LinkedIn respects your privacy

LinkedIn and 3rd parties use essential and non-essential cookies to provide, secure, analyze and improve our Services, and to show you relevant ads (including professional and job ads) on and off LinkedIn. Learn more in our Cookie Policy.

Select Accept to consent or Reject to decline non-essential cookies for this use. You can update your choices at any time in your settings.

PoC Buffer Overflow exploitation in the British Airways Entertainment System

Hector Marco Gisbert

Associate Professor at Universitat Politècnica de València (UPV)

Published Feb 12, 2019

+ Follow

Updated on 06/03/2019

I have created a blog post providing further details to clarify the CVE-2019-9019.

This CVE is getting a lot of attention and "fake news" are exaggerating this for their own benefit. No, I did not attack the system. I was curios about the USB port socket and its purpose and I found a weakness accidentally.

This was published without putting too much effort on the details about what and how this happened. However since this is getting a lot of attention I decided to write a blog post to clarify it.

From the beginning, the intention was to avoid this issue to go unnoticed, that's all, because I really think this should be addressed and I am supporting stakeholders on this.

Please read http://hmarco.org/bugs/CVE-2019-9019/CVE-2019-9019-British-Airways-Entertainment-System.html before you start to make wrong judgements using incomplete information about what and how this happened (video included).

I do not think I am the first person in the world knowing this issue but I know that now this have much more chances to be fixed.

Tim D Williams

Unless you have access to first class advice on international aviation law providing you with a lawful basis for doing this or had explicit written permission from an authoriaed authoriser at BA, what you have apparently done is far from clever. It might have constituted an acceptable style of “security research” back in the early 1980’s but that was before the film Wargames which influenced the passage of the US Computer Fraud and Abise Act 1984 (https://en.m.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act) and the hacking of the Duke of Edinburgh’s dial-up email account in 1984 which led to the passing of the Computer Misuse Act 1990 (https://www.bbc.co.uk/news/amp/technology-36306419). In short if you intentionally cause a computer to do anything which you know you are not authorised to cause it to do, then you are comitting a crime. It’s really hard to thibk of any conceivable defence. Even if yoi were to claim that everything you have published was a simulation and was not actually done as described on an actual transatlantic flight you would be hard-pressed not to have broken any other laws, not least laws related to hoaxes and frauds ot to have contravened the ethical standards of your employers. In short, whiile you have attracted attention to yourself including mine, this style of “security research” is rather childish and does not benefit anyone: yourself, BA, the travelling public or the wider community of security researchers who commit themselves to behaving in a far more mature and responsible manner.

Jorge Peinado Prado

If I were you I would remove that video before any BA attorney see it ...

Tim (Wadhwa-)Brown

So whilst traveling on the plane, you thought it would be a good idea to attack a component on it? Ethical and legal questions abound... (yes, I'm technical enough to understand the limited practical risk but still...)

Kurt Thomas

Thanks for the article! Airlines, let's not have USB ports on planes. At least not outside the cockpit. On second thought, probably having them there is not a good idea, either.

Victor F.

I think that Ruben Santamarta played with this consoles until a few years ago

Craig Thacker

Interesting Hector, could the other passengers see your messages in the "Active Chat Room" or was this test only on your own chat?

Aristeidis Syrogiannis

As I see was on his own chat .. you can see how it start crashes after the inputs without to press the send button .

See more comments

Explore topics