These guys have had a poke around some publically available firmwares and describe how it works

Source: IOActive Labs Research: In Flight Hacking System