Slashdot Mirror
FBI Accuses Researcher of Hacking Plane, Seizes Equipment
chicksdaddy writes: The Feds are listening, and they really can't take a joke. That's the apparent moral of security researcher Chris Roberts' legal odyssey on Wednesday, which saw him escorted off a plane in Syracuse by two FBI agents and questioned for four hours over a humorous tweet Roberts posted about his ability to hack into the cabin control systems of the Boeing 737 he was flying. Roberts (aka @sidragon1) joked that he could "start playing with EICAS messages," a reference to the Engine Indicating and Crew Alerting System.
Roberts was traveling to Syracuse to give a presentation. He said local law enforcement and FBI agents boarded the plane on the tarmac and escorted him off. He was questioned for four hours, with officers alleging they had evidence he had tampered with in-flight systems on an earlier leg of his flight from Colorado to Chicago. Roberts said the agents questioned him about his tweet and whether he tampered with the systems on the United flight -something he denies doing. Roberts had been approached earlier by the Denver office of the FBI which warned him away from further research on airplanes. The FBI was also looking to approach airplane makers Boeing and Airbus and wanted him to rebuild a virtualized environment he built to test airplane vulnerabilities to verify what he was saying.
Roberts refused, and the FBI seized his encrypted laptop and storage devices and has yet to return them, he said. The agents said they wished to do a forensic analysis of his laptop. Roberts said he declined to provide that information and requested a warrant to search his equipment. As of Friday, Roberts said he has not received a warrant.
Roberts was traveling to Syracuse to give a presentation. He said local law enforcement and FBI agents boarded the plane on the tarmac and escorted him off. He was questioned for four hours, with officers alleging they had evidence he had tampered with in-flight systems on an earlier leg of his flight from Colorado to Chicago. Roberts said the agents questioned him about his tweet and whether he tampered with the systems on the United flight -something he denies doing. Roberts had been approached earlier by the Denver office of the FBI which warned him away from further research on airplanes. The FBI was also looking to approach airplane makers Boeing and Airbus and wanted him to rebuild a virtualized environment he built to test airplane vulnerabilities to verify what he was saying.
Roberts refused, and the FBI seized his encrypted laptop and storage devices and has yet to return them, he said. The agents said they wished to do a forensic analysis of his laptop. Roberts said he declined to provide that information and requested a warrant to search his equipment. As of Friday, Roberts said he has not received a warrant.
To anyone who has a shred of fear of flying, the game of "screwing with the pilots for laughs" is not fucking funny.
FTA, "Roberts said he had met with the Denver office of the FBI two months ago and was asked to back off from his research on avionics – a request he said he agreed to."
So he's scaring people and breaking/threatening-to-break his word, and they're being dicks to him. This may not be statutory justice, but it's poetic.
On the irrelevant issue of his research turning up vulnerabilities and the manufacturer's response being "shhhhhh, maybe no one will notice," I'd be completely on his side if he wanted to go on TV and talk about it with the world. I would contribute to his legal defense fund if he was in this for the good fight.
But if his frustration with Boeing and Airbus is going to drive him to be a fear-mongering troll, then any inconvenience caused him by the FBI seems utterly fair.
No local cover here in any of the Syracuse media. Any other time if something happens at the airport, that passes for front page news.
“Find myself on a 737/800, lets see Box-IFE-ICE-SATCOM, ? Shall we start playing with EICAS messages? “PASS OXYGEN ON” Anyone ? :)”
Looks like he threatened to turn on the Passenger Oxygen Light (as someone with the skill and tools to do it that's not an idle threat), Nothing that would cause a mass panic on a plane or anything like that. I mean you post a public comment like that I would far more surprised if the FBI didn't forcibly remove you from the plane. The article itself seems very biased as well.
Sorry, teleporters just kill you and then make a copy. A perfect, soul-less copy.
At the same time, wouldn't this be a nice opportunity to fix exploits? You have someone willing to show how terrible your security is right there..
do we call assholes "researchers"? This guy is nothing but a grandstanding asshole. You dont make comments like that and you dont do the FUD slinging that he does after getting denied.
Researchers do real work and publish their findings for peer review, not act like a street cred seeking HAx0r trolling for Lulz.
Do not look at laser with remaining good eye.
I have as much sympathy for someone who messes with the FBI as I have for someone who messes with a pack of pit bulls. Yes, the pit bulls shouldn't eat people but....
Some things need to be said...
This guy is showing ignorance of the law. He gave them a reason to believe he did something wrong, and then wants a warrant? First, the warrant will be rubberstamped based upon his comments, but second, they don't need a warrant once that is established.
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
He did *NOT* screw with the pilots. He jokes about hacking the aircraft system to his followers who are smart enough to know a joke.
If being nice means not investigating security holes, then yes, he needs to be a dick, at least in some peoples eyes. Imagine if the QA in a software company didn't dig too hard for bugs because it upset the programmers?
It's not illegal to be a dick and often quite necessary. He should not have to watch his words for fear some moron FBI agent might be reading.
If they have proof he hacked into the avionics via the inflight WiFi, the aircraft equipment companies should be in HUGE trouble.
There are two types of people in the world: Those who crave closure
“Find myself on a 737/800, lets see Box-IFE-ICE-SATCOM, ? Shall we start playing with EICAS messages? “PASS OXYGEN ON” Anyone ? :)”
His mistake is obvious. He used a smiley face instead of a winky face.
systemd is Roko's Basilisk.
Roberts has been demonstrating vulnerabilities in the avionics systems used on modern airplanes for the past five years, warning that modern planes have converged critical systems and non-critical systems such as in-flight entertainment and wi-fi in ways that create serious security and safety risks.
He isn’t alone. Ruben Santamarta a Principal Security Consultant for the firm IOActive demonstrated at the 2014 Black Hat Briefings how satellite based communications devices (SatCom) used to provide Internet access to planes in flight could be used to gain access to cockpit based avionics equipment. Brad “RenderMan” Haines has also demonstrated methods for moving from in-flight entertainment systems to critical control systems aboard planes.
If plane manufacturers are putting in-flight entertainment systems on the same network that a planes control systems are on, then Roberts are doing the public a great service by exposing this horrible security debacle.
Nope, it is actually quite the opposite.
Avionics weren't created with security in mind, and they don't contemplate a hostile environment to the point that they don't verify nor encrypt information that is being broadcasted. Spoofing a plane signal is *very* trivial. The technology changed very little since 1980.
> HE claimed he was able to hack the plane. That would be a potentially very serious public safety issue. It is only right that they question him and search his equipment to see if that is true.
I hereby claim that I have hands, therefore I am able to stab someone. Should I be detained and my property seized because I am ABLE to commit a crime? 50/50 chance you have the skills and equipment to be a hooker. Therefore you should be treated as a hooker?
Knowing quite a bit about crew management, if this clown would have messed with the system as he pondered he could have crashed the plane. FBI for once were right to remove this clown from the plane. I can only imagine how a overworked crew would have responded if they were alerted to Oxygen systems being enabled; Chances are they would have began to exchange messages with control to decend with the suspicious of insipid cabin decompression. Combine that with nerves getting rattled and you could easily ignite piloting errors that cascade into a disaster. A 737 and older non-fly by wire designs are not the best planes to troll the crew on it could be very costly. In any case, if he were a real researcher he would have disclosed it to the manufacturer with a SOLUTION; and then disclosed non-specifics to the AIRLINE flying community. He could have even marketed the solution to companies and enetered into entroperneurship WHILE helping us increase safety (in which he would have well deserved riches). But, in the end I guess Lulz are worth more to him. Toss him in the brig for a little while.
Maybe they should be hiring him to help consult on how to secure the systems instead of trying to intimidate him and silence the truth?
Maybe they should be hiring him to help consult on how to secure the systems instead of trying to intimidate him and silence the truth?
The 1970s called, they want their common sense back.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
of what Bruce Schneier would call "security theater".
How much closer to being in a prison do we need to be before we figure out we're in prison?
The tweet didn't suggest he was threatening to do anything. Posing a question is not the same thing as a threat. You can post a question for any number of reasons and in this case it was obvious what the reason was. He posed the question of should he do something horrifically dangerous. He never implied in the tweet he intended to do so. Anybody who understands English should realize (that isn't a prude or has some other prerogative) the guy was making a point and not making a threat. Being able to do something and actually doing it are two different things. If you can't distinguish between the two you have no business being in the law enforcement arena. He clearly was making a point that there were dangers not being addressed and that there are people capable (ie him) of doing bad stuff (not that he has suggested he would, and nothing has indicated he was psychologically unsound, so thus clearly not even a danger).
This guy who fancies himself a "aviation hacking expert" goes around the country giving lectures on all sorts of things he sees as "risks" in all sorts of things just got himself in trouble by saying stupid things at the wrong time. It's like a security expert who gave talks about preventing Hijacking was talking about his presentation as he goes though the TSA checkpoint or with the flight attendant. Somebody took exception to the topic being discussed because of the context (he was actually ON an airplane at the time) and in the abundance of caution he was detained and questioned. I'll bet he never attempted any hacking, much less validated any of his perceived risks, most likely he made some inane statement like "I could hack into this plane and cause .... to happen" which got the attention of the flight crew who called the FBI who stops him as he gets off the plane.
But NOW this guy has a PR angle to play. And why not? Here is some self proclaimed "expert hacker" who has even been questioned by the FBI about possible hacking attempts and had his electronic devices taken in the process while he was on his way to give a talk on the very subject. Play that up, get more speaking gigs by playing up your qualifications.
This guy has nearly zero credibility with me. He's never really tested any of his theories on real equipment, doesn't work for anybody who would have access to the actual design specifications. Never worked for Boeing, Airbus or any avionics manufacturer. Has never demonstrated any successful attack and to my knowledge hasn't even attempted to hack anything. About all he has are a series of power point presentations that outline a lot of perceived risks he's come up with, but never verified, yet now he's the subject of international news? I sure hope he wasn't stupid enough to actually have tried his theories out on an actual commercial flight because the FBI is going to make an example of him if he did.
This guy's angle is all about milking the PR now. He's hit the short term jackpot and will be the featured speaker at "aviation security" conferences and I hope he makes some money. He's going to need it to pay the lawyers. However, IMHO, he's a nut job with power point skills and very little actual knowledge. He's just some lucky nut with a big mouth who fancies himself an expert on some issue that happens to be the news story of the day.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
i would cheer him on.
I recently discovered that my old arcnet card has a vulnerability that allows me to hack the planet Mars. I plan on crashing it into the planet Vulcan. (Damn those pointy eared freaks).
I also plan on hacking the Atlantic Ocean and renaming it to the Great Eastern Ocean. This hack is so powerful that even paper maps will spontaneously change to reflect the update.
Up front, let me say this guy does have a point. Avionics systems were never designed to be secure, since the technology for unauthorized users to access them didn't exist when they were developed. If you're an Airbus designer building the A320's core messaging bus back in the late 80s, do you assume people are going to have wireless network access and phones with the power of laptops in their pockets? Of course, you do now...but not back in the 80s. And once an aircraft system gets certified, changing it is an extremely drawn out process, hence the inertia. If you want another example, look at magstripe credit cards -- another system where, when it was invented, magnetic readers/encoders were "magical devices" that only huge companies could afford, so therefore there was no encryption.
Now, that said, there are way better methods for getting the word out on stuff like this. I'm assuming he already went to the vendors on this, but if he acted anything like what he displayed here, they may have just ignored him as a crackpot. If the guy doesn't have a lot of emotional intelligence, it can significantly impact his credibility in the eyes of the "normal" population. That seems to be a problem with a lot of the security types -- they're obviously very intelligent and spend vast amounts of time digging around in the internals of the systems they're hacking. When it comes time to communicate this knowledge to others, they can do so in ways that might get them lumped into the "nerd living in Mom's basement" camp, deserved or not. Threatening to demonstrate your latest find in a live environment would certainly not be my first choice. Imagine if he had turned on the passenger oxygen warning -- air crews don't go back and check whether a warning like that is legit or not. Pilots follow checklists, and I would imagine the first thing they do is descend very quickly to a safe altitude just in case the cabin actually did depressurize!!
Syracuse is, as the crow flies, within 100 miles of the Canadian border. His equipment belongs to the US government now.
If they had actual evidence as they claimed, he'd be in jail right now and facing arraignment.
Dear reader: let that one sink in for a moment...
Quo usque tandem abutere, Nimbus, patientia nostra?
This is the exact equivalent of a bomb joke when on a plane. This guy is an idiot. Did he think his tweets were private?
....are "allowed" to cyberjack any Boeing (or other commercial airliner) jet!
Syracuse? What where the FBI doing in Sicily?
Disallow in flight Wi-Fi. Problem solved.
We've flown for years without it, never had an issue. Try reading or something. . . . it works. . lol
You know the companies aren't going to disclose any security vulnerabilities since it would cost them to ground the planes. Many times you'll get ignored when trying to bring an important issue to light. This is because Profit > Safety. Only when Fines / Lawsuits > Profit do recalls happen and problems get fixed.
If you can't get the owners of the Airlines to fix their problem, a better way to make it happen is to get folks with more authority involved. Hence: The FBI.
NOW, the issue will get the microscope and spotlight treatment. NOW, if a vulnerability does exist, the Airlines WILL get it fixed or their planes will get grounded for them. Maybe they'll actually start taking folks seriously from now on. . . . but I doubt it.
...is because there is a century of the best engineering behind them, with levels of failure and fault identification and mitigation that most people would find obsessive and arcane. Throw in a Swiss cheese like WiFi access and you have a serious disruption and a non-trivial influence that I for one, as an engineer designing aircraft safety systems, do not particularly want to see, It's nice that I can read my Kindle during take-off. That's enough.
"Our opponent is an alien starship packed with atomic bombs," I said. "we have a protractor"
"officers alleging they had evidence he had tampered with in-flight systems on an earlier leg of his flight from Colorado to Chicago"
This I think is much more interesting than the tweet. (And not just because practically everything is more interesting than a tweet (including literal tweets from birds).)
Joking about tampering with an aircraft should not be taken lightly, though I'm leaning a bit to calling the FBI's response an over-reaction.
But *evidence* of an earlier crime is something else.
Unless the FBI just made that part up....
This guy is most likely a fraud. Why else would he refuse the opportunity to work with Boeing to fix a problem that he claims to be able to exploit but has never actually been done before.
Looking at his twitter profile and his "resume" on the company website... He has never done an-y-thing but gather credentials and bitch. There is nothing the least bit interesting that he has actually done. Certainly nothing to warrant all the attention he gets himself. Just a loudmouth with no skillz.
My career has landed me in the security industry for the last 5 years and I've noticed it is chock full of gas bags like this dude. They grab some encryption packages that someone else wrote, get some certifications, and sudfdenly they are an expert. And they get paid very well to bullshit their way around the country. Meanwhile the real experts keept heir mouths shut, find problems, and hopefully help fix them.
Not quite the same. He tweeted in a language completely unintelligible to regular twitter followers, understandable only to friends that already knew him and his gripes about certain alleged vulnerabilities. To make it comparable, he would have to announce it to his fellow passengers and to the crew, in a language that they would understand.
But he was mistaken because there were followers that were not his intended audience, and who knew just enough of the lingo to go an ask him questions.
There is no substitute for common sense. Especially, no body of rules will do.
It's pretty damn funny running through an airport terminal yelling "bomb" too. Maybe he should try that next time... for science.
Roberts breached the 'Yelling "Fire!" in a crowded theatre test'. Only in his case it was a plane instead of a theatre
Donte Alistair Anderson Roberts - hi son!
Karma: Chameleon