Slashdot Mirror
FBI Accuses Researcher of Hacking Plane, Seizes Equipment
chicksdaddy writes: The Feds are listening, and they really can't take a joke. That's the apparent moral of security researcher Chris Roberts' legal odyssey on Wednesday, which saw him escorted off a plane in Syracuse by two FBI agents and questioned for four hours over a humorous tweet Roberts posted about his ability to hack into the cabin control systems of the Boeing 737 he was flying. Roberts (aka @sidragon1) joked that he could "start playing with EICAS messages," a reference to the Engine Indicating and Crew Alerting System.
Roberts was traveling to Syracuse to give a presentation. He said local law enforcement and FBI agents boarded the plane on the tarmac and escorted him off. He was questioned for four hours, with officers alleging they had evidence he had tampered with in-flight systems on an earlier leg of his flight from Colorado to Chicago. Roberts said the agents questioned him about his tweet and whether he tampered with the systems on the United flight -something he denies doing. Roberts had been approached earlier by the Denver office of the FBI which warned him away from further research on airplanes. The FBI was also looking to approach airplane makers Boeing and Airbus and wanted him to rebuild a virtualized environment he built to test airplane vulnerabilities to verify what he was saying.
Roberts refused, and the FBI seized his encrypted laptop and storage devices and has yet to return them, he said. The agents said they wished to do a forensic analysis of his laptop. Roberts said he declined to provide that information and requested a warrant to search his equipment. As of Friday, Roberts said he has not received a warrant.
Roberts was traveling to Syracuse to give a presentation. He said local law enforcement and FBI agents boarded the plane on the tarmac and escorted him off. He was questioned for four hours, with officers alleging they had evidence he had tampered with in-flight systems on an earlier leg of his flight from Colorado to Chicago. Roberts said the agents questioned him about his tweet and whether he tampered with the systems on the United flight -something he denies doing. Roberts had been approached earlier by the Denver office of the FBI which warned him away from further research on airplanes. The FBI was also looking to approach airplane makers Boeing and Airbus and wanted him to rebuild a virtualized environment he built to test airplane vulnerabilities to verify what he was saying.
Roberts refused, and the FBI seized his encrypted laptop and storage devices and has yet to return them, he said. The agents said they wished to do a forensic analysis of his laptop. Roberts said he declined to provide that information and requested a warrant to search his equipment. As of Friday, Roberts said he has not received a warrant.
To anyone who has a shred of fear of flying, the game of "screwing with the pilots for laughs" is not fucking funny.
FTA, "Roberts said he had met with the Denver office of the FBI two months ago and was asked to back off from his research on avionics – a request he said he agreed to."
So he's scaring people and breaking/threatening-to-break his word, and they're being dicks to him. This may not be statutory justice, but it's poetic.
On the irrelevant issue of his research turning up vulnerabilities and the manufacturer's response being "shhhhhh, maybe no one will notice," I'd be completely on his side if he wanted to go on TV and talk about it with the world. I would contribute to his legal defense fund if he was in this for the good fight.
But if his frustration with Boeing and Airbus is going to drive him to be a fear-mongering troll, then any inconvenience caused him by the FBI seems utterly fair.
No local cover here in any of the Syracuse media. Any other time if something happens at the airport, that passes for front page news.
“Find myself on a 737/800, lets see Box-IFE-ICE-SATCOM, ? Shall we start playing with EICAS messages? “PASS OXYGEN ON” Anyone ? :)”
Looks like he threatened to turn on the Passenger Oxygen Light (as someone with the skill and tools to do it that's not an idle threat), Nothing that would cause a mass panic on a plane or anything like that. I mean you post a public comment like that I would far more surprised if the FBI didn't forcibly remove you from the plane. The article itself seems very biased as well.
Sorry, teleporters just kill you and then make a copy. A perfect, soul-less copy.
At the same time, wouldn't this be a nice opportunity to fix exploits? You have someone willing to show how terrible your security is right there..
do we call assholes "researchers"? This guy is nothing but a grandstanding asshole. You dont make comments like that and you dont do the FUD slinging that he does after getting denied.
Researchers do real work and publish their findings for peer review, not act like a street cred seeking HAx0r trolling for Lulz.
Do not look at laser with remaining good eye.
I have as much sympathy for someone who messes with the FBI as I have for someone who messes with a pack of pit bulls. Yes, the pit bulls shouldn't eat people but....
Some things need to be said...
He did *NOT* screw with the pilots. He jokes about hacking the aircraft system to his followers who are smart enough to know a joke.
If being nice means not investigating security holes, then yes, he needs to be a dick, at least in some peoples eyes. Imagine if the QA in a software company didn't dig too hard for bugs because it upset the programmers?
It's not illegal to be a dick and often quite necessary. He should not have to watch his words for fear some moron FBI agent might be reading.
If they have proof he hacked into the avionics via the inflight WiFi, the aircraft equipment companies should be in HUGE trouble.
There are two types of people in the world: Those who crave closure
“Find myself on a 737/800, lets see Box-IFE-ICE-SATCOM, ? Shall we start playing with EICAS messages? “PASS OXYGEN ON” Anyone ? :)”
His mistake is obvious. He used a smiley face instead of a winky face.
systemd is Roko's Basilisk.
Roberts has been demonstrating vulnerabilities in the avionics systems used on modern airplanes for the past five years, warning that modern planes have converged critical systems and non-critical systems such as in-flight entertainment and wi-fi in ways that create serious security and safety risks.
He isn’t alone. Ruben Santamarta a Principal Security Consultant for the firm IOActive demonstrated at the 2014 Black Hat Briefings how satellite based communications devices (SatCom) used to provide Internet access to planes in flight could be used to gain access to cockpit based avionics equipment. Brad “RenderMan” Haines has also demonstrated methods for moving from in-flight entertainment systems to critical control systems aboard planes.
If plane manufacturers are putting in-flight entertainment systems on the same network that a planes control systems are on, then Roberts are doing the public a great service by exposing this horrible security debacle.
This guy is showing ignorance of the law. He gave them a reason to believe he did something wrong, and then wants a warrant? First, the warrant will be rubberstamped based upon his comments, but second, they don't need a warrant once that is established.
They need a warrant to search the contents of the computer. They do not need a warrant to confiscate and hold the equipment while they decide what to do.
> HE claimed he was able to hack the plane. That would be a potentially very serious public safety issue. It is only right that they question him and search his equipment to see if that is true.
I hereby claim that I have hands, therefore I am able to stab someone. Should I be detained and my property seized because I am ABLE to commit a crime? 50/50 chance you have the skills and equipment to be a hooker. Therefore you should be treated as a hooker?
Maybe they should be hiring him to help consult on how to secure the systems instead of trying to intimidate him and silence the truth?
The 1970s called, they want their common sense back.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
This guy who fancies himself a "aviation hacking expert" goes around the country giving lectures on all sorts of things he sees as "risks" in all sorts of things just got himself in trouble by saying stupid things at the wrong time. It's like a security expert who gave talks about preventing Hijacking was talking about his presentation as he goes though the TSA checkpoint or with the flight attendant. Somebody took exception to the topic being discussed because of the context (he was actually ON an airplane at the time) and in the abundance of caution he was detained and questioned. I'll bet he never attempted any hacking, much less validated any of his perceived risks, most likely he made some inane statement like "I could hack into this plane and cause .... to happen" which got the attention of the flight crew who called the FBI who stops him as he gets off the plane.
But NOW this guy has a PR angle to play. And why not? Here is some self proclaimed "expert hacker" who has even been questioned by the FBI about possible hacking attempts and had his electronic devices taken in the process while he was on his way to give a talk on the very subject. Play that up, get more speaking gigs by playing up your qualifications.
This guy has nearly zero credibility with me. He's never really tested any of his theories on real equipment, doesn't work for anybody who would have access to the actual design specifications. Never worked for Boeing, Airbus or any avionics manufacturer. Has never demonstrated any successful attack and to my knowledge hasn't even attempted to hack anything. About all he has are a series of power point presentations that outline a lot of perceived risks he's come up with, but never verified, yet now he's the subject of international news? I sure hope he wasn't stupid enough to actually have tried his theories out on an actual commercial flight because the FBI is going to make an example of him if he did.
This guy's angle is all about milking the PR now. He's hit the short term jackpot and will be the featured speaker at "aviation security" conferences and I hope he makes some money. He's going to need it to pay the lawyers. However, IMHO, he's a nut job with power point skills and very little actual knowledge. He's just some lucky nut with a big mouth who fancies himself an expert on some issue that happens to be the news story of the day.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Up front, let me say this guy does have a point. Avionics systems were never designed to be secure, since the technology for unauthorized users to access them didn't exist when they were developed. If you're an Airbus designer building the A320's core messaging bus back in the late 80s, do you assume people are going to have wireless network access and phones with the power of laptops in their pockets? Of course, you do now...but not back in the 80s. And once an aircraft system gets certified, changing it is an extremely drawn out process, hence the inertia. If you want another example, look at magstripe credit cards -- another system where, when it was invented, magnetic readers/encoders were "magical devices" that only huge companies could afford, so therefore there was no encryption.
Now, that said, there are way better methods for getting the word out on stuff like this. I'm assuming he already went to the vendors on this, but if he acted anything like what he displayed here, they may have just ignored him as a crackpot. If the guy doesn't have a lot of emotional intelligence, it can significantly impact his credibility in the eyes of the "normal" population. That seems to be a problem with a lot of the security types -- they're obviously very intelligent and spend vast amounts of time digging around in the internals of the systems they're hacking. When it comes time to communicate this knowledge to others, they can do so in ways that might get them lumped into the "nerd living in Mom's basement" camp, deserved or not. Threatening to demonstrate your latest find in a live environment would certainly not be my first choice. Imagine if he had turned on the passenger oxygen warning -- air crews don't go back and check whether a warning like that is legit or not. Pilots follow checklists, and I would imagine the first thing they do is descend very quickly to a safe altitude just in case the cabin actually did depressurize!!
Syracuse is, as the crow flies, within 100 miles of the Canadian border. His equipment belongs to the US government now.