Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

United Airlines Stops Researcher Who Tweeted about Airplane Network Security

eff.org

Post reply on HN
Print view View original

11–20 of 128 posts

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#11

Post by tomp »

jamesbrownuhh wrote: post #10
csirac2 wrote: post #2

We live in shitty knee-jerk reactionary times, but did anyone else see his tweet at the time? At best, it seemed in poor taste. At worst, the outcome seems depressingly predictable. I don't know what I'm trying to contribute here, except that whilst I have no problem with EFF working on this, their article here seems overly shrill and over-reactionary at how shrill and over-reactionary the airline was in their respon…

This isn't exactly a new phenomenon - even before 9/11, a careless joke at baggage check-in ("Did you pack your own luggage today, Sir?" - "No, my wife probably put a bomb in there.") would often result in the joke not being recognised or treated as such. Said jokester gets taken to one side, scrutinised by the boys in blue, and eventually told that they "will not be flying today, sir." In the age of Twitter, such hi…

> whose job it is to flag up and respond to any and all threats, no matter how credible.

That's exactly the problem, right there. Such jobs should not exist, because non-credible/joking threats are not threats, they are just jokes.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#12

Post by Confusion »

csirac2 wrote: post #2

We live in shitty knee-jerk reactionary times, but did anyone else see his tweet at the time? At best, it seemed in poor taste. At worst, the outcome seems depressingly predictable. I don't know what I'm trying to contribute here, except that whilst I have no problem with EFF working on this, their article here seems overly shrill and over-reactionary at how shrill and over-reactionary the airline was in their respon…

It seems reasonable to allow someone to joke about their own research when it becomes applicable in their real life.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#13

Post by 616c »

So for aspiring infosec people, can someone explain how he can crack the encryption of EICAS? Different commenters on different site articles claim that the 737 never had EICAS, or maybe they mean that the Oxygen Mask On light is of course not connected to the internal avionics network.

Are there people who know this stuff better and have pointers? I would love to know more.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#14

Post by briandear »

narsil wrote: post #3

The tweet in question: https://twitter.com/Sidragon1/status/588433855184375808

Could someone be so kind as to translate this tweet so that those of us that aren't security experts can understand what was said? Or perhaps point me in the direction of some recommended, intro-level reading? I feel distinctly ignorant at the moment!

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#15

Post by jamesbrownuhh »

tomp wrote: post #11
jamesbrownuhh wrote: post #10

Earlier quoted context omitted.

This isn't exactly a new phenomenon - even before 9/11, a careless joke at baggage check-in ("Did you pack your own luggage today, Sir?" - "No, my wife probably put a bomb in there.") would often result in the joke not being recognised or treated as such. Said jokester gets taken to one side, scrutinised by the boys in blue, and eventually told that they "will not be flying today, sir." In the age of Twitter, such hi…

> whose job it is to flag up and respond to any and all threats, no matter how credible. That's exactly the problem, right there. Such jobs should not exist, because non-credible/joking threats are not threats, they are just jokes.

Absolutely, but a credible security researcher, on a plane, talking about its configuration and asking "shall we start playing with EICAS messages?" is not a joke that can be disambiguated in real time.

That is achieved through men with badges, confiscation of property, the disruption of travel, and the kind of inconvenience being written about here.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#16

Post by getsat »

Confusion wrote: post #12
csirac2 wrote: post #2

We live in shitty knee-jerk reactionary times, but did anyone else see his tweet at the time? At best, it seemed in poor taste. At worst, the outcome seems depressingly predictable. I don't know what I'm trying to contribute here, except that whilst I have no problem with EFF working on this, their article here seems overly shrill and over-reactionary at how shrill and over-reactionary the airline was in their respon…

It seems reasonable to allow someone to joke about their own research when it becomes applicable in their real life.

In that case, it was potentially VERY applicable to the other people's lives who also were on the plane in question.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#17

Post by Confusion »

mentat wrote: post #6
csirac2 wrote: post #2

We live in shitty knee-jerk reactionary times, but did anyone else see his tweet at the time? At best, it seemed in poor taste. At worst, the outcome seems depressingly predictable. I don't know what I'm trying to contribute here, except that whilst I have no problem with EFF working on this, their article here seems overly shrill and over-reactionary at how shrill and over-reactionary the airline was in their respon…

Don't imply you're going to harm an aircraft when you're on it. Also, airlines, don't imply you're going to allow someone to travel when you're not.

If he was going to harm the aircraft, he wouldn't have announced it in a tweet. If the FBI already had reasonable suspicion he would, they shouldn't have let him get on the plane in the first place.

There is no rational reason for their action. This is simply a PR move by United and the FBI. Which leads to the same conclusion: just don't tweet things like this. Not because you're wrong, but because they are assholes.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#18

Post by ButchDriveshaft »

briandear wrote: post #14
narsil wrote: post #3

The tweet in question: https://twitter.com/Sidragon1/status/588433855184375808

Could someone be so kind as to translate this tweet so that those of us that aren't security experts can understand what was said? Or perhaps point me in the direction of some recommended, intro-level reading? I feel distinctly ignorant at the moment!

I'm relatively uninformed in this area, but I assume it was a proposal for an exploitation path. "Box-IFE-ICE-SATCOM" would most likely be a plan meaning exploiting and escalating privileges from the actual passenger's client interface or in-seat screen(box), escalating to the in flight entertainment system (IFE), to the inter-communications system (ICE), and finally to the Satellite Communications system (SATCOM). Not sure how realistic it is, because I know really nothing about info-sec with regard to aircraft, but it's no different than planning something like web app/service vulnerability -> database -> backend systems.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#19

Post by tokenizerrr »

droopybuns wrote: post #7
csirac2 wrote: post #2

We live in shitty knee-jerk reactionary times, but did anyone else see his tweet at the time? At best, it seemed in poor taste. At worst, the outcome seems depressingly predictable. I don't know what I'm trying to contribute here, except that whilst I have no problem with EFF working on this, their article here seems overly shrill and over-reactionary at how shrill and over-reactionary the airline was in their respon…

This person was an absolute clown. I think the infosec community needs to grow up. We all hate when legislators use the word 'cyber.' Title 18 is a mess. The new computer crime proposals are worse. Every couple of years we get the occasional story about licensing security professionals. It is because of exactly this type of clownish behavior. There are consequences for the attention seeking type of behavior. This idi…

> Stunt hacking scares the shit out of normal people. Eventually people will demand regulatory intervention.

Good. Maybe they'll actually start caring about security instead of obscurity through law.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#20

Post by Confusion »

getsat wrote: post #16
Confusion wrote: post #12

Earlier quoted context omitted.

It seems reasonable to allow someone to joke about their own research when it becomes applicable in their real life.

In that case, it was potentially VERY applicable to the other people's lives who also were on the plane in question.

People make harmless jokes that are applicable to your life at a daily basis, you're just not party to them. Thinking a joke is dangerous just because you observe it is a base rate fallacy.
Post reply on HN