Hacker News Reader

Comment by narsil | Hacker News Reader

The tweet in question: https://twitter.com/Sidragon1/status/588433855184375808

I clicked on the word "tweeting" in the article twice before realizing it wasn't a hyperlink. I totally assumed it would be. And now I see why EFF didn't link to this.

I'm sorry, but that tweet actually is threatening in my eyes. Note that I know __nothing__ about airplane-system-security, but that looks to me like he gained some kind of cmdline and/or admin-tool access and "PASS OXYGEN ON" looks like something that would cause the oxygen masks to drop down for all passengers. And he did this while on the plane with other passengers while it was flying? If so, he got what was coming to him. Sorry.

____

EDIT: Screencap in case someone(s) decide to delete tweets http://i.imgur.com/Uqfh0oL.png

Proper archives > screenshots.

https://web.archive.org/web/*/https://twitter.com/Sidragon1/...

https://archive.today/ysTzt

You should always make your own copy in cases like this.

Archive.org will delete everything on request. For example if you add a robots.txt file blocking them they will automatically remove the entire history for your domain

Yes but no one put yourself can trust your copy. People can reasonably trust independent third-party sites.

Archive.org will not delete anything, they do censor though. In case of court orders there should be no problem getting hidden content from them.

Could someone be so kind as to translate this tweet so that those of us that aren't security experts can understand what was said? Or perhaps point me in the direction of some recommended, intro-level reading? I feel distinctly ignorant at the moment!

I'm relatively uninformed in this area, but I assume it was a proposal for an exploitation path. "Box-IFE-ICE-SATCOM" would most likely be a plan meaning exploiting and escalating privileges from the actual passenger's client interface or in-seat screen(box), escalating to the in flight entertainment system (IFE), to the inter-communications system (ICE), and finally to the Satellite Communications system (SATCOM). Not sure how realistic it is, because I know really nothing about info-sec with regard to aircraft, but it's no different than planning something like web app/service vulnerability -> database -> backend systems.

> Find myself on a 737/800, lets see Box-IFE-ICE-SATCOM, ? Shall we start playing with EICAS messages? "PASS OXYGEN ON" Anyone ? :)

737/800: is the type of aircraft and specific model (Boeing 737, stretched version (800)).

Box-IFE-ICE-SATCOM: Is a theoretical (or actual?) exploitation path.

Box: I'm assuming is in-flight WiFi

IFE: Is the in-flight entertainment system

ICE: Is also part of the IFE, but I'm guessing he specifically referenced that due to the "I" (in ICE) namely, the information that gets fed into the IFE from the flight systems (speed, altitude, and position)

SATCOM: The uplink used by in-flight WiFi but also the IFE to provide "latest news." If can be used to deliver information to the airline about the aircraft so they can keep track of if its on schedule and such.

EICAS messages: Used on aircraft's secure network for flight crew alerts and diagnostic information. Some of these may be relayed onto the insecure network and forwarded to the airline (similar to ACARS, but over SATCOM).

PASS OXYGEN ON: The implication is he wants to cause the oxygen masks to drop down into the passenger cabin (although in reality sending this wouldn't do that, it would just set off a warning on the flight deck letting the pilots know that the oxygen masks dropped, even if they physically hadn't).

If he could send EICAS messages to the aircraft's secure network, that would be a legitimate safety concern. However if he just witnessed EICAS messages from the insecure network, that isn't really a concern except maybe he could send misleading ones to the airline and give them a metaphorical heart attack.

I'm somewhat familiar with avionics system on a 737, and that above is a pretty accurate description. The FMS* basically forwards the messages through CANBUS for the IFE, via a gateway.

At worst this guy could send a fake message to other passengers, and maybe cause a IFE system warning in the cockpit. Oxygen Masks are controlled by a completely separate system to the IFE.

* The 737NG has various displays for warnings, but its not quite the same as the Airbus EICAS

And the best response to the tweet is from Matt Blaze:

> "I'm on an Amtrak train, which, for the record, I'm pretty sure I can't take over via the wifi." - https://twitter.com/mattblaze/status/589153697910935552

Right, because you can't do anything via Amtrak Wi-Fi. It's far too slow to be dangerous, or, indeed, useful at all.

Can someone explain what exactly this tweet means? I managed to figure out EICAS but the whole thing I'm not getting. Thanks in advance.

Edit: https://news.ycombinator.com/item?id=9403693

Reply on news.ycombinator.com