in the overhead above?
- camkego 4y ago
  If those are 1/4" or 6.35mm audio phone jacks, I'm sure there are lots of electrical engineers who could design a pre-recorded player that would fit ENTIRELY inside the jack without protruding outside the jack whatsoever.
  - stonegray 4y ago
    Eh, only one way to find out. An ESP32-PICO-D4 is 7mm wide, but based on internal images it appears you can safely grind it down to ~6.35mm. It contains a DAC, 4MB flash, and all needed peripherals plus bluetooth. The quality [1] would be poor, but this matches what we observed. A circuit board would probably be out of the question given the size. Even 0.8mm would have very little usable area. Flex PCB could work well, but is probably overkill for the complexity required. I'd expect a project like this to be hand soldered, given the low (less than 6?) component count. It wouldn't be easy, but well within the capabilities of a hobbyist at home with a cheap USB microscope. For power, I could imagine a repurposed AirPod battery (they fit in the 0.235 inch diameter "stem" of the headphone) with a deadbugged switching or linear regulator fitting both the power budget and the size constraint. From a physical design perspective, a lot of traditional methods seem impractical. With this size constraint one possibility could be placing requisite components into a 1/4" jack shaped mold, and casting it in epoxy in a vacuum, completing the conductive surfaces with copper tape. 1. https://www.youtube.com/watch?v=lgDu88Y411o https://www.youtube.com/watch?v=lgDu88Y411o I could definitely make one as a demo.

by rx_tx 4y ago

bb88 4y ago

Apparently there is a compact flash card to play music and the pre-recorded announcement over the loud speakers. I wonder if someone replaced the standard announcement with a 5 hour long file with intermittent burps and groans....

TheBlight 4y ago
They would probably notice that but it does seem like some former passenger most likely installed something that's patched into the system. It may just be a recording from a flash drive. Or it could also be more sophisticated and patch into the wifi as well. You could also imagine it having a microphone for added hijinx but none of the interactions seem to suggest that.
- panarky 4y ago
  I've flown American six times in the last ten days, and four of the flights had chaos with the entertainment system. No groans or heavy breathing on the PA, but flight attendants had to "reboot the system" once or twice every flight.
  - oefrha 4y ago
    I once captured the Linux boot screen of a United Boeing 737 infotainment system. Apparently I still got that photo. OCRed text for lols: video capture buffer0 40b37460 video capture buffer1 40a8dd60 wideo_capture buffer2 409e4610 geode_: gamma black+csccorrection VAL2: Registered "NSC Geode V4LZ UBI driver" as char device B1, 224 VAL2: Registered "NSC Geode V4L2 Capture driver" as char device 81, geode_v: Unknown standard VAL2: Registered "NSC Geode V4LZ Overlay driver" as char device B1, 16 Warning: loading /lib/modules/realmagichul_kernelland.o will taint the kernel: non-GPL license - Proprietary. Copyright (c) 2002 Sigma Designs Inc. All rights reserved (version 103 with proc pci dolby css macrovision sm2288 osdric_memorycheck), /lib/modules/realmagichul_kernelland.o:init_module:Invalidargument Hint: insmod errors Can be caused by incorrect module parameters, including invalid IO or IRQ parameters PCI: Setting latency timer of device 00:12.3 to 32 geodeoss: disabling PM: PM registration failed geodeoss: version 1.2.0 time 12:37:36 Dec B 2004 geodeoss: use_pm=0 check_interrupt=0 Warning: loading /lib/modules/maspcu.o will taint the kernel: no license usb.c: registered new driver pcu MAS-eFX SEB USB PCU driver version 1.01 usb.c: registered new driver usbccr usb_ccr open is being called (0xc165f000 ) <6›ccrdev.c: Adding credit card reader: input1 input1: Panasonic Avionics Corp PAC USB Keyboard/Credit Card Reader Ver. 1.01 on usb1:2.1 usbccr.c: v0.59:USB HID Credit Card Reader driver mice: PS/2 mouse device common for all mice usb.c: registered new driver pacpcu geode rev-7 pmr-03a834c4 mcr-00030250 using /dev/mtd1 /usr/app --- mount succeeded --- using /dev/mtd4 /usr/app2 --- mount succeeded ---
    - ksaj 4y ago
      Some of the time is because they have a single board computer, and only licensing the BIOS. You'll know if that's the case if after the boot, you see it purposely set the time to something arbitrary, but dating back to the 90's. To the flight entertainment, the date doesn't really matter. For the licensing however, it does. Also elsewhere in the boot, you might notice they tend to be 80486 CPU emulation boards from Cyrix. They're not fast at all, but for what they do, they don't need to be. Also, if you took video instead of a pic, there are a few interesting IP addresses might scroll by as the media program gets initialized.
    - flutas 4y ago
      > I once captured the Linux boot screen of a United Boeing 737 infotainment system. I used to work adjacent to these exact systems...they're so bad. Like, 10+ minute boot at times, or assigning multiple devices to the same IP, or the communication network just randomly dying... (and this was all in vitro testing) It was still cool to see "the rack", aka an entire planes infotainment system setup on a rolling cart including however many seat backs each plane was supposed to have. They had multiple office buildings that were essentially full of these, because each airline and deployment was different enough that they didn't want to have to reconfigure when needing to test them.
    - joezydeco 4y ago
      Oh man, the NatSemi Geode (aka Cyrix MediaGX). What a system. I'm amazed anyone got a usable Linux system out of it at all.
  - 6stringmerc 4y ago
    They might be doing that out of caution just to keep it from being exploited. Sounds like something management or the Flight Crew might decide is a band aid if one tries it and it works then everybody starts doing it. Knee jerk reaction but sounds like they’re stumped.
    - ksaj 4y ago
      If you watch the whole boot, they purposely set the date to the 90's. I think it is because they don't want to pay the license for the BIOS. You can see some text about that license scroll by as well. I've seen it often, and somewhere on an old PeeCee buried in the darkest areas of my home office, I have a video of the whole sequence.
    - nightpool 4y ago
      That's true, but there's also reports from flight attendants of it happening spontaneously before the issue was known about: https://twitter.com/xJonNYC/status/1572358118985633795 https://twitter.com/xJonNYC/status/1572358118985633795
      - consumer451 4y ago
        Deeper link to video of it happening: https://twitter.com/actuallyemerson/status/1573107117254639616 https://twitter.com/actuallyemerson/status/15731071172546396...
  - docmars 4y ago
    I recently had some funny business on a United Airlines flight where the high-low chime (you hear for the seatbelt sign and landing gear, etc.) was going bonkers and chimed maybe 10 times in a row while the cabin lights faded on and off. No announcements were made by the pilot or flight attendants afterwards, and everyone was left confused. I turned to the passenger next to me and we both shrugged.
- josu 4y ago
  If it were just one passenger it would be easy to find out who she is by cross checking passenger lists. So probably not. Maybe a coordinated 4chan-style prank.
- bb88 4y ago
  What's interesting is that it appears that the CF card slot is only accessible behind a panel. The only people that would have access to that are likely the ground crew -- possibly doing a software update, or other maintenance on that panel.
bemmu 4y ago
If there is such a flash card, this sounds like the easiest explanation. Someone swapped the card with a file that starts with the real announcement, then X minutes of silence, followed by joke sounds.
- smelendez 4y ago
  Absolutely did this in middle school music class, where there was a cassette player that usually went unused. I don’t remember the details but it was basically 10 minutes of silence and then some raunchy audio, probably NIN or Marilyn Manson (it was 1998 and we were 12).
- joezydeco 4y ago
  Especially if the crew is used to the player stopping automatically at the end of the spiel. The attendants wouldn't suspect the player because the earlier announcement ended so why would playback still be going?
O__________O 4y ago
Looked at that too, but since unless I am missing something, that appears to be in the captain’s cabin based on linked document from the parent of this comment thread; which means it would not only be hard to access, but once placed, very likely be hard to recover and would have been checked too, likely even in flight while the audio continued to be heard.
deltaray3 4y ago
Another idea is that there is a source file that is copied onto the flash card on a regular basis and someone has hacked the source back at the office or something. Seems more likely because that wouldn't require the perpetrator to be on each flight and thus less likely to get caught. Some of these flights play music as you board the plane, could it be that this comes from music on a flash card and someone has replaced that?

xky 4y ago

There’s also this video overview of the system. https://youtu.be/0l2jUPI1fpk https://youtu.be/0l2jUPI1fpk

wildrhythms 4y ago

I'm struggling to understand how this would explain the account here: >Then the master power button up at 1L for the cabin power kept getting I pushed so it would shut off all the IFE, seat power and outlets. I had to push the button on again about 3 times inflight. Then the 2 got a call with the same groaning noise and thought it was one of us playing a joke but it wasn't us. >It certainly was freaking all of us and the passengers. They wanted off the plane as bad as we did. The 2 be FAs said they had been on the plane the other day and the same thing happened. I had a visual on each FA when the noise would come over the PA and one time when the FO was doing a break so unless the captain was playing a long sick, joke I don't have an explanation. https://twitter.com/xJonNYC/status/1572358118985633795 https://twitter.com/xJonNYC/status/1572358118985633795 Any ideas?

culi 4y ago
> Then the master power button up at 1L for the cabin power kept getting I pushed so it would shut off all the IFE I can't even get passed the first sentence of this. What does any of this mean?
- saryant 4y ago
  1L is the forward-most door on the port (left) side. IFE is in flight entertainment.
- iudqnolq 4y ago
  Uninformed guess: "The master [public address system] power button [located] up by [seat] 1L kept getting pushed so it would shut off all the IFE [(inflight entertainment)]" This makes sense, because for safety reasons all the entertainment is paused when they use the public address system.
  - thaumasiotes 4y ago
    > for safety reasons all the entertainment is paused when they use the public address system. It's more common for the entertainment to be muted without being paused. I assume that's as a convenience to the passengers.

w-ll 4y ago

My best guess its an unfunny "Easter Egg" that triggers after something like 5,000 hours of uptime. I think I remember some bug in Boeing or some other system that they need to actually be rebooted every 100 days.

exmadscientist 4y ago
I'm one of those people who thinks easter eggs are great, and miss the days when you had a decent chance of coming across one in a program or game. The FAA does not agree with that. The FAA probably thinks that easter eggs in avionics software are a crime. And I agree with that position! Aviation, medical, military, and any other critical software should not contain easter eggs, and it should be an offense to knowingly include one. Stuff like this (even though it's probably not an easter egg) is a great example why. Just imagine the cost to patch this if it's widespread... and it has to be patched, because this one can literally kill people if you don't fix it (think spooked flight crews making rushed or generally poor decisions if you don't think this is potentially lethal).
- _zzaw 4y ago
  Reminds me of when a security researcher discovered that, in addition to some serious security flaws, certain Siemens PLCs had monkeys hidden in their firmware: https://arstechnica.com/information-technology/2011/08/serious-security-holes-found-in-siemens-control-systems-targeted-by-stuxnet/ https://arstechnica.com/information-technology/2011/08/serio... According to the researcher who found it, "they didn’t think it was very funny.” I love easter eggs myself—classic Apple software in particular had a lot of these, and I really miss finding them—but they're admittedly a risk. I remember one obscure Easter egg in Mac OS 7.6 that occasionally caused crashes at boot time after displaying a bizarre message about how "bluets and granola bars / make a chewy snack". Cute, but probably not something Apple wants to be getting customer support requests about. As far as the topic at hand, I don't believe these weird noises are an Easter egg, either. I'd guess it's a recording patched in somehow by someone who works for the airline.
  - exmadscientist 4y ago

stickfigure 4y ago

A bit of searching for airplane medical communications jacks turned up this picture: https://aviation.stackexchange.com/questions/12776/how-are-the-medical-communication-headset-sockets-on-some-airliners-used https://aviation.stackexchange.com/questions/12776/how-are-t... Jacking into that would not be inconspicuous.

morsch 4y ago
Could that pick up a transmission from a device designed to emit RF stored in the overhead above?
camkego 4y ago
If those are 1/4" or 6.35mm audio phone jacks, I'm sure there are lots of electrical engineers who could design a pre-recorded player that would fit ENTIRELY inside the jack without protruding outside the jack whatsoever.
- stonegray 4y ago
  Eh, only one way to find out. An ESP32-PICO-D4 is 7mm wide, but based on internal images it appears you can safely grind it down to ~6.35mm. It contains a DAC, 4MB flash, and all needed peripherals plus bluetooth. The quality [1] would be poor, but this matches what we observed. A circuit board would probably be out of the question given the size. Even 0.8mm would have very little usable area. Flex PCB could work well, but is probably overkill for the complexity required. I'd expect a project like this to be hand soldered, given the low (less than 6?) component count. It wouldn't be easy, but well within the capabilities of a hobbyist at home with a cheap USB microscope. For power, I could imagine a repurposed AirPod battery (they fit in the 0.235 inch diameter "stem" of the headphone) with a deadbugged switching or linear regulator fitting both the power budget and the size constraint. From a physical design perspective, a lot of traditional methods seem impractical. With this size constraint one possibility could be placing requisite components into a 1/4" jack shaped mold, and casting it in epoxy in a vacuum, completing the conductive surfaces with copper tape. 1. https://www.youtube.com/watch?v=lgDu88Y411o https://www.youtube.com/watch?v=lgDu88Y411o I could definitely make one as a demo.