one oh boy yes right the name that I've
given this presentation is internets of
planes when I sent in the draft fashion
to the people in my company who know how
to sell themselves better than myself
they said Nana Nana you should change
the title and you should give it the
following Hakim Elena jet cabins aniseh
well it's always good to have good
friends so this is the index of my
presentation first of all who am i
introduction the applications let us see
what is the purpose of this presentation
then we move on to analysis some
acquaintances are here in this room
following this presentation that will
help me at the end of the presentation
most likely then we are the plane I will
tell you more about our vulnerabilities
that we found some fixes and then
research timeline so first of all
congratulations and happy Anniversary
for the 10 years for the great work that
you do in terms of dissemination because
treatment having trusted me to give me
the opportunity to share what I do with
you and then we see significant change
in this decade in these 10 years of time
so we also have change our entire watch
see Alberto OMA all of them who work for
free as well as minions volunteers
well according to this photograph what
priority were expecting a dog to give
this presentation well my name is Daniel
Martinez my aliases donítö I'm a sinner
security consultant in terms of
experience I say longer than a hobbits
because I've gone through the experience
of many people I've seen lots of child
labor because people some people say
that they have 18 years of experience 20
years of experience and then I said to
myself okay experience how long more
years or longer run a hobbit and then I
was about to show this photograph and
then perhaps if I go and show that you
would be expecting I don't know some
food to come over here and then spam a
bit of a spam oh I have to say that
working your active company it's an
American company has an office in Madrid
and I'm very lucky to work with highly
interesting people those people that
make you feel a bit stupid when you work
with them and I was like that means
rounded by smarter people we break
things we like big things satellites
aircraft planes ships so what I will be
sharing with you it's a bit related to
what you said nation this is basically a
system in room time where I've found
some vulnerabilities it is installed in
many devices of hismus series in
aircrafts and others and then it is also
related to revenge presentation
about antennas aircraft etc so nowadays
well not that much nowadays but in the
past the incidence of the things is what
has become the option nowadays if you
have luck change when no one so
therefore all the companies started to
push the introduction of Internet of
Things to sell a lot over a short period
of time and when did it all end up well
every day we ended up having lots of
problems with bitcoins and we weren't
being inspired all the time so the
interesting thing about this is when the
Internet's of the things is it was
implemented following the same
philosophy in well other fields such as
aviation nowadays we can find mobile
apps that will help us interact with
some features in the plane such as
multimedia etc this is the most
important slide and it is important to
know that aircraft systems landing
system following a different what
operates on a different network and
network the systems that we'll be
discussing how connected to we can
gather information about the altitude of
the plane that we may introduce into our
device and say well the aircraft is
flying at five thousand feet and we are
flying over Poland so during my
presentation well we ve situations that
we found this could create situations of
discomfort on board an aircraft playing
with temperature light intensity and
other type of attacks but in any case
well this is not a direct threat to
safety we will not be moving any
aircraft at all so these are the
applique
to reanalyze I don't know that you are
aware of these companies well I didn't
know any of them but Bombardier drink
about to me in terms of trains whereas
this one is bombarded having control
developed and then the other one is very
common promote developed by Rockwell
Collins so we also took a look at other
applications but we cannot really show
it to you because of a nondisclosure
agreement so these are some screenshots
that we can see in Google Play we see
here different roles different things
that you can touch on having
entertainment location of the fly the
toilets that was very interesting when I
found it this is a video where Rockwell
Collins company showed us what they do
from the moment you settle into your
aircraft you and your air crew will have
many ways to conduct your cabin
experience your air crew
and without
device becomes an additional
so your mobile device becomes an
additional controller use your wireless
headset for hands-free selections and
communications
Jonathan I don't own any of these jets
oh it's a pity I would have very surely
crushed it so what happens that these
applications cannot be researched cannot
be analyzed and DS it is not a specific
or this is not exclusive of aircrafts
only it also happens in other fields so
this is an app that will have you
interact with having things but if you
don't own that chest you cannot really
go ahead with it so the application is
connected to the Wi-Fi network on the
aircraft and then it interacts with the
capabilities in the aircraft so these
episodes available at is it is not
within the scope of our research and
then it has been developed by Rockwell
Collins which is their developer many
companies work with Rockwell Collins so
when you search for a device over the
map of an aircraft so we can see that
all companies are working with each
other even if they do not kind of
shorten them in the first place and as I
said it helps you interact with all the
carving capabilities and it is based on
wireless access points so we gather data
and we can interact with them and now
I'd like to tell you about the
infrastructure of the systems we but we
are interested in is the mobile device
that is us and we will move on the right
side of the slide these are the elements
we will interact at and then the
elements in the center's will help us
reach the elements on the left this is
another map which I like
well because I was suggested to show a
map of the aircraft's then I could see
that device I said what is that device
there it is a six-legged
device and as a all control is one of
the companies that use win OS and it is
one of the systems and my colleague
deuce ever crashed so I'm not going to
say that those things have broken
everywhere but there are many devices
key devices here that were not fully
robust as some stage of the cycle
development so this is the layout of the
devices on the aircraft's but this is
not that relevant to us but this is for
you to have some background and now let
us move on to applications
well the apps have different user roles
different roles depending on whether you
are true whether you are passenger your
world would allow you to access some
features and not others you will never
be able to drive to move the aircraft to
access a true section you'll have to
enter password we've seen that what do
we say when do you open the manifest you
see an activity to ask you to enter a
password then you take a look at the
code we can see that the password plays
a role but we will not be going into
that in this presentation but it's
interesting for you to know for what
coming is the location of the person on
the aircraft so there is a person in the
front of the cabin the other one at the
rear of the cabin so the purpose of this
presentation is the following
oh we said that we wanted to come here
to see what you do when you are facing
this type of application so that you can
mimic a real connection environment and
to find out the entry points to attacked
a situation or to launch an attack while
the objective is you can't try to be net
crafts and to do that from M mark once
you have the working environments we
will start to find vulnerabilities and
then the we will tell you about the
steps that we follow to find the
vulnerabilities and in some cases we
will exploit some of those from the
abilities these are the target versions
of our research so both are numbered
with the same number and this is not
right because the bashing on top is two
two two and one below is two two one and
thanks to that now I have a new demo I
would also explain you there no mode
basically imagine that you are a new
rage or you are a salesperson of this
company and you want to sell these
products who company because you're not
going to sexy aircraft with you and well
they take these mobile app with a demo
mode the demo mode is then open and then
demoed and then you get to see the air
traffic so this is an innovation of the
operation of the app features in is this
will be interesting
later on in my presentation
during the talk we will combine the type
of analysis the one hand code analysis
which is essential but we will also be
basing ourselves in logs in network
traffic and all that oftentimes you'll
have it in the code when you see it when
you find it having an app that helps you
makes you save time I'm not going to say
CFC but these applications are very
interesting to learn to improve to see
new things what do we do first we get an
apk which is not a
Seyfert zip a PK 2d we open the file and
we analyzed it to XML I don't want you
to read through it but you may notice
that they are very similar the only
thing that changes is the name of the
package in those cases come Robert
Collins venue having promote dot for
Martine and the other one doesn't say
dot Bombardier so therefore we are
talking about the same up what are the
things that are to be channel here entry
points activities that are exported
activities that are not exported DVDs
and all these elements and we are all
aware of we read through all that we
guarantee standing as to what the app
can do the only activities that were
exported for this month of the screen
and now we will be focusing on
permissions you will
later I understand but I'm writing this
when I'm showing this we may write on
the car we can change the Wi-Fi we can
access the network estate more
information about what permission allows
you to do you can find it on the Android
app you can use very many tools well I
like it
J ATX quite a lot with those two flags -
if some of the station is detected maybe
the obfuscated shell byte codes often
times when we compile an app some code
is not well decompiled mistakes are
found whereas in this case instead of
sanity we cannot do that sometimes it
tells you the code right at the bottom
and then sometimes you'll come back to
an older version so we can do several
things to continue discovering things
another one for you to get a travel file
is very good you open it with under the
studio to export it and everything in
the end is this place it's played in a
beautiful manner so the first thing that
we do is start the app we got the ABB I
heard of lots of info so that it is not
too boring so basically in green these
are the things that we found and say
look I'm starting now is that any
session in it then a warning instead of
timeout and then I said finish the step
one okay step one completed it is very
easy to see
so more information than needed is being
locked in this is a good starting point
to look for specific change in the code
and to look for this element when it
says done step one could be interesting
to start organizing the code there as I
was saying if you look for step then you
end up in a Java class which is known as
step one so therefore it makes sense for
me to start off in step one what do we
find in a step one this is an example of
code you call it from the run function
and basically what it does is the
following the code is detecting whether
the SS dld are connected to well first
of all if you are connected to an SS ID
and then if that s ID has dd-wrt dead if
you have a string it gives you an idea
of multicast if you look for that IP you
will see different value to the value
that it would have otherwise so for this
type of things please do not share these
in production shouldn't be there so now
the state machine step one then will be
more onto the step two to step three
when you take a closer look at it that
wants to go from one step to another to
move from one step to another and what
we can see that this is a state machine
State one may finish my way or another
depending on how he finishes he may go
to demo mode etc then there are a couple
of classes coma event
under state initializing that implements
what I've just told you
there never tells you about the step
number two where need performs it
finishes it is ended and then it moves
on to the next step when this step one
is ended takes a look at a number of
things and then it ask you to move on to
step 2 goes to step 2 when the step is
and they're here so do you do that from
a state initializing of Java now let us
move on to multicast to see this line we
see what multicast does multicast is a
protocol running under UDP and then
based on the principle there are a
number of IPS that you can use to
sending information and that information
reaches the devices that are connected
to multicast
therefore I may be emitting in my
network buddy if you are not listening
in that multicast group if you haven't
joined the multicast group you will see
what's in there that if you aren't
having Joan's you cannot really see it
so we will open a second security import
53,000 and now we can already see some
of the next step Jason which is the
Android library to work with Jason
we start our search we continue search
cone announcement Tulsa Zoo
kind of makes us anticipate the format
of Jason but we really want to see
what's in those values up there comes
path come from there it is not very
obvious case it could be bias and then
we agreed port 3 1 & 3 2 I had enough
the rest of it because it is doesn't add
any value so at the end of the day give
us a call announcement with the
following information we take a closer
look at it of this cone announcement in
the step 2 we see a download
configuration file which is getting a
connection and it is but the other
method pretentious so the next method
which is called the next class is file
downloader and the definition is quite
clear or at least it is quite clear to
me we have FTP download our connection
address 3 1 3 2 and half as well as an
enemy file which has been defined in the
package as well as storage we can see
here is that when you reopen FTP file
download it receives a hostage username
the password a directory file name as
well as a local directory of the device
there is a java class known as in its
tasks that will provide quite a lot of
information about the check evasion and
the possible valid values in it I'm not
going to go and analyze each and every
one of data
and now I'm doing good with time but
still I will go a bit fast
Jason so the values that we're
interested in here are 1000 - which is
an IP IP that we will find in the code
of the app 421 and use a password we are
not going to complicate our lives if we
are going to send it will receive an FTP
through multicast why should I enter a
secure password so we will be using the
tool-house IP d I'm sure that you know
it from UNIX to analyze the traffic
between the server and the device with
Wireshark or whatever you would like to
use and then will reduce but - to create
a simple script Ascenta configuration
over multicast output that we get from
Center dot P I and this is the one that
I created to send information through
multi cast you can see the path
configuration at rest port this is the
host apt actually there are many
summoners of a scripts in github I tried
not to look like a hero here in creating
a access point to start one and then you
add HP and then you start to play around
with it and I have already routed one
interface with another so we start the
app we execute our Center we can see
that it tries to connect to our FTP
server this is no surprise
and now let us try to configure an
environment and to start an FTP server
but before that let us take a look at
the log but we see in the log pad the
same thing and trying to connect to
these class refused connection an error
so the app is telling us to follow these
steps so it was kind of it was kind of
interesting too in that it was good fun
actually and as a 1 FTP server oh what a
pain I took a look at it and then I just
the server in the meta exploit assistant
and I said well then I could see that it
didn't work well with folders so if you
insert a point file name is Ola dot txt
it done knows accepted and then I could
realize that if I created in the root
folder under test folder I could take a
look at it and then having reached this
point of craziness I installed an FTP in
the server and that was it
we started the FTP server and what did
we see in the webshop it is asking us
for a remote configuration XML we don't
have - and you can also see that in the
code but we already seen here so let us
take a closer look at it if you took
query XML if you have to read how an app
passes an XML well it could be really
boring but you know that there are very
difficult things to generate however
demo mode I look for data string for
that file and I found a folder that had
the primal configuration XML at the ends
of the day that included information
about the characteristics of the
aircraft such as like UNC its sensors
media etc so in a folder I found this
file at which basically I copied and
pasted on and as well let us give it a
girl so the app is not being very
reluctant so I copied the file the file
was downloaded and I say oh well done
another file is zip file took a look in
and I could see a folder known as asset
and what we find in my configuration XML
and then we also find another two
folders mdpi and excite DPI
because the file is icon Android XH a1
says SH dpi to candle you don't have to
really make a mistake on purpose I just
created a file with information inside I
put it into the folder and then it must
unloaded then I took a look at Lockhart
and we can see that we were going
through all these steps it was connected
to our up and then when I went back to
this light and I said well this is not
that that was not such a big job and now
we follow all those steps were already
in the plane because it gets all the
configuration this is the same as a semi
mode and because the application offers
its it parses it but we offered that
from a different environment so we we
are going to do a mini demo such a great
time
well the thing is that to comment in the
video I have to move over there so the
higher the number of black screens so
top left I will live tonight I will
start an AP then on the right I produced
and searching in pairs whether the
process exists if the process exists I
use Lockhart's to find information about
the process you know that every button
that you press to get seven lines as the
results and we just want us bottom left
we get to see the Python file Oh hold on
this is a mobile app the mobile app Tara
and using is the last one the one that
offer is the report of everything well
anyway they decided not to correct it
don't you change it this is the last
version of the app and it works bottom
right I'll show you so that you can see
how the traffic has been sent and then
we'll change it to have to be so this is
the latest fashion in the market
beautiful thing is
then the AP
I'm starting to send in multicast
traffic as you can see I am sending it
from three IPS to the multicast IP
you're already connected to the Wi-Fi
this hippie dump / / 21 to see what we
can see in there we are really looking a
mobile on whether the processes started
is this the app this is the process of
TP traffic
so the up is serial up
so we'll download the zip we'll process
it it takes some time
come on
now I've run it again occasionally I'm
gonna bring but sometimes when I heard
ferry components working with mobile
apps you have to uninstall them of the
time clearing the cache of wife and
doing other things this is extremely
complicated but I did write reopen it
then the configuration was well loaded
and then the demo mode has not been
loaded I want to show you something in
traffic okay so I have a pointer with me
you may notice there is a JSON here
MSG data there are lots of information
you can see that in 421 but it is not
FTP traffic obviously and actually FTP
server says user and password this is
for you we can't continue emulating on
mimicking these environments in the
latest market application
and these aircraft flies so very good
from here we will take a look at number
of annuities that we found in our
analysis as we were loading the
configuration and XML and I see the word
unloaded the function unfortunately was
not well done we will take a look at the
code a few minutes but basically what
happens here is that we can enter a
cross sectional route when you create
the zip file in Java and other languages
by default they do not sanitize the path
of the entries if you were to do it in
laminates that will be omitted and it
will be written in the file we are
working with so obviously supported
vulnerability we had to do it properly
we have to simulate the environment so
for this reason we can find transversal
routes in the zip we can write if their
permission we could get in the SD card
we could get an e rc
dependent it's not the purpose of this
presentation to get in here see but it
would be nice be nice to buy it over and
send him half the plane this is not the
right place to show you an ELC with an
Android version of the prehistory
anybody can do that but it could follow
two parts one is explosion of everything
like the States fry you know the fine
the pathway user his prone to region and
that was it and then if the application
is multicast because it's has a number
of functions it will turn out to see two
million dots on Dex files so with the
previous versions of Android you would
be able to remember right rewrites
classes in that folder and there you
have yourself so as I was saying the
first I'm using the hetaera tool someone
that applied in black had 15 I think and
what the guy he achieved remote
execution of san through a mistake in
the keyboard which also uploaded a zip I
did this with a PK but we can use it as
a px team basically we say the name of
the file so we noted it could be we load
the destination fund and and so the
vulnerable function I'm going to show
you about is in these classes in these
two places so why is it in these two
places I don't know maybe they're paid
by kilo this is the function the
interesting part is in green basically
trying to create a file F variable and
use an absolute path adding and that is
a bar which is the separator of the OP
cysts
and get name which is the name of the
fire you make some verifications then it
writes the fine according to that and
you we should be able to do something
we'll do another demo now
one more sin one more sin basically you
find the same thing but I'm showing this
or you can see here we have a call to me
item that I used to send it through
multicast we have the AP working with to
make the reset here we get the
permissions I was talking to friends in
the script down there and so I asked
them to write the script on monetization
to see if their changes and you can
execute one one step and list the
content of folder according to what you
need it could be more difficult or less
you can use maybe another day name I'm
not sure the code so basically we have
the list content of that SD and we'll do
the same thing we did before but we will
offer the zip that I talked to you about
we wait for connection as you can see
here's the UDP traffic FTP traffic we
will monitor to find the file and then
we have the folder okay
right now there's only three folders
and it has created a fourth basically
all the laws shown through a to be okay
Wow and also keep them here
and ours are also in the AST so this
version here we have it I think I have
another fun here I'm trying to download
everything the apple fell parts we have
another file in USB so we stopped
yes it is kind of - your mother knows
about it but I got a benefit so we can
see the date' and on that so this is
what we showed the manufacturer and we
say you haven't caught a server
validation and we were able to do this
last night I saw the video I showed you
the spam of the application and you can
see we have tablets on the wall I do
know the user Android or iPad or other
obsess I can't really find out I'll say
things that I don't know for sure but
those are the tablets there
let's see where we're at as I was saying
on the basis of the design of the
application we can broadcast a valid
configuration so this was this would
download defined so these are the things
we could do we could get a faith server
as it has a password we find method
verified in XML to find the site with a
password we could hijack this and to get
the pass therefore we could access
characters that a passenger doesn't have
but bits is better than before I'm
better than nothing other things we
could do if we had access if the Wi-Fi
was open or we had a password broadcast
through a menu my attack controller
music you can have the listen to maluma
the entire flight when in fact you
couldn't but you can just think about it
then which broadcast music any kind that
it can't change
you can do this with the subliminal
recording to get people to vote the
party you want when they get off the
plane so I don't have a lot of
imagination as you can see as I was
saying what can the crew do they could
change we can change the temperature I
understand that all this has manual
controls but it's not bad to play with
it maybe I don't have access to the
device I don't know what what
temperature you can put the plane this
is controlled by the app or by a server
I have and I can change it not but these
are things that I can access obviously
communications are not safe or secure
the application implements a layered
encrypts communications so the attacker
could make the management starts
sensitive some secret if the application
is based on our network without Wi-Fi it
could become the mail in the middle then
I was seen that according to the
connected device form in which you
download the configuration changes
encrusted tablets although we were
discussing earlier if it has the word
SDK Devon Devon I can download it
through HTTP instead of RTP so you just
look for the connection
HTTP 80 path as you can see here
so fixes as we were saying implements a
TLS authentication client-server do
something to make it not easy as issuing
through multicast a password and user
now I found the bag I said hey I'm
sitting I wouldn't you know how to
envelop half of the application or so
there's sufficient knowledge to fix this
the sanitization of the sit it would be
good to review the application in hires
other minor issues
well this information it's in the logcat
it's in the code you put the password
and get it through the locket and you
can save it in the folder fold is the
one we said earlier no one we saw in the
video
so obviously for us when you're using a
complex application everybody uses prim
F's but in this case it's not necessary
joshan is non hack so we find a number
of i/os attacks of the famous XML lol
memory to parse and the application is
overloaded v zip it's the same you can
make a zip with a hundred gigabytes and
that's the end of the app online is
important so February 2018 we discovered
I ulnar ability then they sent an
advisory client March 19 so we found
this we can do all this so we will
coordinate with Bombardier to see it and
this is when we were publishing it I
don't say that we that they haven't
fixed it
we could continue playing to do plane I
don't ask you to remember everything
because I couldn't either this is the
permissions given by the application so
what problems do we have that gentleman
is creating files in a SMD SD this is
the way you fix it fix this for a while
but anyway so the last version of the -
- - remote is here so if we try to do it
we get the error oh my god something is
happening we have two apps
I put the videos on YouTube because I
didn't know if I was gonna be left
without internet so there or whatever's
have the backup of the backup of the
backup this only accept the bombardier
application okay
how are you doing timewise should I show
the video now okay I'll do the demo if
it fails so give me a sec
give me a minute and this is the last
slide actually
malice toward a stocky stocky vamos a
poner Valley
Malibu Curitiba damp vamos para para que
se como el video give me a second cuz I
want to get everything ready to show the
video
so we will connect
Linux just oh yeah
nearly ready please be patient
Palestinian under Sharia I'm trying to
show the mobile on the screen have you
seen any icon around here on the screen
so give me a sec male crew gotta see
Bali see auras male touch cell ok so
what is the shell now
now I can send all this to the screen
there we go weird I don't know is how
can I do it blindly here we have the app
and now I have to raise a small issue
here okay this is the script that lists
the information on the card
we want to start the Wi-Fi
so we're connected no more flight mode
the Bombardier application we don't have
crochet or anything and this is the two
to one version so here we have a UDP
right there's nothing we can see here so
if I do a cat here we get the cold
better
so will you here we can see here the
forseeable UDP traffic so we will put
your TCP X 21 so now we will start the
app is the content of a folder here we
see that the app is not executed and
somebody's messing around with a Wi-Fi
maybe it's some of you but watch it
because I've got all your max addresses
so here we see the app starting up I
don't know if I'm someone who's being
naughty here or what is happening in the
lower part
it says working now what there's we
won't be able to have the video I'm
sorry
bombardier last version the video is
executed in some of the screens of this
computer ok overlook all this jump close
on this this is what you get when you do
tests with Wi-Fi and now the file is
created again loads the latest version
and it writes the file so we do and
there we are so the last version is
still rotating
you don't applaud you give me hand or
anything really look so you were good in
the end so it created a file here we
have it
now here we have the Canton file
I guess he fainted wow you're really a
difficult crowding maybe someone is
gonna connect to the Wi-Fi
I think I have just one slide to go well
I'll put this at the end this wonderful
photo reference and this great video to
thank all of you for putting up with me
routed Khan and my company for giving me
the time to do the research and as soon
as I cut they said
didn't you want to do things with
Android ok look we have app for planes
so that's how it all started thank you
very much
[Applause]