Boot The Messenger! United's Response To Accusations Of Lax On-Plane Security
Jack Gilliam writes for the AP that UAL stopped a security researcher Chris Roberts from boarding his California-bound flight on Saturday in the wake of his tweets suggesting the airline's onboard systems could be hacked:
Roberts had been removed from an earlier United flight Wednesday by the FBI after landing in Syracuse, New York, and was questioned for four hours after jokingly suggesting on Twitter he could get the oxygen masks on the plane to deploy. Authorities also seized Roberts' laptop and other electronics, although his lawyer says he hasn't seen a search warrant.A lawyer for Roberts said United gave him no detailed explanation Saturday why he wasn't allowed on the plane, saying instead the airline would be sending Roberts a letter within two weeks stating why they wouldn't let him fly on their aircraft.
"Given Mr. Roberts' claims regarding manipulating aircraft systems, we've decided it's in the best interest of our customers and crew members that he not be allowed to fly United," airline spokesman Rahsaan Johnson told The Associated Press. "However, we are confident our flight control systems could not be accessed through techniques he described."
...When asked what threat Roberts posed if United's systems couldn't be compromised, Johnson said Sunday: "We made this decision because Mr. Roberts has made comments about having tampered with aircraft equipment, which is a violation of United policy and something customers and crews shouldn't have to deal with."
Roberts also told CNN he was able to connect to a box under his seat at least a dozen times to view data from the aircraft's engines, fuel and flight-management systems.
"It is disappointing that United refused to allow him to board, and we hope that United learns that computer security researchers are a vital ally, not a threat," said Nate Cardozo, a staff attorney with the San Francisco-based Electronic Frontier Foundation, which represents Roberts.
Cardozo said Sunday he hasn't seen a copy of a search warrant that would have been used to seize Roberts' electronics, and that he's working to get the devices returned.
Geniuses. Yes, the "solution" is keeping the guy off the airline rather than talking to him about what he knows -- and finding out if he is, indeed, telling the truth -- and using this to fill any security holes.
Just talking about this story aids the terrorists, doesn't it?
Now they know they can:
1. Plug laptop into plane while inflight.
2. ?????
3. Profit!!
You are correct, Ms.A. They need to do what others do, and pay this guy to help them close the 'holes' which may or may not be there.
drcos at April 20, 2015 8:06 AM
Did I read that right? Does this person claim that he was able to connect his laptop to the avionics systems of the aircraft while in flight?
Forgive me, but I wouldn't let him on board my $100-million aircraft either. And I wouldn't want to be on any aircraft that he's on.
Sure, maybe he has valuable knowledge about security vulnerabilities in commercial aircraft, and it might well be useful to enlist his aid in trying to learn more about them.
But, in the meantime - he's admitted to tampering with the aircraft, and I take leave to assume that he knows precisely nothing about the avionics that he's tapping into. Until he stops doing that, he should be walking. It would be no different than if he (to create a physical example) smuggled himself into the cargo hold, and then started opening inspection covers and twiddling with whatever he found underneath them. He should be arrested and charged - just the same as if he had tampered with the smoke detector in the lavatory.
This image of the 'hacker' as a sort of benign harmless and all-knowing force for good is misplaced. Many of these people are doing the digital equivalent of saying 'Look at that knob/switch/lever. I wonder what would happen if I were to turn/press/pull it? I know - let's try it!'
llater,
llamas
llamas at April 20, 2015 8:40 AM
I wonder if Mr. Roberts had tried to alert United about their security concerns in a less public manner and was ignored and blown off.
Southwest Airlines had no trouble taking his money and letting him fly, so there's that.
Janet C at April 20, 2015 8:44 AM
"A box under his seat".
Right.
Decades of service by most of the United fleet, and nobody's noticed this? Is there any design demand at all for a flight-systems interface to be in the PASSENGER compartment, where seating is routinely changed in the life of the aircraft and varies between both airlines and aircraft production series?
Show me the "box". Until then, I think you're selling me Kleenex.
Fear!
Radwaste at April 20, 2015 9:25 AM
Yeah, I'm not buying the 'box under the seat' story either, but it really doesn't matter what his exact path into the system was.
I think I'm right in saying that the USB outlets in the armrests are power-only - no data? I've never sniffed one to see.
FWIW, I bet he got in via the in-flight entertainment system or the in-flight wifi. Or he may have tapped the company's private telemetry - for which he would not have to be on the plane, necessarily.
llater,
llamas
llamas at April 20, 2015 11:00 AM
I think Raddy has it right; this guy is probably blowing smoke up United's skirt. I seriously doubt that there is any part of the avionics network running through the cabin where a pax can get to it. As llamas speculated, he might have been able to hack into the in-flight entertainment system, which does have boxes under seats, but that's a completely separate system for that very reason -- the worst thing he would be able to do with it would be to annoy other passengers. There is a small amount of aircraft telemtry that is gatewayed into that network, but it's nothing that you can't see by just punching up the "flight follower" on the entertainment display. Another possibility is that he had an ACARS receiver, but that's also a one-way system and he wouldn't really get any data that would be of value to anyone other than an aircraft engineer or tech.
(One additional possibility is that he had on board a radio transmitter that mimics the TCAS transponder. If so, that's an excellent reason to throw his ass off the flight and not let him near an aircraft ever again.)
There have been cases of "security researchers" who are really just blackmail artists. They go to a company and say, "I know how to hack your high-security systems, and I'll share the information with you if you pay me a consulting fee of $450 per hour." The companies hire the guy, and then it turns out that his claims aren't true and he doesn't really know anything.
Cousin Dave at April 20, 2015 11:30 AM
I flew to Paris on American (yeah, my bad) and there was zero leg room because there was a "computer box" under each and every frickin' narrow-ass seat on that plane.
Apparently keeping short-attention-span techno-freaks and gaming chilluns glued to their screens is more important than sitting comfortably for 11 hours.
So, yeah, there are boxes under seats. If this shmoe can open one and connect, then can't Abdul the Mad Turban figure it out?
Gog_Magog_Carpet_Reclaimers at April 20, 2015 3:26 PM
Nope, boot him off is exactly the right call. You simply don't get to threaten airplanes, and that's what that tweet was. Hire him, maybe, or more likely his competitors, since he shows a startling lack of forethought and common sense. But yes, boot his ass off that plane.
momof4 at April 20, 2015 4:34 PM
"A box under his seat".
Right.
I saw a bit about this on TV earlier. He's accessing the entertainment system. Given that someone thought putting the electric grid on the commodity internet was A Good Idea, I'm thinking "security" was not the first thought when designing this subsystem. I will not be in the least bit shocked if it turns out to be on the plane's internal network, not segregated onto its own network. Duplication like that? costs money!
But United could have seen his tweet and raised the bet: if you can take over a airliner sitting on the ground idling as a proof of concept, we'll talk about a nice fat contract for you to fix the problem.
Penetration testing does an airliner good.
I R A Darth Aggie at April 20, 2015 6:17 PM
See previous about seating changes. There is zero utility in routing FLIGHT SYSTEMS into the passenger cabin.
Radwaste at April 21, 2015 4:06 AM
"I will not be in the least bit shocked if it turns out to be on the plane's internal network.
I can absolutely, 100% guarantee you it isn't. If they were, the FAA and EASA would ground those aircraft in a New York minute. Clue: In-flight entertainment systems are not made or installed by Boeing or Airbus. They come from third-party suppliers, and are installed at either a supplier facility or the airline's maintenance facilities, after the plane has been delivered. Boeing and Airbus won't touch an IFE system; they don't want anything to do with it.
Cousin Dave at April 22, 2015 9:18 AM
Leave a comment