6 ms·

It would be nice if you could send a POST request to open the door if you want some fresh air.

by c7DJTLrn 3y ago

pwillia7 3y ago
DELTE
hackmiester 3y ago
I tried to change the flight level by PATCHing altitude, but it seemed to require authentication. Oh well.
- CamperBob2 3y ago
  This sounds like a good way to meet some upset people with expensive sunglasses shortly after you land.
  - jmharvey 3y ago
    It's not like that at all. The sunglasses aren't that expensive.
    - hackernewds 3y ago
      after you land also open to interpretation
  - deleted 3y ago
    [deleted]
- ComputerGuru 3y ago
  Maybe you can take risks like that, but I certainly can’t. I don’t think anyone with my name or skin color would be given the benefit of the doubt for even a moment.
  - thomashop 3y ago
    Your comment made my day. Eye opening
  - foxhill 3y ago
    let me guess, you experience “random selection” events more than the expected amount? apologies for joking. it must suck.
    - ComputerGuru 3y ago
      Oh yes. Reminds me of the XKCD rand() comic!
hk1337 3y ago
Someone will probably figure out how to send a request to disable auto-pilot or turn off the fasten seat belt sign.
- naikrovek 3y ago
  the airline industry is nowhere nearly as stupid as the software industry with things like this. the communication between plane and wifi/entertainment system, if there is any, is almost certainly one-way. likely, the wifi system providing this info is receiving data from the flight systems and repeating it or transforming it a bit and providing that. it would not surprise me at all if the flight attendants have to program everything about the flight into the system prior to departure each flight, and there is no communication from the aircraft at all.
  - jpalomaki 3y ago
    "The computer network in the Dreamliner's passenger compartment, designed to give passengers in-flight internet access, is connected to the plane's control, navigation and communication systems, an FAA report reveals." [1] (I guess there's some kind of firewall, but we know that those are not always perfect) [1] https://www.wired.com/2008/01/dreamliner-security/ https://www.wired.com/2008/01/dreamliner-security/
    - AdamN 3y ago
      Not a problem as long as you reboot your Dreamliner every once in a while: https://www.theregister.com/2020/04/02/boeing_787_power_cycle_51_days_stale_data/ https://www.theregister.com/2020/04/02/boeing_787_power_cycl...
  - eep_social 3y ago
    IIRC the in-flight infotainment systems are entirely separate from the avionics control systems at the data layer. I recall being told that in some cases even the flight status is actually pulled from a 3p api service rather than hooked into the onboard avionics. There could be some fuckery via shared power or other non-data systems but that’s probably beyond someone sitting in a seat with standard laptop hardware.
fnord77 3y ago
Please stand by, a DHS agent will be with you shortly
queuebert 3y ago
You probably can. I suspect airliner software is appallingly insecure.
- epse 3y ago
  Relies very strongly on simple airgapping. Can't do anything to it if there's no wires in the direction you want. Can't remotely hack if there's nothing antenna connected that can talk to flight control. It has the luxury of not needing to do the "limited RCE" that is a modern web request
  - inopinatus 3y ago
    In the article above, in-flight wifi has an API reporting position, altitude, and velocity. That is a feed from avionics, which renders the claim of airgapped systems essentially null.
    - nucleardog 3y ago
      They could, for the sake of a ridiculous but clear example, have a display hooked up to the avionics and a camera hooked up to a separate computer which reads the values. There are various ways of connecting systems while physically guaranteeing one way data flow—a fiber optic link with the transmitter removed from one end and the receiver removed from the other is basically a less silly “camera pointed at a display” and used in the real world. You could argue the exact semantics of “air gapped”, but for the discussion here that’s accomplishing the same thing. The fact that the passenger network has some visibility into the avionics network is not, in and of itself, any indication of an issue.
      - deleted 3y ago
        [deleted]
      - deleted 3y ago
        [deleted]
      - upwardbound 3y ago

It would be nice if you could send a POST request to open the door if you want some fresh air.

pwillia7 3y ago

DELTE

hackmiester 3y ago

I tried to change the flight level by PATCHing altitude, but it seemed to require authentication. Oh well.

CamperBob2 3y ago
This sounds like a good way to meet some upset people with expensive sunglasses shortly after you land.
- jmharvey 3y ago
  It's not like that at all. The sunglasses aren't that expensive.
  - hackernewds 3y ago
    after you land also open to interpretation
- deleted 3y ago
  [deleted]
ComputerGuru 3y ago
Maybe you can take risks like that, but I certainly can’t. I don’t think anyone with my name or skin color would be given the benefit of the doubt for even a moment.
- thomashop 3y ago
  Your comment made my day. Eye opening
- foxhill 3y ago
  let me guess, you experience “random selection” events more than the expected amount? apologies for joking. it must suck.
  - ComputerGuru 3y ago
    Oh yes. Reminds me of the XKCD rand() comic!

hk1337 3y ago

Someone will probably figure out how to send a request to disable auto-pilot or turn off the fasten seat belt sign.

naikrovek 3y ago
the airline industry is nowhere nearly as stupid as the software industry with things like this. the communication between plane and wifi/entertainment system, if there is any, is almost certainly one-way. likely, the wifi system providing this info is receiving data from the flight systems and repeating it or transforming it a bit and providing that. it would not surprise me at all if the flight attendants have to program everything about the flight into the system prior to departure each flight, and there is no communication from the aircraft at all.
- jpalomaki 3y ago
  "The computer network in the Dreamliner's passenger compartment, designed to give passengers in-flight internet access, is connected to the plane's control, navigation and communication systems, an FAA report reveals." [1] (I guess there's some kind of firewall, but we know that those are not always perfect) [1] https://www.wired.com/2008/01/dreamliner-security/ https://www.wired.com/2008/01/dreamliner-security/
  - AdamN 3y ago
    Not a problem as long as you reboot your Dreamliner every once in a while: https://www.theregister.com/2020/04/02/boeing_787_power_cycle_51_days_stale_data/ https://www.theregister.com/2020/04/02/boeing_787_power_cycl...
- eep_social 3y ago
  IIRC the in-flight infotainment systems are entirely separate from the avionics control systems at the data layer. I recall being told that in some cases even the flight status is actually pulled from a 3p api service rather than hooked into the onboard avionics. There could be some fuckery via shared power or other non-data systems but that’s probably beyond someone sitting in a seat with standard laptop hardware.

fnord77 3y ago

Please stand by, a DHS agent will be with you shortly

queuebert 3y ago

You probably can. I suspect airliner software is appallingly insecure.

epse 3y ago
Relies very strongly on simple airgapping. Can't do anything to it if there's no wires in the direction you want. Can't remotely hack if there's nothing antenna connected that can talk to flight control. It has the luxury of not needing to do the "limited RCE" that is a modern web request
- inopinatus 3y ago
  In the article above, in-flight wifi has an API reporting position, altitude, and velocity. That is a feed from avionics, which renders the claim of airgapped systems essentially null.
  - nucleardog 3y ago
    They could, for the sake of a ridiculous but clear example, have a display hooked up to the avionics and a camera hooked up to a separate computer which reads the values. There are various ways of connecting systems while physically guaranteeing one way data flow—a fiber optic link with the transmitter removed from one end and the receiver removed from the other is basically a less silly “camera pointed at a display” and used in the real world. You could argue the exact semantics of “air gapped”, but for the discussion here that’s accomplishing the same thing. The fact that the passenger network has some visibility into the avionics network is not, in and of itself, any indication of an issue.
    - deleted 3y ago
      [deleted]
    - deleted 3y ago
      [deleted]
    - upwardbound 3y ago