4 ms·

My wife shared a tiktok with me last year, which was clips of an American Airlines flight, Airbus Plane, and someone had "hijacked" the speaker system. I combed

My wife shared a tiktok with me last year, which was clips of an American Airlines flight, Airbus Plane, and someone had "hijacked" the speaker system. I combed the Airbus manuals and maintaince PDFs and found that those planes have several exposed compact flash ports for "pre-flight audio". I hypothesized that either the copilot lost a bet or someone slipped a pre-recorded track into one of those slots... /shrug, but Im still interested in those CF card slots...

gloyoyo 3y ago
Wow. Given the amount of things that can be done with audio networking, and or connections via wireless to a CF card, this seems like something that should be considered.
- spacecadet 3y ago
  Well, they are non-obvious slots near Flight Attendant stations and high traffic areas. I wont say I hung out near them on a flight and observed traffic patterns, nor did I observe periods in the rear of the plane where one CF slot was unattended. I forget the exact model now, but Im leaving out alot of detail. There are assumptions in the "unattended slot" hypothesis. For one, the slots need to be set to an autoplay, which is not a given, and if not- requires navigating a complex and dated touch screen.
- weinzierl 3y ago
  If I remember correctly CF was just a stripped down PCMCIA which in principle is capable of DMA.
  - ctxc 3y ago
    Quite the acronym soup, but off I am to Google it...
  - ctxc 3y ago
    Andd I'm back. Got to love when it all comes together :P CF is compact flash card, kind of like the big memory card in cameras. PCMCIA is a PC card whose function is to "introduce peripheral capability to a laptop", kind of an interface. DMA is direct memory access.
  - mips_r4300i 3y ago
    It does have DMA but this only speeds up data transfer. You are probably thinking of PCI bus mastering, where the PCI slave temporarily takes control of the bus to read and write main system memory. This still exists in PCIe and thunderbolt, which is why bus mastering can be a security risk. CF poses no such risk. PCMCIA I don't think does either, since it is effectively a stripped down ISA. Later PC laptop cards look very similar but are actually CardBus, which is basically PCI. CardBus does support bus mastering. And the later Express card did too, in its PCIe forms
jstarfish 3y ago
Funny enough something like four months before that incident, the CEO of a cybersecurity firm that sounds like Kerberos reached out directly to American's CEO with a bullshit story that his personal laptop was hacked while onboard a flight. He was claiming all sorts of vague nonsense like sites rendering in Chinese or something and a flight attendant making him clear his history or something; I don't remember specifics but it read like bad copypasta and is quite possibly the stupidest case I've ever worked. He could not have been any more unhelpful with the investigation had he pissed directly into my eyes and called me blind. I wrote him off as a crank trying to drive business through FUD when we asked for his MAC address with the wifi vendor's AP logs in-hand. He gave us the MAC for his VPN adapter and ignored further questions. He provided so little usable information altogether I could never confirm whether he was even on that flight in the first place, much less connected to the AP and doing whatever the hell else supposedly transpired. Maybe coincidental that American's PA system gets taken over a few months later, with similar nonsensical circumstances-- it's not an obvious prank or tampering, which would get someone like me called in again looking for shenanigans. Instead, aircraft engineers looked at it from a mechanical failure angle.

gloyoyo 3y ago

Wow. Given the amount of things that can be done with audio networking, and or connections via wireless to a CF card, this seems like something that should be considered.

spacecadet 3y ago
Well, they are non-obvious slots near Flight Attendant stations and high traffic areas. I wont say I hung out near them on a flight and observed traffic patterns, nor did I observe periods in the rear of the plane where one CF slot was unattended. I forget the exact model now, but Im leaving out alot of detail. There are assumptions in the "unattended slot" hypothesis. For one, the slots need to be set to an autoplay, which is not a given, and if not- requires navigating a complex and dated touch screen.
weinzierl 3y ago
If I remember correctly CF was just a stripped down PCMCIA which in principle is capable of DMA.
- ctxc 3y ago
  Quite the acronym soup, but off I am to Google it...
- ctxc 3y ago
  Andd I'm back. Got to love when it all comes together :P CF is compact flash card, kind of like the big memory card in cameras. PCMCIA is a PC card whose function is to "introduce peripheral capability to a laptop", kind of an interface. DMA is direct memory access.
- mips_r4300i 3y ago
  It does have DMA but this only speeds up data transfer. You are probably thinking of PCI bus mastering, where the PCI slave temporarily takes control of the bus to read and write main system memory. This still exists in PCIe and thunderbolt, which is why bus mastering can be a security risk. CF poses no such risk. PCMCIA I don't think does either, since it is effectively a stripped down ISA. Later PC laptop cards look very similar but are actually CardBus, which is basically PCI. CardBus does support bus mastering. And the later Express card did too, in its PCIe forms

jstarfish 3y ago

Funny enough something like four months before that incident, the CEO of a cybersecurity firm that sounds like Kerberos reached out directly to American's CEO with a bullshit story that his personal laptop was hacked while onboard a flight. He was claiming all sorts of vague nonsense like sites rendering in Chinese or something and a flight attendant making him clear his history or something; I don't remember specifics but it read like bad copypasta and is quite possibly the stupidest case I've ever worked. He could not have been any more unhelpful with the investigation had he pissed directly into my eyes and called me blind. I wrote him off as a crank trying to drive business through FUD when we asked for his MAC address with the wifi vendor's AP logs in-hand. He gave us the MAC for his VPN adapter and ignored further questions. He provided so little usable information altogether I could never confirm whether he was even on that flight in the first place, much less connected to the AP and doing whatever the hell else supposedly transpired. Maybe coincidental that American's PA system gets taken over a few months later, with similar nonsensical circumstances-- it's not an obvious prank or tampering, which would get someone like me called in again looking for shenanigans. Instead, aircraft engineers looked at it from a mechanical failure angle.