FBI And United Airlines Shoot The Messenger After Security Researcher Discovers Vulnerabilities In Airplane Computer System

from the that-doesn't-make-me-feel-safer dept

At some point, the corporations and authorities in America are going to have to get over this knee-jerk reaction complex they have in going after citizens kindly pointing out technology and security flaws for them. You see this over and over and over again: someone notices a flaw in a system, points it out publicly instead of exploiting the flaw, and is thoroughly punished for his or her efforts. Often times there is a mealy-mouthed explanation for these punishments, which, chiefly, have to do with security risks in publicizing the flaw even though the ultimate goal should be fixing the exploit to begin with.

The latest version of this has gotten the EFF involved in defending a security intelligence expert who tweeted from aboard a United Airlines flight about his ability to hack into the flight's WiFi and access some level of the flight's communications.

Find myself on a 737/800, lets see Box-IFE-ICE-SATCOM, ? Shall we start playing with EICAS messages? "PASS OXYGEN ON" Anyone ? :) — Chris Roberts (@Sidragon1) April 15, 2015

It may not mean much to you, but he's talking about getting access to communications systems and even some level of controls within the plane itself. And if that doesn't scare you, it should. It scared the feds, too, but it didn't scare them into actually, you know, addressing the security concerns. But it did scare them enough that upon the plane landing Roberts was scooped up by the FBI, questioned for several hours, and had his encrypted computer, tablet, and drives snatched from him. No warrant for any of this, mind you, at least not at the time of this writing. As you can imagine, he's not pleased. Mostly, though, he's confused as to why the feds are picking on him at all.

Roberts told FORBES he was disconcerted by the actions of US law enforcement. “Feds have known about issues in planes for years, why are they hot now? I’m a researcher, that’s what I do, I don’t go out to harm or hurt, why pick on researchers? If not us then who will find flaws?”

Which is the entire point. The government should be thanking its lucky stars that a benevolent force such as Chris Roberts was the one who found this exploit, rather than someone who might actually wish to do harm. Tweeting about it may alert more nefarious folks that such an exploit exists, sure, but it also got the attention of the federal government who had damned well better be fixing this tout de suite. As far as anyone interested in actually fixing this exploit should be concerned, mission freaking accomplished. And yet Roberts is targeted, not because he's an actual threat, but merely for doing what people in his profession do.

And not just at the conclusion of that flight, either, I should add. The harassment continued afterwards.

Roberts was back at the airport on Saturday evening, headed to San Francisco to attend two high-profile security conferences, the RSA Conference, where he is scheduled to present on Thursday, and BSides SF. After Roberts retrieved his boarding pass, made his way through the TSA checkpoint and reached the gate, United corporate security personnel stopped him from boarding the plane. Roberts was told to expect a letter explaining the reasons for not being allowed to travel on United. Thankfully, Roberts was able to book a last-minute flight on another airline and has now landed safely in San Francisco.

Nevertheless, United’s refusal to allow Roberts to fly is both disappointing and confusing. As a member of the security research community, his job is to identify vulnerabilities in networks so that they can be fixed. Indeed, he was headed to RSA speak about security vulnerabilities in a talk called “Security Hopscotch” when attempting to board the United flight.

This should be seen as useful for the public, which now knows somewhat certainly that United Airlines would much rather attempt to achieve security through obscurity rather than seeing experts like Roberts as a boon to their own safety product. Should you need to fly anytime soon, do you really want to board a flight run by a company that has now demonstrated that it tolerates vulnerabilities aboard its flights and also would rather try to put its head in the sand than deal with those vulnerabilities? I sure wouldn't. Keep in mind, by the way, that United is getting this important information into its own security for free. But rather than be grateful, out come the cross hairs.

It's enough with this crap already. No amount of embarrassment is justification for harassing a security researcher who happens to be fault-testing technology on high-profile targets. And doing it free of charge, I might add. In the realm of security, Roberts is a helpful force, not a harmful one. It'd be nice if the Feds and United Airlines would behave gratefully, rather than targeting the man.

Filed Under: chris roberts, hacking, in-flight computers, in-flight wifi, obscurity, research, security, shooting the messenger
Companies: united airlines

Glenn Greenwald Says NSA, GCHQ Dismayed They Don't Have Access To In-Flight Internet Communication

from the one-that-got-away? dept

Glenn Greenwald gave a video keynote speech to the Chaos Communication Congress last Friday. Most of his talk revolved around the Snowden leaks, of which he says there's plenty more to come. (The most conservative estimate puts the total number of pages taken by Snowden at ~58,000, of which less than 900 have been released. Cryptome's running count puts it at 799 pages as of Dec. 24th -- 1.4% of the most conservative total.)

According to Greenwald, an upcoming story at his new venture will focus on one area the surveillance mesh has failed to cover -- one that's driving the NSA and GCHQ crazy.

He said he was working on a new story indicating that the NSA was “obsessed” by the idea that people could still use some Internet devices and mobile phones on airplanes without being recorded. “The very idea that human beings can communicate for even a few moments without their ability to monitor is intolerable.”

I can imagine this must be very irritating for the two agencies. Somewhere someone (many someones) will be generating data that isn't immediately being harvested. I'm sure there's a "fix" on the way to plug this "security hole." It's not as if government intelligence agencies are going to sit idly by while a government regulatory agency (inadvertently) creates airborne data havens by loosening restrictions on electronic devices.

Whatever's preventing the NSA and GCHQ from making a grab for in-flight data and communications isn't a technological issue. In-flight WiFi and other internet connections have been available for years. All data necessarily flows in and out of airborne choke points, which would make it very easy for the agencies to collect, store and retrieve the data later.

No, what's holding the agencies back is likely a lack of justification for patching up this hole in its collections. The metadata being generated may not be protected by the Fourth Amendment, but there's no simple way to collect and minimize this very mobile form of domestic communication. International flights would perhaps provide some leeway for collection. Once the flight is out of domestic airspace or is connecting with foreign communications towers, etc., it could be argued that the data is fair game.

Playing the "national security" card is a non-starter. To claim potential terrorists are using in-flight connections to communicate without fear of surveillance is to call into question the skills of those providing security on the ground, putting the DHS in the awkward position of explaining why its TSA agents are allowing suspected terrorists to board planes. It also would require officials to believe that terrorists would be willing to risk discovery by airport security in exchange for a few hours of surveillance-free internet usage. None of this is very plausible, and deploying arguments along this line would paint the agencies as data-obsessed paranoiacs, not exactly the sort of image they wish to portray at this point in history.

We do know the NSA collects data on flyers via flight reservation systems and Passenger Name Records (PNRs) created and compiled by airlines. This would give the agency some idea who's flying and where, and there's little doubt it would like to take a look at any communications occurring during these flights. I suppose if it wanted to pull the data retroactively it could, provided it could convince the FISA court the data would be relevant to terrorism-related investigations. The TSA could be tasked with linking device info with passenger records, but there's probably no unobtrusive way to achieve this goal. Because of this, it would be simpler for the agencies to require the airlines to trap communications data and hold it for a certain length of time. PNRs could then be matched with flights and that specific data harvested and pored through for possibly "relevant" communications. Again, this would involve many more entities and tons of domestic citizens' metadata and communications, something that would have been a tough sell five years ago, much less in today's Security vs. Privacy climate.

Filed Under: gchq, in-flight wifi, nsa, surveillance