Slashdot Mirror
FBI Accuses Researcher of Hacking Plane, Seizes Equipment
chicksdaddy writes: The Feds are listening, and they really can't take a joke. That's the apparent moral of security researcher Chris Roberts' legal odyssey on Wednesday, which saw him escorted off a plane in Syracuse by two FBI agents and questioned for four hours over a humorous tweet Roberts posted about his ability to hack into the cabin control systems of the Boeing 737 he was flying. Roberts (aka @sidragon1) joked that he could "start playing with EICAS messages," a reference to the Engine Indicating and Crew Alerting System.
Roberts was traveling to Syracuse to give a presentation. He said local law enforcement and FBI agents boarded the plane on the tarmac and escorted him off. He was questioned for four hours, with officers alleging they had evidence he had tampered with in-flight systems on an earlier leg of his flight from Colorado to Chicago. Roberts said the agents questioned him about his tweet and whether he tampered with the systems on the United flight -something he denies doing. Roberts had been approached earlier by the Denver office of the FBI which warned him away from further research on airplanes. The FBI was also looking to approach airplane makers Boeing and Airbus and wanted him to rebuild a virtualized environment he built to test airplane vulnerabilities to verify what he was saying.
Roberts refused, and the FBI seized his encrypted laptop and storage devices and has yet to return them, he said. The agents said they wished to do a forensic analysis of his laptop. Roberts said he declined to provide that information and requested a warrant to search his equipment. As of Friday, Roberts said he has not received a warrant.
Roberts was traveling to Syracuse to give a presentation. He said local law enforcement and FBI agents boarded the plane on the tarmac and escorted him off. He was questioned for four hours, with officers alleging they had evidence he had tampered with in-flight systems on an earlier leg of his flight from Colorado to Chicago. Roberts said the agents questioned him about his tweet and whether he tampered with the systems on the United flight -something he denies doing. Roberts had been approached earlier by the Denver office of the FBI which warned him away from further research on airplanes. The FBI was also looking to approach airplane makers Boeing and Airbus and wanted him to rebuild a virtualized environment he built to test airplane vulnerabilities to verify what he was saying.
Roberts refused, and the FBI seized his encrypted laptop and storage devices and has yet to return them, he said. The agents said they wished to do a forensic analysis of his laptop. Roberts said he declined to provide that information and requested a warrant to search his equipment. As of Friday, Roberts said he has not received a warrant.
Nope... The "king", at least on parchment, in this country is restrained from this type of behavior.
Yeah, I know, this is the real world and in fact our (United States) law enforcement (executive branch) officers (and these include the FBI) shoot unarmed people with impunity and pretty well do as they damned well please.
sigh
“Find myself on a 737/800, lets see Box-IFE-ICE-SATCOM, ? Shall we start playing with EICAS messages? “PASS OXYGEN ON” Anyone ? :)”
Looks like he threatened to turn on the Passenger Oxygen Light (as someone with the skill and tools to do it that's not an idle threat), Nothing that would cause a mass panic on a plane or anything like that. I mean you post a public comment like that I would far more surprised if the FBI didn't forcibly remove you from the plane. The article itself seems very biased as well.
Sorry, teleporters just kill you and then make a copy. A perfect, soul-less copy.
What restraint did the "king" break? They had his twitter post threatening/teasing that he might do something crappy, like drop all the oxygen masks. He was a credible threat because they knew he had the skills. They detained him. They questioned him (actual questions, nothing with a rubber hose), and they let him go.
Holding onto his laptop to see if they can get a judge to give the a warrant is standard procedure. They held onto my stolen sound system for 4 months in an evidence locker because the DA was pressing charges against the burglar and they needed the evidence. I REALLY hadn't done anything wrong, but that's how that part of the legal system works, if you don't like it, vote to change it.
So, I can't see how they are breaking the letter of the law and I don't see how they are breaking the spirit of it.
Are you choosing sides purely on an "us" vs "them" basis?
do we call assholes "researchers"? This guy is nothing but a grandstanding asshole. You dont make comments like that and you dont do the FUD slinging that he does after getting denied.
Researchers do real work and publish their findings for peer review, not act like a street cred seeking HAx0r trolling for Lulz.
Do not look at laser with remaining good eye.
He did *NOT* screw with the pilots. He jokes about hacking the aircraft system to his followers who are smart enough to know a joke.
If being nice means not investigating security holes, then yes, he needs to be a dick, at least in some peoples eyes. Imagine if the QA in a software company didn't dig too hard for bugs because it upset the programmers?
It's not illegal to be a dick and often quite necessary. He should not have to watch his words for fear some moron FBI agent might be reading.
If they have proof he hacked into the avionics via the inflight WiFi, the aircraft equipment companies should be in HUGE trouble.
There are two types of people in the world: Those who crave closure
For FIVE years he has be stating, as well as others, that there are serious issues with this. For FIVE years. F that. The jokers are the FBI. We don't care about peoples lives, we care about the perception that there is terrorism and that we are receiving the necessary funds to enrich ourselves with. It's funny! Very Funny to me. We spend great sums of money to arrest people who do our work for us, who pose no threat but we do NOT fix the threat. We do not spend any money fixing the threat.
A real terrorist would not post to twitter until after the plane was down. When are we gong to wake up? When there is another 9/11?
After they finished with him the FBI should have gone over to Boeing and Airbus and detained the executives and seized their equipment to verify if the allegations were true. If they are true then they should ground all Boeing and Airbus vulnerable airplanes.
This in not about securing America, this is about terrorizing America so more funds can be spent on protecting Americans. When a plane goes down they can say see we need more funds.
Roberts has been demonstrating vulnerabilities in the avionics systems used on modern airplanes for the past five years, warning that modern planes have converged critical systems and non-critical systems such as in-flight entertainment and wi-fi in ways that create serious security and safety risks.
He isn’t alone. Ruben Santamarta a Principal Security Consultant for the firm IOActive demonstrated at the 2014 Black Hat Briefings how satellite based communications devices (SatCom) used to provide Internet access to planes in flight could be used to gain access to cockpit based avionics equipment. Brad “RenderMan” Haines has also demonstrated methods for moving from in-flight entertainment systems to critical control systems aboard planes.
If plane manufacturers are putting in-flight entertainment systems on the same network that a planes control systems are on, then Roberts are doing the public a great service by exposing this horrible security debacle.
Roberts said he had met with the Denver office of the FBI two months ago and was asked to back off from his research on avionics â" a request he said he agreed to."
"Don't look behind the curtain" is not security, however much it gives you the warm and fuzzies.
So he's scaring people and breaking/threatening-to-break his word, and they're being dicks to him. This may not be statutory justice, but it's poetic.
Unless he "agreed" to it in the context of a consent decree, that conversation has no more legal binding than agreeing to "keep your nose clean and stay out of trouble". Sorry if that scares you, but we all have the right - and in this case, I would dare say a moral obligation, to expose security flaws in commercial air travel.
If this really bothers you, try venting your ire at Boeing, not at the messenger.
Granted, they are guilty of some of the worst fear-mongering ever...
That said: :)"
"Find myself on a 737/800, lets see Box-IFE-ICE-SATCOM, ? Shall we start playing with EICAS messages? "PASS OXYGEN ON" Anyone ?
That's really uncool. If he carried out that threat on a flight where my Mom came to visit, I would have to spend my entire Thanksgiving talking her out of an anxiety attack.
Would it still be funny if someone on the plane died of a heart attack? Screwing with people for who have a fear of flying is the same kind of fun as gently pushing crippled people at the tops of stair cases and then catching them and saying "ha ha."
This guy is showing ignorance of the law. He gave them a reason to believe he did something wrong, and then wants a warrant? First, the warrant will be rubberstamped based upon his comments, but second, they don't need a warrant once that is established.
They need a warrant to search the contents of the computer. They do not need a warrant to confiscate and hold the equipment while they decide what to do.
You really don't understand how the requirement for a warrant works, do you?
Holding onto his laptop to see if they can get a judge to give the a warrant is standard procedure.
False. The police need a warrant *before* they can seize property. Read the 4th Amendment.
They held onto my stolen sound system for 4 months in an evidence locker because the DA was pressing charges against the burglar and they needed the evidence. I REALLY hadn't done anything wrong, but that's how that part of the legal system works, if you don't like it, vote to change it.
They recovered your stolen property from the burglar, and held it as evidence. It was seized and held as evidence pursuant to a warrant issued on the *burglar*.
They would not, for example, have been able to seize *from you* the TV the burglar *didn't* steal and hold it until they got a warrant.
This guy who fancies himself a "aviation hacking expert" goes around the country giving lectures on all sorts of things he sees as "risks" in all sorts of things just got himself in trouble by saying stupid things at the wrong time. It's like a security expert who gave talks about preventing Hijacking was talking about his presentation as he goes though the TSA checkpoint or with the flight attendant. Somebody took exception to the topic being discussed because of the context (he was actually ON an airplane at the time) and in the abundance of caution he was detained and questioned. I'll bet he never attempted any hacking, much less validated any of his perceived risks, most likely he made some inane statement like "I could hack into this plane and cause .... to happen" which got the attention of the flight crew who called the FBI who stops him as he gets off the plane.
But NOW this guy has a PR angle to play. And why not? Here is some self proclaimed "expert hacker" who has even been questioned by the FBI about possible hacking attempts and had his electronic devices taken in the process while he was on his way to give a talk on the very subject. Play that up, get more speaking gigs by playing up your qualifications.
This guy has nearly zero credibility with me. He's never really tested any of his theories on real equipment, doesn't work for anybody who would have access to the actual design specifications. Never worked for Boeing, Airbus or any avionics manufacturer. Has never demonstrated any successful attack and to my knowledge hasn't even attempted to hack anything. About all he has are a series of power point presentations that outline a lot of perceived risks he's come up with, but never verified, yet now he's the subject of international news? I sure hope he wasn't stupid enough to actually have tried his theories out on an actual commercial flight because the FBI is going to make an example of him if he did.
This guy's angle is all about milking the PR now. He's hit the short term jackpot and will be the featured speaker at "aviation security" conferences and I hope he makes some money. He's going to need it to pay the lawyers. However, IMHO, he's a nut job with power point skills and very little actual knowledge. He's just some lucky nut with a big mouth who fancies himself an expert on some issue that happens to be the news story of the day.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
I don't think they need a warrant at all to seize his laptop. Warrants attest to the "reasonableness" of a search. The 4th amendment protects from "unreasonable search and seizure."
Officers can seize any evidence of a crime that is in plain sight when they are somewhere they are authorized to be.
The officers were fully within their authority to board the plane, and probably did so with the permission and appreciation of the plane's owner and the pilot. There, in plain sight, is the laptop of the person who announced to the world that he was considering tampering with the flight computers. Why would they need a warrant to seize the tool with which he said he might do so?
Replace "tweet" with "stand up and announce" and "laptop" with "metal pipe" and the story becomes "Man stands up in aircraft cabin and announces he 'could disable flight instruments' with metal pipe." Not that he necessarily was going to. Just that he could...and he's got to the tool to do so right here...kinda maybe thinking about it...
How would it be "unreasonable" to seize the man's metal pipe on the spot? No warrant required.
We don't have a state-run media we have a media-run state.
You need more than hands to stab someone. You also need a knife.
If you stood up in the aircraft cabin and announced that you had a knife and "could stab flight crew," yes, your knife would be confiscated.
Similarly, if you announce that you "could start messing with flight controls and indicators" in a cabin of an airplane, with your laptop, yes, your laptop should be confiscated.
We don't have a state-run media we have a media-run state.
Up front, let me say this guy does have a point. Avionics systems were never designed to be secure, since the technology for unauthorized users to access them didn't exist when they were developed. If you're an Airbus designer building the A320's core messaging bus back in the late 80s, do you assume people are going to have wireless network access and phones with the power of laptops in their pockets? Of course, you do now...but not back in the 80s. And once an aircraft system gets certified, changing it is an extremely drawn out process, hence the inertia. If you want another example, look at magstripe credit cards -- another system where, when it was invented, magnetic readers/encoders were "magical devices" that only huge companies could afford, so therefore there was no encryption.
Now, that said, there are way better methods for getting the word out on stuff like this. I'm assuming he already went to the vendors on this, but if he acted anything like what he displayed here, they may have just ignored him as a crackpot. If the guy doesn't have a lot of emotional intelligence, it can significantly impact his credibility in the eyes of the "normal" population. That seems to be a problem with a lot of the security types -- they're obviously very intelligent and spend vast amounts of time digging around in the internals of the systems they're hacking. When it comes time to communicate this knowledge to others, they can do so in ways that might get them lumped into the "nerd living in Mom's basement" camp, deserved or not. Threatening to demonstrate your latest find in a live environment would certainly not be my first choice. Imagine if he had turned on the passenger oxygen warning -- air crews don't go back and check whether a warning like that is legit or not. Pilots follow checklists, and I would imagine the first thing they do is descend very quickly to a safe altitude just in case the cabin actually did depressurize!!
Common sense at this level is why we need a score of 6 - Application of Common Sense. Point is spot on. When you are arrested, everything on your person, etc... is fair game. No need for a warrant to seize the laptop and such. Now, get the password is likely a court order.
In God we trust, all others require data.
The cops get a warrant and go in to Joe's house looking for evidence of drug dealing.
There is a bottle of drain cleaner under Joe's bathroom sink. Near his computers they find a digital scale, a bottle of 99% ISA alcohol, a bottle of acetone, and a few glass bowls.
The drain cleaner is for getting hair out of the shower. The ISA and acetone and the Pyrex bowls are for cleaning and refilling print cartridges.
The lot of it is put into a box and paraded into court as Joe is charged with "intent to manufacture controlled substances".
It's like how a real terrorist would not joke about a bomb at an airport. But someone who does is detained or arrested, and time is spent by TSA that could be better spent looking for real terrorists.
OK a new size TV
Warrants are soooo 20th century. We don't need those anymore, all we need to do is call you a 'terrorist' and all that goes away.
Meanwhile the home was seized under asset forfieture and the police have sold it for their share of the profits before the trial ended. Too bad, Joe. Better luck next time. Maybe you can bid on your car, since that auction is still pending.
Where's the specific articulated threat? "Should we start playing" is not a threat. Especially not in context with the tone of the rest of his tweets. Making a joke is not a threat or a crime.
The corner of a round room