Grab a drink and find a seat, because it's time for the Pentest Partners Power Hour, presented by Pentest Partners.
Today we have Ken Monroe and Alex Lomas to regale the audience in their further adventures in hacking electronic flight bags, or EFB.
And to close out the first day of presentations at the Aerospace Village, they'll rant about all the terrible aviation hacking in the movies.
So let's give a warm welcome to Ken and Alex.
Hit it!
If everyone's ready, let's begin.
So thank you, everyone.
Thank you for making it through the first day of the Aerospace Village.
We have two talks for you for this hour.
The first one is kind of semi-serious, and the last one is very much not serious.
So I guess I'm the serious one, and Ken is not.
So I'm going to talk to you about electronic flight bags, but the sequel, as we did talk about them last year, but there's more.
So for those of you that didn't come last year, what is an electronic flight bag?
Well, it's a tablet computer that is used instead of paper charts.
Basically, EFBs have replaced paper charts and manuals.
These are really heavy.
They are really difficult to update.
So now pilots basically just take an iPad with them, which has a suite of applications on it instead.
This is much easier.
What do these apps do?
Well, there are lots of things.
So firstly, we want to compute takeoff performance, or perf.
And the reason we want to do this is that, firstly, we want to know if it's safe to take off from a given runway of a given length, but we also want to be really efficient in our engine use.
We don't want to use maximum thrust all the time.
That's expensive in fuel, increases wear, all that good stuff.
So we want to reduce the amount of thrust we use to take off, but to a safe level.
Weight and balance is also really important on aircraft.
We need to make sure the center of gravity is correct for a given loading.
So passengers and freight and all that kind of stuff.
And this is an example of a mistake.
So here we have an A320 that was switched out at the last minute for an A321.
The pilots should have changed the calculation for the model, the type, and they didn't.
And it was actually kind of a close call.
But no one hurt, nothing was damaged, everything is fine.
But one of the great things about aviation is that we publish our mistakes.
We hold our hands up and we publish for everyone to see this is what went wrong, don't make our mistake again.
And I think IT can learn quite a lot from the aerospace industry in that regard.
So here's another thing that we need to know is landing.
So the amount of runway we need to land can change quite dramatically depending on the weather conditions, for example.
So if it's snowy, icy, rainy, it's going to take longer to break.
But also air traffic control want us to turn off the runway for efficiency at a certain point.
So they might ask us to use certain auto braking parameters.
So it's really important that we calculate our landing distances accordingly.
So what is the kind of stuff that can go wrong?
Well, in extreme cases, a miscalculation of our takeoff speeds, weight and balance, whatever, could lead to the rather euphemistically termed runway excursion.
So that's going off the end of the runway.
Or if we miscalculate our takeoff speeds, we could rotate too early, scrape the tail on the runway in a tail strike.
Now, pilots are really well trained.
They plan for this.
They train in simulators for exactly this.
So injuries, fatalities are extremely rare even if we do have one of these kinds of incidents.
We might lose or damage the airframe, but everyone generally walks away.
So back to our AFBs then.
Our iPads, typically, is what these are.
We found that airline operators are maybe not treating these mobile devices with enough pardoning.
So no pin or really simple pin.
They are even asked to go out and buy their own from the local store.
They don't have an MDM.
They are not really locked down.
But even operators that do have a corporate device and enroll them in an MDM, it's not really just a matter of turning on every option in your MDM because a lot of things like, you know, enabling a face unlock isn't really going to work with pilots who are showing you sunglasses.
Or if there's a decompression and they have to don a full face mask, then this isn't going to really work out.
So there's quite a lot of thought required when implementing these things.
But it's not also just about these performance apps.
These iPads typically go home with a pilot or to a layover hotel.
So they're not only just used for their performance calculations, they have access to corporate data like email.
They often have all of the passenger data on them as well.
So your frequent flyer status, all that kind of good stuff.
But we've also heard of pilots giving their EFBs to their kids so they can watch videos because it's just handy.
Now, last year, previously in Aerospace Village, we disclosed vulnerabilities in Boeing's performance tool, OPT.
And the issue that we had with OPT is that all the data is stored inside plaintext SQLite databases.
There was no signing mechanism.
There's no integrity checks to prove that the data came from a trusted source.
So an attacker who's got local access can change these values.
And that has impacts on the calculation.
So, for example, we've got the runway length here at Heathrow.
This is the correct value.
But we could modify it to be 10 kilometers long in this case.
Now, something like this, a massively gross change would typically be picked up by a pilot.
This is not what you would expect to see.
But if we're operating on the margins of performance, what we would term hot, high, and heavy, then a small change might go undetected, and that's when we might start to see problems.
These distances also have an impact on our speed.
So these are real takeoff speeds.
These are modified speeds based on our injected data.
So, again, wrong, this could lead to a tail strike or something.
So Boeing were awesome.
I'm not just saying that, but they were genuinely great during the disclosure process.
They were really responsive.
They kept us informed.
It took two years for this to be fixed.
So this is not like a Google project zero, 90-day, publish and be damned thing.
And I think that's really important for the researchers to understand, is that sometimes we can push companies into making a change, and that actually has a greater safety impact than just leaving things as they were.
So it takes quite a long time to test and make sure that there isn't a regression when we push out a fix.
So this is all nicely fixed.
This year, some more issues.
So first up is Airbus fly smart paperless cockpit, I believe LPC stands for.
Again, this is a really similar thing.
There are plain text files.
In this case, these are the obstacles that are erected around a runway, so it's really important to know if there's a crane or chimneys or pylons, stuff like that.
So in this case, we can change them.
Or, again, we can change runway lengths at Heathrow.
So this is reflected back into the fly smart UI.
So we disclosed this to Airbus in 2021, and Airbus felt that this didn't really need addressing.
This was a known risk, and they actually described it as a product improvement if this vulnerability were to be fixed.
So it's still kind of present.
The mitigation obviously is that operators need to harden their AFPs.
This needs kind of local access to modify.
So I think that's reasonable, but we think they could probably go a bit further.
So the fly smart updater, this is a separate application that is used to update all of the charts and other data every month on what's called the ARAC cycle.
And I think one of the things to remember is that there are usually two AFPs in the cockpit.
Each pilot has one.
So if there's a mismatch between the values, then they're probably going to be picked up.
Or if I could impact both at the same time.
And this was kind of the issue with fly smart updater, which is that they had consciously disabled TLS certificate checking in the app.
So pilots tend to frequent the same layover hotels.
So we can spin up a Wi-Fi access point with the same hotel name, sit there and intercept traffic and actually modify this data on the way through.
So remember that they've got to keep these updated every month as well.
So it's just kind of a matter of lying in wait, I guess.
So this was a conscious decision, but this is now fixed in fly smart updater.
So Lufthansa have their own product called Lido, which is a charting application.
This has similar issues, but kind of different.
So their data integrity checks were not good.
So it's interesting that Lufthansa had decided to actually add cryptographic integrity updates, but the way that they implemented it was flawed.
So they calculated an MD5 hash of the data and then encrypted it with an AES key.
And then the client software did the same computation and compared that with the value that was shipped with the update.
But unfortunately, those encryption keys were in the client software.
So we could just make our own data with, you know, the correct hash.
What's kind of interesting is that the encryption key by default, there were several, but the default one that was in use was 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3.
You get the idea.
So that was kind of amusing.
So here's some examples.
It's like a vector-based charting application.
So in this case, we could change the real descent profiles to one that is lower, potentially bringing the aircraft into conflict with terrain, for example.
Here's another one that could lead to a really bad day, which is that if you're flying through Iranian airspace, you need to call up Iranian radar and make yourselves aware.
Otherwise, bad things will happen.
So we could change that to say, yeah, you're good.
No problem.
No restrictions apply.
Walk on in.
That would not be good.
So again, a really, really great interaction with Lufthansa.
We disclosed in May 2021.
They kept us informed all the way along.
It was all really great.
We published in conjunction with them in May 2023.
And actually, the version that we had tested, taken from a real-life aircraft in 2021, was actually already end of life in 2021.
So the software was out of date in 2017.
And I think it's quite a timely thing for operators to remember is that they kind of need to keep these things updated.
It's really hard and needs lots of checks, but they do need to keep up to date with vendor support, just like everything else in life.
So it does kind of feel like there's a common thread throughout many of these big EFB apps for multiple vendors.
Now, aviation is a really highly regulated business.
All the national regulators kind of have their own standards with EFBs, but mostly in theory, the airlines and operators, they're the ones that are responsible for hardening the EFBs themselves.
That's their job.
But should each operator be really be looking at this software on their own every single time?
Is it not better that there should be some guidance to vendors to make these things more secure from the get-go?
So there's been an update recently, a draft set of regulations.
And this does improve things a little bit in EFBs, we think.
There's still discussion of integrity, and I think that's still open to discussion.
Interpretation, does that mean a CRC, or does it mean cryptographic integrity?
So I think this needs to be improved still.
And the emphasis is still on operators to harden the EFBs.
So it's great for a pentest company like us.
Please, operators, come to us, and we'll tell you the same thing over and over again.
But overall, that's probably not great for the industry that we're having to deal with this all the time.
Now, I don't know whether people have come across this, but it's a risk analogy in aviation.
It's maybe not the best, but it's called the Swiss cheese model.
So each of our wholly slices of cheese is a hazard.
And it's only when all of the holes align in our cheese that there's an accident opportunity.
So we're not saying that EFBs on their own are going to lead to a safety critical issue.
They don't fly the plane for you.
There is still a pilot who ultimately makes those decisions and flies the aircraft.
But, well, yes, they can't change the aircraft.
But if the charts are wrong, in bad weather, with a high cockpit workload, that's when we feel that an accident is more likely to happen through this kind of issue.
So that's kind of a run through really quickly the more serious stuff on EFBs.
Surely you've got a drink.
Please go avail yourself to the free bar at the back, and Ken will be back in a minute talking about crappy things in the movies.
Have we got time for questions?
I can do questions.
Oh, my God, many questions.
So most of your research has looked at compromising the data once it's on the EFB.
Have you looked at the supply chain issue of the data coming from the state agencies to organizations like Jefferson, and then Jefferson pushing it out to the end user and compromising that in some way, shape, or form?
So the supply chain is an interesting one.
Different operators take a different approach.
Some will just take a data feed directly from Airbus or Lufthansa, for example.
And, yes, behind the scenes, I'm sure there's supply chain issues.
I mean, we're less easy to look at because we can't go pen test them without their say-so.
Other operators are different, and actually most of these apps have the capability to define their own data sources.
So some operators have their own systems for generating these databases and pushing them out.
So, again, that's another really interesting opportunity for getting in the way of these online updates.
Some aircraft will even do it through the cockpit.
So when the aircraft is at the gate, there is a way to update some of these EFBs through the aircraft itself, through TFTP, of all things.
So, yes, there's quite a lot of scope for this, yes.
Should we crack straight on with this, then?
What do you think?
So this is the less serious of the two talks.
It's the first time I've given this talk.
Kind of made it up a little bit.
But I thought it'd be quite good fun to look at some of the airplane hacks that we've seen in the movies.
More?
You want more?
Okay, we can do more.
So, quick recap.
Who the heck are we?
Alex kind of forgot to introduce us.
There's a bunch of us somewhere between Oxford and Cambridge in the UK.
There's a few of us are pilots, too.
I'm a really lousy pilot.
I successfully landed at the wrong airport once.
That was quite an achievement.
That took some doing.
We joined a group off the back of the experience with Boeing.
They asked us to give us some advice and they've been the most cool organization to work with ever.
We helped get involved with the Descon Aerospace Village back in the day and we've done all sorts of really cool and fun work, including hacking 747s, 320s, and all sorts of fun airplanes that we found retired in boneyards.
It's amazing if you give the boneyard operator a bit of cash, they'll let you fire up the airplane and have a play.
It's great.
So, anyway, airplane hacking in the movies.
Why on earth am I spending my time and wasting your time talking about plane hacking in the movies?
Hey, TV shows and movies are there to entertain us, right?
We all like a bit of jeopardy, right?
That's important.
And why piss on their chips?
Why make a movie?
Why tear it apart?
Because it's not factually accurate.
Well, actually, I think it's really important because there are some very misleading narratives that are set in the media by journalists about airplane hacking.
And unfortunately, a lot of those myths persist in the movies.
They persist in TV shows.
And do you know what they do?
They actually set a narrative that damages industry.
So I think it's really important that we spend time looking at some of those insane plot holes.
Of course, there's only one place to start, right?
It's got to be Die Hard 2.
Yippee-ki-yay, mother... Anyway, every time I say that, you've got to drink.
This might be coming again.
Anyway, John McClane, isn't he the best?
Right.
So, who hasn't seen Die Hard 2?
Okay, you're screwed then because I'm going to go through the entire plot right now.
So, what is the plot of Die Hard 2?
Fundamentally, Dulles Airport, a terrorist team attack the instrument landing system and make it appear that it's 200 feet lower than it actually is.
So the airplane's flying in, hit the ground 200 feet before they're supposed to, and they crash and explode in flames, right?
Great.
What an awesome movie.
Now, there's a couple of issues here.
First of all, in order to do that landing, you need to be doing what's called a Cat 3 auto-land.
Now, Cat 3 is for when the weather's completely socked in.
There's a problem though, because in the movie, you can actually see the entire runway, but Cat 3 conditions don't make for great movies because you can't see shit.
Now, that's what Cat 3 really looks like.
You cannot see very much at all.
Once you can see the runway lights, yes, you go through the decision, you can land.
Now, the entire east coast of the USA is socked in with a snowstorm.
There's so many issues around this, it's nuts.
So when we take off in an airplane, we have to file an IFR, instrument flight rules flight plan, and we have to nominate alternate aerodromes, and we have to make sure that we can divert after making an approach to the next airport, and then hold for a specified period of time.
If the entire east coast was socked in with a snowstorm, no one would be taking off, right?
We know the weather's coming.
Some storm systems move quickly, but not quickly enough to outrun airplanes.
So the whole plot doesn't work.
But let's just roll that, right?
So I don't know.
So the whole piece was about an airplane landing, and the terrorists had a gun at its head, effectively.
And they were running low on fuel.
But there's a kind of an issue there, because if you were running low on fuel, you wouldn't carry on holding.
You'd just go somewhere else.
You'd go to alternate.
And if you look at Dulles, that's actually one of the Jefferson charts.
You can see downtown D.C., bottom middle.
You've got Dulles on the left there.
You've got Baltimore top right.
You've got Reagan National in the middle.
And in an emergency, you could stick something big into Reagan National if you really needed to.
It would be a lot better than crashing into a runway, right?
You can even land at a military base in an emergency.
So the whole plot concept just doesn't kind of work.
Now, this is where, I mean, I'd forgotten about this.
Alex found this for me, is apparently in A.T.C., they have an altitude dial.
So they can dial up and down the instrument landing.
So this is amazing.
Even better than that, they actually had a touch pen, and they took the instrument landing system, you can kind of make it out there, and dragged it down.
Wow.
That's incredible.
I wish I knew how to do this stuff.
So they moved it down.
But then there's another plot problem.
Because your typical rate of descent on an instrument landing system is about 700 feet per minute, maybe a bit more, maybe a bit less, depending on the wind.
But call it 700 feet per minute.
If they had put the instrument landing system 200 feet lower, you'd just hit the ground at 700 feet per minute.
Now, that's actually a survivable incident for an airplane.
It's going to cause a heavy landing, there's going to be an engineering inspection, you might have some maintenance to do, but it's probably not going to destroy the airplane.
Certain types are certified for landings up to 1400 feet per minute vertical.
It's going to be heavy, but you're not going to destroy the airplane.
I might spill my beer, though, Ken.
You would definitely spill your beer.
Alex, do you want to just talk us through a little bit about the way that an instrument landing system works?
Oh, now I have to remember my instrument training.
So I think this is a slight myth in ILS, but it holds, I think, for our discussion.
There are two beams, two radio beams, the localizer and the glide slope.
And you can think of the localizer as sort of two lobes, the top diagram, sort of a left hand and a right hand.
And where they overlap, that's your center line.
So if you fly to the left or fly to the right, then the beams are slightly stronger and you get that deflection on your instruments.
Sort of similar for the glide slope.
Think of it like an invisible beam coming from the end of the runway about on a three degree slope is what we would normally land on.
So in a nutshell.
Yeah.
So you fly up, you fly down, you fly left, you fly right, you land.
Now, how do they present it?
Now, you need a transmitter, a great big antenna.
When you've been on an airplane and you take off, look straight down and you'll see the instrument landing system antenna.
And of course, the big question is, can you really screw with an ILS?
Well, sort of.
So there's one thing you can do.
So the instrument landing system is usually configured about three degrees.
But there are a few airports around the world because of various skyscrapers in the vicinity where you can make it steeper.
And this is London City Airport.
If you've ever flown into it, they have a lot of short haul flights.
There's a lot of skyscrapers on the approach.
So they have a 5.5 degree glide slope.
And they have to have special software on the airplane so that the autopilot can cope with the steep descent.
But what you can't do is change the intersection.
And that's what they try to do in Die Hard 2, is they try to present the intersection being much lower than it actually was.
Now, you kind of could.
But in order to do that, you would need to dig a 200 feet deep hole at the end of the runway and also grade it at three degrees so that the signal would come out.
So you could do it.
This is Lelystad Airport in the Netherlands.
So what you would have to do is dig a quarry.
And then you could do your hack.
Then it would really work.
Or you could also go to St.
Helena, which is an island in the middle of nowhere.
And they built it over a cliff.
So what you could do is put the instrument landing antenna down there.
But given that only one or two airplanes go there a week, it's not going to kind of work, is it?
Dulles is a bit busier.
And there's more.
So we don't just rely on the instrument landing system when we're landing.
In Cat 3 auto land conditions when you can't see anything, we use the radio altimeter, or the radout.
And that tells the autopilots when to flare.
So we use the radout and check.
Yep, 50 feet.
Start the flare.
Descend.
Throttle's back.
Great.
Now, yeah, there are some really interesting things going on with the radio altimeters.
You probably saw a lot of press coverage last summer when we talked about the interference with 5G with radouts.
But, you know, worst case, yeah, you might just flare a bit high or flare a bit low.
We actually think that interfering with the radout is far more interesting than tampering with the ILS like die hard.
We also use DME, so distance measuring equipment.
It's used a little bit less nowadays, but it used to be very much how we did stuff.
Bottom left on the image, 7.4 nautical miles.
And it's a cross check on your approach to tell you that you're at the right altitude for the distance from the threshold.
And there's other crazy stuff, too.
So we don't just sit there and fly the ILS on autopilot.
We monitor everything, including the barometric altimeter, which you set manually.
There's also ground proximity warning systems.
Alex, tell us a bit more about those.
Yeah, so there is a system that will tell you if you're close to the ground, and it does change its state depending on what mode the aircraft is in.
But during landing, if you've come and flown our flight sim out there, you might have had this happen to you, which is if you're exceeding a certain excessive descent rate, then you'll get a warning about it.
So even if you can't see anything, the system will tell you to pull up because you're going too quickly.
That's kind of what ground proximity is, right?
There's more.
So the integrity of the instrument landing system is also monitored and managed by ATC.
So if it's going wrong, they know about it straight away.
There are systems, so that's one from Leonardo, that monitors the integrity of the approach systems.
And if you do get low, ATC will tell you as well.
So there's so many things going wrong.
How would we have done this hack?
We're the terrorists.
How would we have outfoxed John McClane?
How would we do it?
Well, I suppose what you could have done, you could have taken the instrument landing system, the legitimate one, you could take it offline, and then you could build another one about half a mile further away from the runway so the airplanes would come down.
That's not really going to work.
A much better attack would be to take the instrument landing system offline in those marginal conditions and force the airplanes to use a non-precision approach.
And by non-precision, we mean like a VOR letdown, we mean... what else do we do, Alex?
Using our eyes.
We're not very precise with our eyes.
That wouldn't be great, would it?
So okay, let's look at that.
And amazingly, this stuff happens.
So this is an interesting incident that happened at Charles de Gaulle airport a couple of years ago.
And an incoming, I think it was an A320, was given the wrong barometric pressure setting.
So the correct pressure setting was 1011 QNH, right?
So would we do it in millipascals in the UK?
No, no, no, no, hectopascals.
Sorry, hectopascals in the UK.
So over here you do it in inches of mercury.
So 29.98, I think, would be about the equivalent, right?
I don't understand those units, sorry.
It means nothing to me.
We'll start talking Fahrenheit next, right?
Anyway, and what happened is the ATC guy gave them the wrong pressure setting.
They missed out a one.
So instead of reading out 1011, they read out 1001.
That might sound like a little change, but actually the effect of that was nearly 300 feet of vertical distance.
And because of the lousy weather conditions and the non-precision approach conditions, the airplane approached, went straight through its decision height, went straight through, and amazingly, the captain figured something was a bit wrong, even though all the systems were misconfigured because of the wrong data,
went around toga, full power, and came within six feet of hitting the ground.
Six feet.
It's a fascinating accident report.
Really, really worth looking into.
So they nearly hit the ground about 0.7 of a mile from the true threshold just because someone read out the wrong number twice.
Bad day.
So it's possible.
But anyway, frankly, most approaches nowadays are moving to GPS, right?
And it's so much more plausible to spoof some GPS.
Difficult, don't get me wrong.
It's practically difficult because the receivers are on the top of the airplane, so you've got to be on top of the plane to spoof it, so you need another plane to do the spoofing.
But it's kind of more plausible.
So what we say is bullshit.
Die hard, too.
And let's have a drink.
Cheers.
So that is one hacking scene in the movies dismantled.
Let's go somewhere else.
I think there's a question.
Oh, sorry.
Is it a Christmas movie or not?
Yes, it's a Christmas movie.
Okay.
Next, we're talking about TV shows and movies.
I want to talk about a Netflix show that made me really, really mad.
I want to walk through the plot.
Has anyone watched this one?
MH370?
Okay.
Awesome.
This is Bananas.
So they did three episodes.
A journalist got really involved, and the first episode talked about the most commonly accepted theory, which was a pilot murder-suicide.
A horrible, horrible incident, but plausible.
In the second episode, I shouted at my TV, right, because they suggested this insane conspiracy where a Russian special ops team took control of the airplane from the avionics bay whilst transmitting fake satellite tracking signals.
Okay.
Let's go through it.
So what did they do?
The first thing they suggested in the documentary was that the special ops team caused a distraction in the airplane whilst one of the team opened up the avionics bay hatch, which is forward, just behind the cockpit, and then got down there without anyone noticing and put both the hatch and the carpet back undisturbed.
Wow.
I mean, we've been into avionics bays a good few times, and, yeah, it's not easy.
They're quite tight.
So next thing they did, and this is the bit where I got really mad, is the hacker connected their Windows laptop to one of the avionics systems and took control of the flight control systems.
It's like, wow.
We were looking at the connector going, like, wow.
That's Windows.
The great thing is avionics bays don't run Windows.
So let's go further.
So what they did, they did some horrible things.
They reduced the cabin pressure, which is doable from the avionics bay, and then they turned off the emergency effort cockpit, which is kind of doable, and the idea was that everyone died, and then they had control of the airplane, right?
And, of course, the next thing they did is then to control the plane, and they used a UEFI BIOS exploits to control the plane and some DNS exfiltration.
We zoomed in on that to prove it, and, of course, it's always DNS, right?
This is the most implausible thing I think I've ever seen.
The next bit they did is they fooled the SATCOM terminal into giving the wrong timing pings, and given that the, I think it was Inmarsat who knew this SATCOM terminal, even they didn't really know their terminal did this stuff until a few days later.
This is just insane.
And the idea was that instead of this plane going south on an arc, it was flown north in an arc into one of the stands, and they were going to land there.
And this all coincided, as you might remember, with the first invasion of Crimea.
And the conspiracy theory was it was there to distract the rest of the world from what was going on in Ukraine.
Yeah, let's look at this.
So they talked about depressurizing the cabin in order to kill everybody.
Now, as soon as the cabin pressure rises, typically over 10,000 feet, there will be alarms going off in the cockpit.
And there are some planes, actually, if the cabin pressure rises to a certain point, it will do a crash dive by itself.
Certain modern planes.
But even if the oxygen supplies to the crew were interrupted, there's still time to put it into a crash dive, to get it to take a lower height, down to 10,000 feet where we can live.
They might have passed out for a couple of minutes.
But killing everybody?
No.
Just isn't going to happen.
They were also taking control of the airplane systems from the avionics bay.
So you'd argue they were taking control of flight by wire.
Now, this airplane was a 777.
It does have flight by wire.
I actually learned this recently.
But actually, as I understand it, there are still some physical interconnections to certain of the flight control systems.
So there would have been resistance from the flight crew.
And then if you were going to hack a plane, the one plane you don't hack is the 777.
Why?
Because it's got a unique protocol.
Everything else flies with a protocol called ARINC 429, which is relatively easy to decode.
You can decode it with a PicoScope, I think.
You can do it with a Raspberry Pi if you want.
Raspberry Pi would do it great.
Anything later like the A380, the Boeing 787, they use a bit more familiar to all of us.
But the 777 uses a custom protocol called ARINC 629, which is incredibly difficult to decode without some exceptionally expensive gear.
Alex, how much was that decoder that you got hold of?
That was $20,000.
I had to give it back.
They wanted it back.
What a shame.
I look old there, by the way.
I don't know why.
So they chose the wrong airplane.
That was another massive mistake they made as well, which is just crazy.
And then uploading software in the avionics bay.
What were they doing?
So as you've probably seen, I think one of the most watched DEF CON Village talks ever was Alex's talk during COVID where we talked about how you upload software using floppy disks in certain older airplanes.
That's the data loader from a 737, I think.
It's quite old, deprecated now.
But it's difficult to get software to go onto avionics.
There's so many controls.
So you want weight on wheels.
Landed, so it's safe.
And the software assigned, so the concept of loadable software air parts.
And even dedicated loaders.
You don't do it from a damn laptop.
So how would we have done it?
Well, if this ridiculous conspiracy theory was possible.
So the only way you do it is compromising engineering teams.
You'd have to have a rogue agent.
You'd need to re-sign the code yourself.
You'd have to code some rogue firmware.
But frankly, it's just making shit up.
It was really, really annoying to see a very sad and distressing episode commercialized for views and clicks and entertainment was something I think was probably a bit disrespectful to those who passed away.
So I think it was really, really sad that someone made up an unbelievable hack.
All right.
That's that one done.
Let's talk about Scorpion.
Has anyone seen the movies, sorry, the TV show Scorpion?
Was it 2014 or 16, Alex?
It's quite a while ago.
Do you remember this?
So this is the maddest script I think I've ever seen.
So this is an airplane that can't land because of some crazy something to do with the software.
And kid drives along in a Ferrari, pops the soft top off, stands up, grabs an ethernet cable from the copilot who's hanging out of the undercarriage and downloads some software from it.
So let's look at this.
Let's look at this.
Okay.
The plot is not a plot.
So that's the avionics bay in this short-haul airplane.
I think based upon what it looked like, I think it was a 737 and that's the avionics bay.
Has anyone here been in an avionics bay?
Anybody?
Okay.
Do they look like that?
No, they look like that.
And they are full of sharp edges.
They're very tight.
So that one is about four and a half feet high.
That's the avionics bay on an A320, right?
It's really not very tall.
It's full of incredibly noisy equipment and there is not a shred of RJ45 or ethernet cabling in there.
It's that particular one.
So they dangled a network cable out.
So that's the scorpion flight control network connector.
Now, okay, airplanes don't use IP, but when they do on some very specific networks, that's the real one, right?
That's a genuine aviation ethernet connector, but that's not used for flight control.
But it's obviously got screws on so they don't fall out.
So that is a real hatch.
Because remember, the guy climbs down.
It goes out of the avionics bay door, climbs down the undercarriage, down the gear, but actually that hatch is nowhere near the gear.
And I don't know if any of you have tried sticking your head out of your car window at like 100 miles an hour.
Doesn't work, does it?
Try it at 160 miles an hour, which is like 140 something knots, which is what an airplane enters short finals at.
You aren't going to hang on to that undercarriage.
It ain't going to happen.
You see he's got the ethernet cable dangling.
So other crazy plot holes.
Now, during the entire segment of the TV show, the undercarriage, the gear, is down.
What is going on over there?
The undercarriage is up, right?
And he's also flying towards some lights as well.
That seems a little brave.
Other crazy stuff.
So when the Ferrari has done its thing and starts braking, it brakes really, really hard, but somehow it ends up on the ramp.
How did that happen?
With like lamps behind as well.
And then I don't know if you remember this bit from the show is as they're climbing away, having downloaded the software to the car, they then buzzed the tower.
So they had so much time left over.
They had time to download the software and then go and buzz the tower just because they could.
They left the runway center line just to go and buzz the tower.
Genius.
So was there really a legitimate hack in there?
Well, we think there is.
But it's not very serious.
We actually made a little video for you.
We actually went down to an airfield in the UK and we recorded a little video of what you could genuinely do that might stand up to Scorpion.
So here we go.
Let's see if it's going to play.
Right.
So that's the external hatch on a Boeing 747.
You can see the undercarriage down there.
There is genuinely an RJ45 Ethernet connector in the EE bay.
We dangled it out.
Yeah, we didn't drive anywhere.
We've got a laptop ready because it's Windows.
Remember, we can do this stuff.
Got the laptop open.
My colleague is hanging on for dear life.
Yeah, anyway, we uploaded some software.
And what we discovered we can do by dangling is we actually could upload Scorpion, the TV show, to the in-flight entertainment system from a car outside.
There you go.
That was mad.
Yay!
There you go.
There's one last movie I want to comment on.
Transformers, what an awesome movie.
Now, there is one point where Air Force One is compromised by one of the bad guys in Transformers.
Autobots.
No, the other ones.
What are they called?
And they go into the avionics bay of this Air Force One, and in there, they find a mainframe.
What is it about mainframes in the movies?
I have no idea.
You can even see P-O-U-T-S right at the top.
So yeah, they found a mainframe in an airplane.
I do not know how on earth they did that.
So kind of where I want to leave all this is airplanes are complicated things.
But there is so much that the movies and TV shows could do to actually show something sensible.
And if we go back to Mr.
Robot, which has got some people at DEF CON on the script writing crew, plausible, demonstrable hacks, why don't they do that rather than just making shit up?
It really, really riles me when we find unbelievable, unhelpful hacks demonstrated in the movie.
It took me and Alex quite a while to find the various sources of this.
So if anyone else knows any TV shows with airplane hacking in, please send them in to us.
This is us.
You will find our details there.
Thank you so much.
Enjoy the beer.
Thank you.