Hacker News Reader

Comment by rx_tx | Hacker News Reader

For those interested in the various aircraft systems for PA (public address) and aircraft status system for aircrew, I found this interesting training doc PDF online [1] for the A320/321. I have been looking at section "03-010 CABIN INTERCOMMUNICATION DATA SYSTEM"

It does not mention the "medical intercom jacks" in overhead bins that are mentioned at the end of the article

[1]:https://caisatech.net/uploads/XXI_3_AIRBUS_H51_A320_O_CCOM_R...

View on HN

Apparently there is a compact flash card to play music and the pre-recorded announcement over the loud speakers.

I wonder if someone replaced the standard announcement with a 5 hour long file with intermittent burps and groans....

Another idea is that there is a source file that is copied onto the flash card on a regular basis and someone has hacked the source back at the office or something. Seems more likely because that wouldn't require the perpetrator to be on each flight and thus less likely to get caught. Some of these flights play music as you board the plane, could it be that this comes from music on a flash card and someone has replaced that?

They would probably notice that but it does seem like some former passenger most likely installed something that's patched into the system. It may just be a recording from a flash drive. Or it could also be more sophisticated and patch into the wifi as well. You could also imagine it having a microphone for added hijinx but none of the interactions seem to suggest that.

I've flown American six times in the last ten days, and four of the flights had chaos with the entertainment system. No groans or heavy breathing on the PA, but flight attendants had to "reboot the system" once or twice every flight.

I once captured the Linux boot screen of a United Boeing 737 infotainment system. Apparently I still got that photo. OCRed text for lols:

  video capture buffer0 40b37460
  video capture buffer1 40a8dd60
  wideo_capture buffer2 409e4610
  geode_: gamma black+csccorrection
  VAL2: Registered "NSC Geode V4LZ UBI driver" as char device B1, 224
  VAL2: Registered "NSC Geode V4L2 Capture driver" as char device 81,
  geode_v: Unknown standard
  VAL2: Registered "NSC Geode V4LZ Overlay driver" as char device B1, 16
  Warning: loading /lib/modules/realmagichul_kernelland.o will taint the kernel: non-GPL license - Proprietary. Copyright (c) 2002 Sigma Designs Inc. All rights reserved (version 103 with proc pci dolby css macrovision sm2288 osdric_memorycheck),
  /lib/modules/realmagichul_kernelland.o:init_module:Invalidargument
  Hint: insmod errors Can be caused by incorrect module parameters, including invalid IO or IRQ parameters
  PCI: Setting latency timer of device 00:12.3 to 32
  geodeoss: disabling PM: PM registration failed
  geodeoss: version 1.2.0 time 12:37:36 Dec B 2004
  geodeoss: use_pm=0 check_interrupt=0
  Warning: loading /lib/modules/maspcu.o will taint the kernel: no license
  usb.c: registered new driver pcu
  MAS-eFX SEB USB PCU driver version 1.01
  usb.c: registered new driver usbccr
  usb_ccr open is being called (0xc165f000
  ) <6›ccrdev.c: Adding credit card reader: input1
  input1: Panasonic Avionics Corp PAC USB Keyboard/Credit Card Reader Ver. 1.01 on usb1:2.1
  usbccr.c: v0.59:USB HID Credit Card Reader driver
  mice: PS/2 mouse device common for all mice
  usb.c: registered new driver pacpcu
  geode rev-7 pmr-03a834c4 mcr-00030250
  using /dev/mtd1 /usr/app
  --- mount succeeded ---
  using /dev/mtd4 /usr/app2
  --- mount succeeded ---

> I once captured the Linux boot screen of a United Boeing 737 infotainment system.

I used to work adjacent to these exact systems...they're so bad.

Like, 10+ minute boot at times, or assigning multiple devices to the same IP, or the communication network just randomly dying... (and this was all in vitro testing)

It was still cool to see "the rack", aka an entire planes infotainment system setup on a rolling cart including however many seat backs each plane was supposed to have. They had multiple office buildings that were essentially full of these, because each airline and deployment was different enough that they didn't want to have to reconfigure when needing to test them.

Some of the time is because they have a single board computer, and only licensing the BIOS. You'll know if that's the case if after the boot, you see it purposely set the time to something arbitrary, but dating back to the 90's. To the flight entertainment, the date doesn't really matter. For the licensing however, it does.

Also elsewhere in the boot, you might notice they tend to be 80486 CPU emulation boards from Cyrix. They're not fast at all, but for what they do, they don't need to be.

Also, if you took video instead of a pic, there are a few interesting IP addresses might scroll by as the media program gets initialized.

Oh man, the NatSemi Geode (aka Cyrix MediaGX). What a system. I'm amazed anyone got a usable Linux system out of it at all.

They might be doing that out of caution just to keep it from being exploited. Sounds like something management or the Flight Crew might decide is a band aid if one tries it and it works then everybody starts doing it. Knee jerk reaction but sounds like they’re stumped.

If you watch the whole boot, they purposely set the date to the 90's. I think it is because they don't want to pay the license for the BIOS. You can see some text about that license scroll by as well.

I've seen it often, and somewhere on an old PeeCee buried in the darkest areas of my home office, I have a video of the whole sequence.

That's true, but there's also reports from flight attendants of it happening spontaneously before the issue was known about: https://twitter.com/xJonNYC/status/1572358118985633795

Deeper link to video of it happening:

https://twitter.com/actuallyemerson/status/15731071172546396...

I recently had some funny business on a United Airlines flight where the high-low chime (you hear for the seatbelt sign and landing gear, etc.) was going bonkers and chimed maybe 10 times in a row while the cabin lights faded on and off.

No announcements were made by the pilot or flight attendants afterwards, and everyone was left confused. I turned to the passenger next to me and we both shrugged.

If it were just one passenger it would be easy to find out who she is by cross checking passenger lists. So probably not. Maybe a coordinated 4chan-style prank.

What's interesting is that it appears that the CF card slot is only accessible behind a panel. The only people that would have access to that are likely the ground crew -- possibly doing a software update, or other maintenance on that panel.

If there is such a flash card, this sounds like the easiest explanation. Someone swapped the card with a file that starts with the real announcement, then X minutes of silence, followed by joke sounds.

Absolutely did this in middle school music class, where there was a cassette player that usually went unused. I don’t remember the details but it was basically 10 minutes of silence and then some raunchy audio, probably NIN or Marilyn Manson (it was 1998 and we were 12).

Especially if the crew is used to the player stopping automatically at the end of the spiel. The attendants wouldn't suspect the player because the earlier announcement ended so why would playback still be going?

Looked at that too, but since unless I am missing something, that appears to be in the captain’s cabin based on linked document from the parent of this comment thread; which means it would not only be hard to access, but once placed, very likely be hard to recover and would have been checked too, likely even in flight while the audio continued to be heard.

A bit of searching for airplane medical communications jacks turned up this picture:

https://aviation.stackexchange.com/questions/12776/how-are-t...

Jacking into that would not be inconspicuous.

If those are 1/4" or 6.35mm audio phone jacks, I'm sure there are lots of electrical engineers who could design a pre-recorded player that would fit ENTIRELY inside the jack without protruding outside the jack whatsoever.

Eh, only one way to find out.

An ESP32-PICO-D4 is 7mm wide, but based on internal images it appears you can safely grind it down to ~6.35mm. It contains a DAC, 4MB flash, and all needed peripherals plus bluetooth. The quality [1] would be poor, but this matches what we observed.

A circuit board would probably be out of the question given the size. Even 0.8mm would have very little usable area. Flex PCB could work well, but is probably overkill for the complexity required. I'd expect a project like this to be hand soldered, given the low (less than 6?) component count. It wouldn't be easy, but well within the capabilities of a hobbyist at home with a cheap USB microscope.

For power, I could imagine a repurposed AirPod battery (they fit in the 0.235 inch diameter "stem" of the headphone) with a deadbugged switching or linear regulator fitting both the power budget and the size constraint.

From a physical design perspective, a lot of traditional methods seem impractical. With this size constraint one possibility could be placing requisite components into a 1/4" jack shaped mold, and casting it in epoxy in a vacuum, completing the conductive surfaces with copper tape.

1. https://www.youtube.com/watch?v=lgDu88Y411o

I could definitely make one as a demo.

The only problem, though, is then there need to be dozens of these because that airpod batter lasts maybe what, 2 flights?

Could that pick up a transmission from a device designed to emit RF stored in the overhead above?

Just put some beige box around it to make it look like it's part of the panel. The crew won't notice it.

I'm struggling to understand how this would explain the account here:

>Then the master power button up at 1L for the cabin power kept getting I pushed so it would shut off all the IFE, seat power and outlets. I had to push the button on again about 3 times inflight. Then the 2 got a call with the same groaning noise and thought it was one of us playing a joke but it wasn't us.

>It certainly was freaking all of us and the passengers. They wanted off the plane as bad as we did. The 2 be FAs said they had been on the plane the other day and the same thing happened. I had a visual on each FA when the noise would come over the PA and one time when the FO was doing a break so unless the captain was playing a long sick, joke I don't have an explanation.

https://twitter.com/xJonNYC/status/1572358118985633795

Any ideas?

> Then the master power button up at 1L for the cabin power kept getting I pushed so it would shut off all the IFE

I can't even get passed the first sentence of this. What does any of this mean?

1L is the forward-most door on the port (left) side.

IFE is in flight entertainment.

Uninformed guess: "The master [public address system] power button [located] up by [seat] 1L kept getting pushed so it would shut off all the IFE [(inflight entertainment)]"

This makes sense, because for safety reasons all the entertainment is paused when they use the public address system.

I think "master power button" probably more clearly means some sort of master control switch for in-seat passenger accessory power, since it's described as shutting off all in-flight entertainment AND seat power. The sort of thing you're supposed to press during takeoff and landing, not during announcements

> for safety reasons all the entertainment is paused when they use the public address system.

It's more common for the entertainment to be muted without being paused. I assume that's as a convenience to the passengers.

Yeah great convenience to miss part of the movie because they want to sell inflight shopping :P

I had totally forgotten about this because I haven't flown long-haul in decades. I suppose these days I would just watch video on my tablet anyway.

> Yeah great convenience to miss part of the movie

Nobody said a feature implemented as a convenience to the user had to make things more convenient for the user. They're barely even related concepts.

https://chainsawsuit.krisstraub.com/20171207.shtml

When I’ve been on long flights watching movies it pauses the movie. Not mute… maybe it depends on the airline.

You're right, I forgot because I have just used my phone the last few years. Now I remember I always found it incredibly annoying because I'd miss part of the dialogue of what I was watching.

While it is plausible that the hack compromises the entire comm system, it's unlikely. My bet is that the steward made an incorrect association between the sounds and normal system behavior. These inaccurate retellings are extremely common in ghost stories.

Only time will tell, but I'm almost certain I'm right on this one.

This makes a lot of sense, but I’ll add that it’s also possible that the association was correct, but not for the assumed reason. For example, maybe the plane had a partially faulty breaker for the IFE, and there was a likelihood of tripping every time the PA system was used. (The button probably isn’t a breaker, but there’s a world of similar explanations.)

It's hard to follow what they meant when describing the button pushing.

There’s also this video overview of the system.

https://youtu.be/0l2jUPI1fpk

My best guess its an unfunny "Easter Egg" that triggers after something like 5,000 hours of uptime. I think I remember some bug in Boeing or some other system that they need to actually be rebooted every 100 days.

I'm one of those people who thinks easter eggs are great, and miss the days when you had a decent chance of coming across one in a program or game.

The FAA does not agree with that. The FAA probably thinks that easter eggs in avionics software are a crime. And I agree with that position! Aviation, medical, military, and any other critical software should not contain easter eggs, and it should be an offense to knowingly include one. Stuff like this (even though it's probably not an easter egg) is a great example why. Just imagine the cost to patch this if it's widespread... and it has to be patched, because this one can literally kill people if you don't fix it (think spooked flight crews making rushed or generally poor decisions if you don't think this is potentially lethal).

There are Easter eggs in military avionics.

The B-52H bomb/nav computers had a really rudimentary golf game. Think Atari 2600 quality.

The B-2A had a breakout-like game at one time.

Both were accessed via some really esoteric key presses.

Do you have a source? This seems very interesting, but I can’t find anything about it.

I don’t have a public source. I worked on those aircraft.

They should have included Atari River Raid for bonus meta points!

Reminds me of when a security researcher discovered that, in addition to some serious security flaws, certain Siemens PLCs had monkeys hidden in their firmware: https://arstechnica.com/information-technology/2011/08/serio...

According to the researcher who found it, "they didn’t think it was very funny.”

I love easter eggs myself—classic Apple software in particular had a lot of these, and I really miss finding them—but they're admittedly a risk. I remember one obscure Easter egg in Mac OS 7.6 that occasionally caused crashes at boot time after displaying a bizarre message about how "bluets and granola bars / make a chewy snack". Cute, but probably not something Apple wants to be getting customer support requests about.

As far as the topic at hand, I don't believe these weird noises are an Easter egg, either. I'd guess it's a recording patched in somehow by someone who works for the airline.

> risk

And that's what it boils down to, isn't it?

Personally I draw the line somewhere around "software that's controlling something". If software can directly screw up or cause damage in the Real World™, that's a good reason it shouldn't have easter eggs in it. If the trouble has to indirect through one or more meatbags who know better before becoming reified, well, the harm caused by any easter eggs is probably much less than the harm caused by reported bugs already closed WONTFIX with a laugh. (Note: PAX do not in fact know better, ever, as any airline employee can and will tell you.)

I looked up the story behind the "Bluets and Granola Bars" easter egg. Apparently, the System Error Handler, part of the boot ROM, used to display a popup that said "Welcome to Macintosh" at startup, before the operating system loaded. However, in System 7.6, this was replaced by a new splash screen with the Mac OS logo, and the old "Welcome to Macintosh" message in the system resource file was replaced with the Granola message (probably under the assumption that it would never be shown). However, if the operating system fails to suppress the boot ROM's popup for whatever reason, the Granola message shows through.

There's a YouTube video here of the Granola bug in action:

https://www.youtube.com/watch?v=kTwivCiTHgM

That's really interesting. I didn't know the intricacies behind that.

> critical software should not contain easter eggs

So boring! I look forward to my pacemaker giving me palpitations to the rhythm of "Never Gonna Give You Up".

I read in Slash’s autobiography that when he got his pacemaker installed they set it at a certain heart rate, but when he played his first live show, he felt a handful of thumps in his chest and thought it was bigger pyro than normal.

Turns out his pacemaker was shocking him because it thought his elevated heart rate was a danger! They fixed the setting.

This is a possibility given that ICDs sound a warning alert before shocking.

Why do you think is it a bad idea to have a defibrillator that flashes PSYCH on screen when the Shock button is pressed, but then delivers an actual shock a second or two later? It would happen only on the fifth cycle of CPR or so!

Reply on news.ycombinator.com