Slashdot Mirror
Congressman Calls for Arrest of Security Researcher
Christopher Soghoian writes "Yesterday, I published a tool that allows you to Create your own boarding pass for Northwest flights. This was an attempt to document the fragile and broken state of identity/security for domestic flights in the US. Today, Congressman Markey (D-Mass) has called for my arrest." From the ABC article: "'I don't want to help terrorists or help bad guys do bad things on airplanes, but what we have now is what we in the industry call security theater. It's made to make you think you're secure without actually making you secure,' Soghoian said. 'As a member of the academic research community, I consider this to be a public service.' Soghoian admits that he hasn't actually tried to use one of the boarding passes yet."
Another politician calling for action in places without even thinking. Massachusetts has a Hillary too?
You've always been able to do this. You can change the A/B/C boarding for southwest flights. You can save things to print them out later. You can make your own spoofs, and even make a real barcode if you want. You can remove the "search my luggage" checkerboard pattern, too. You can do a lot of things when you have the html and images.
But what Christopher Soghoian is doing is rubbing the government's nose in it, while they're actually trying to prevent people from being asshats.
Maybe the government is doing it the wrong way. But like any responsible security researcher, you do not release a malicious tool before giving some ability to correct the problem first. You especially don't do it to make a political statement on the tool webpage. And sometimes there's not a good solution.
Christopher Soghoian is an asshat, and not what I'd call any sort of responsible security researcher.
Go back to defacing websites with political messages with the other script kiddies, and blaming microsoft for all the evils in the world.
You assume that this would go to trial. Obviously, this is the work of a terrorist collaborator, so he's an "enemy combatant" and should be sent to Guantanamo Bay for the duration of the War on Terror.
... not even people with boarding passes.... great.
ummm so if none has "test" these generated passes how does anyone know that you could actually get onboard a plane with it????
you could probably get past security which is bad....i guess.... but you'd still have to go thru the screening so not sure what good that would do.... unless your not going to fly but you have a thing for paying $5 for a latte at the starbucks just past the security check?
considering the airlines are basically not letting a plane fly without almost every/every seat filled... even if you managed to get on the plane one can assume that your arrest would be happening shortly there after as the person with the real ticket for the seat showed up and wanted to know what the fuck you are doing in their seat.
on an admittedly off topic not... but related to my last point to the guy that acted all bent outta shape when I accidently sat in your seat instead of mine a row infront of you after working 20hrs the day before the flight....... HOPE YOU ENJOYED MY SEAT ALL THE WAY BACK IN YOUR FUCKING FACE THE WHOLE FLIGHT BITCH
actually I am happy to see you, however that is in fact a banana in my pocket.
You could of gotten your point across by making the generator, but not making it public. You then could of sent the password etc to the right people to take a look at it. Making it public was your demise. It's one thing to show business where their security lacks, and another to air their flaw and permit ANYONE access to it to exploit it. We live in a terrorist society now. I would arrest you too. I have no sympathy for you.
There are plenty of ways to revel this possibly gaping security hole without publishing a tool to do it. Demo it at a conference, show the media, contact the TSA, DON'T put out a tool into the wild. That was just irresponsible and naive. (and as arrestable of an offense as putting out high-quality counterfeit money producers I would guess)
People who think they know everything really piss off those of us that actually do.