DEF CON 32 - An adversarial approach to Airline Revenue Management Proving Ground - Craig Lester

[BLUF with citation]
The video explores how airline revenue management systems and electronic flight bags (EFBs) are vulnerable to exploitation due to poor cybersecurity practices, flawed software design, and inadequate integrity checks—highlighting risks such as incorrect performance calculations, data tampering, and potential flight safety failures 24:00.

Key Takeaways:
• Airline revenue systems face complex pricing and inventory challenges, with dynamic pricing influenced by rules, slots, and market conditions [3:52–4:48].
• EFBs—used by pilots for performance calculations—contain critical vulnerabilities, including data integrity issues that could lead to unsafe takeoffs or landings [32:01–33:03].
• A Boeing performance tool bug allowed runway data to be tampered with, leading to incorrect V-speeds; fixing it took years due to aviation certification requirements [32:01–33:03].
• An Airbus EFB flaw was nearly ignored by engineering teams, who claimed it was a "product improvement," prompting regulator intervention to resolve it [35:50–37:15].
• A Fly Smart Plus app had ATS disabled, enabling man-in-the-middle attacks on updates via Wi-Fi, a risk amplified by pilot habits and fixed layover hotels [38:11–38:41].
• A charting app (eOT Manual) used a predictable integrity key, allowing tampering with approach plates that could result in unsafe descent paths [39:01–40:00].

[Closing statement]
These vulnerabilities demonstrate systemic weaknesses in aviation software and cybersecurity, emphasizing the need for stronger integrity checks, pilot training, and regulatory oversight.

Sources:

• 3:52 Discusses airline revenue management, pricing rules, and dynamic inventory.
• 24:00 Introduces EFBs and their role in flight operations.
• 32:01 Details a