United Airlines Stops Researcher Who Tweeted about Airplane Network Security • Hacker News Board

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#111

Post by droopybuns » Mon, Apr 20, 2015, 4:13 AM UTC

freehunter wrote: post #99

tptacek wrote: post #51

Earlier quoted context omitted.

Every response to this I've seen from "the infosec community" (my connection to that community tends sharply towards vulnerability researchers, since that's my background) has been critical of this guy. I can't think of anyone I've seen cheerleading him. I've even seen rare glimmers of people criticizing EFF for trying to make a cause celebre of him. But you're taking things too far by casting aspersions on all of "s…

I've seen a lot of people cheering for him. I've seen the man in person at various cons, and I think he's brilliant. The problem is, what are we supposed to do? Responsible disclosure: companies don't give a shit and will hide it. Full disclosure: you get sued and thrown in jail. Stunt hacking disclosure: people get scared even though it's easy to do. People demand something be done about it. The person who did the d…

>>The person who did the disclosure is alternatively viewed as a hero or a villain, but the thing is people are talking about the issue.

This is what I have concerns with. It's this "ends justify the means" argument that disregards some important consequences.

There are many ways to breach these topics. You can go to the FAA. You can go to the individual companies. You can post on mailing lists. Ultimately, it may be a grind. But going the press route with inflammatory statements has consequences that exceed your own experiences with law enforcement. The legislators want to regulate infosec. It won't be pretty when they do.

We need people to understand that a successful disclosure doesn't require headlines in arstechnica. You have to be empathetic to interactions with large organizations. Flashy press may get attention to your issue, but it can also have disastrous consequences for the rest of the community. Is it worth it?

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#112

Post by snowwrestler » Mon, Apr 20, 2015, 4:20 AM UTC

grkvlt wrote: post #94

narsil wrote: post #3

The tweet in question: https://twitter.com/Sidragon1/status/588433855184375808

And the best response to the tweet is from Matt Blaze: > "I'm on an Amtrak train, which, for the record, I'm pretty sure I can't take over via the wifi." - https://twitter.com/mattblaze/status/589153697910935552

Right, because you can't do anything via Amtrak Wi-Fi. It's far too slow to be dangerous, or, indeed, useful at all.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#113

Post by ghshephard » Mon, Apr 20, 2015, 4:37 AM UTC

keevie wrote: post #92

ghshephard wrote: post #50

Earlier quoted context omitted.

It also has the peripheral advantage of ensuring that you never carry a package for someone else, and that you are leery about carrying luggage/bags packed by someone else.

Really? I would have no problem bringing a wrapped gift from a friend or colleague, the contents of which I do not know on a plane. And lying about packing my bags myself. In fact, I don't see why anyone would have a problem with that...it's a constant and (imo) fair assumption of mine that my friends are not trying to kill me.

As someone else has noted, the set of things that won't harm you, aren't necessarily the same set of things that you are allowed to carry on a plane (leatherman), or check (LiOn batteries).

Also - while you can be trusted to make judgements about your own safety, the airlines have to make somewhat more conservative decisions about the safety of everyone else on the plane.

And carrying packages for someone else is just one of likely hundreds (thousands?) of factors that they are concerned about.

This doesn't guarantee airplane safety (Nothing ever will), but it reduces the number of easy attacks one can make, such that it's becoming somewhat more difficult for a passenger to bring down the plane they are flying on now. Of course, now we have to worry about the pilots (a thankfully rather rare vector)

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#114

Post by ghshephard » Mon, Apr 20, 2015, 5:56 AM UTC

nitrogen wrote: post #104

ghshephard wrote: post #84

Earlier quoted context omitted.

Bullies proactively seek to hurt others for their own amusement. For better or worse the Secret Service (in the case of the president) and the FBI (in the case of airplane safety), are reactively responding to potential threats. So if you don't want them to react, don't threaten the president, don't make threats about messing around with aircraft EICAS systems. Remember, the FBI isn't responsible for designing safe a…

Bullies proactively seek to hurt others for their own amusement. This is definition is too narrow, in my opinion. Workplace bullying, for example, isn't just for amusement, or even to hurt others deliberately. I would define a bully as anyone or any group that uses coercion to get their way, rather than persuasion. Alternatively I would say a bully wantonly throws their weight around. As such, using the power of the…

I've looked up the definition of "bully" - and I have to admit, they all define the word in pretty much the same way you just have, which surprised me, as it wasn't my sense of the word "bully." It seems to me, though, that by that definition, any police action in which the suspect doesn't just acquiesce and come meekly along, is an example of Bullying - which really stretches my sense of the word.

It should be noted though, that in the case of the FBI seizing the equipment, it turns out to be the case that Roberts actually was guilting of making the threat/joke about messing with the airplane's EICAS system, so it's not clear to me that we can claim it was an "unproven alert."

You can always seize the equipment, perform an investigation, and then return it. But if you fail to seize the equipment, then the suspect can wipe it/destroy it if you later determine you do need to review it.

I'm guessing the FBI (any police agency), in this situation will follow the "Better safe than sorry" approach.

And, as to how you can avoid having your shit seized by the cops - most of us were taught at the age of 5 not to use the B word in an airport - just extend that logic to not making jokes about messing with the aircraft safety and you should be fine.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#115

Post by SixSigma » Mon, Apr 20, 2015, 8:40 AM UTC

patcon wrote: post #54

csirac2 wrote: post #2

We live in shitty knee-jerk reactionary times, but did anyone else see his tweet at the time? At best, it seemed in poor taste. At worst, the outcome seems depressingly predictable. I don't know what I'm trying to contribute here, except that whilst I have no problem with EFF working on this, their article here seems overly shrill and over-reactionary at how shrill and over-reactionary the airline was in their respon…

> their article here seems overly shrill and over-reactionary I totally disagree and am confused how that could be your reading

Op doesn't understand what "reactionary" means.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#116

Post by ropman76 » Mon, Apr 20, 2015, 1:03 PM UTC

tptacek wrote: post #51

droopybuns wrote: post #7

Earlier quoted context omitted.

This person was an absolute clown. I think the infosec community needs to grow up. We all hate when legislators use the word 'cyber.' Title 18 is a mess. The new computer crime proposals are worse. Every couple of years we get the occasional story about licensing security professionals. It is because of exactly this type of clownish behavior. There are consequences for the attention seeking type of behavior. This idi…

Every response to this I've seen from "the infosec community" (my connection to that community tends sharply towards vulnerability researchers, since that's my background) has been critical of this guy. I can't think of anyone I've seen cheerleading him. I've even seen rare glimmers of people criticizing EFF for trying to make a cause celebre of him. But you're taking things too far by casting aspersions on all of "s…

This is the first time I have heard about "stunt hacking" but that is a perfect descriptor for the behavior I have seen from some individuals.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#117

Post by hobarrera » Mon, Apr 20, 2015, 2:35 PM UTC

jhildings wrote: post #24

jamesbrownuhh wrote: post #10

Earlier quoted context omitted.

This isn't exactly a new phenomenon - even before 9/11, a careless joke at baggage check-in ("Did you pack your own luggage today, Sir?" - "No, my wife probably put a bomb in there.") would often result in the joke not being recognised or treated as such. Said jokester gets taken to one side, scrutinised by the boys in blue, and eventually told that they "will not be flying today, sir." In the age of Twitter, such hi…

The baggage questions is so stupid, IF you wanted to do some evil with things packed, WHY would you say something that isn't the "right" answer to them?

The question is targeting naive people, who are carrying some baggage, because a friendly guy asked them to.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#118

Post by simoncion » Mon, Apr 20, 2015, 4:50 PM UTC

ZanyProgrammer wrote: post #110

simoncion wrote: post #38

Earlier quoted context omitted.

Me? I would laugh at him. Everyday FOD [0] will do far more damage than an impact with a .22. [0] Foreign Object Damage. In this case, at-speed impacts with grit, ice, and whatever.

Way to miss the point.

One can't investigate every threat. You have to prioritize. Part of prioritizing is determining how much damage can be done with the resources available to the person.

If someone says "I'm gonna bring down the Golden Gate Bridge with this 12" stick of balsa wood." you don't give them a second thought. They may have hostile intent, but they clearly lack the understanding of how to, or the means to[0], cause harm to the bridge.

If someone says "I'm the operator of this container ship full of high explosives and I'm going to ram it into the GG Bridge and detonate the explosives.", then you investigate that, as the person very probably has both the intent and means to cause actual harm.

We -as a society- used to refuse to be terrorized. We used to laugh off incredible[1] threats as the insanity, bluster, or cathartic ranting that they clearly were. We (or maybe just our investigative and enforcement organizations) freak out much more over much smaller things these days. Our society is poorer and weaker because of this.

I hope that encouraging people to learn to put threats into perspective will help reverse this trend. Perhaps a calm, level-headed populace will calm its over-reactionary leaders, investigators, and enforcers.

[0] Or both.

[1] I mean this in the "in-credible" sense.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#119

Post by arthurcolle » Mon, Apr 20, 2015, 7:56 PM UTC

narsil wrote: post #3

The tweet in question: https://twitter.com/Sidragon1/status/588433855184375808

Can someone explain what exactly this tweet means? I managed to figure out EICAS but the whole thing I'm not getting. Thanks in advance.

Edit: https://news.ycombinator.com/item?id=9403693

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#120

Post by kragen » Mon, Apr 20, 2015, 8:26 PM UTC

ghshephard wrote: post #32

kragen wrote: post #25

Earlier quoted context omitted.

The way we keep airplanes full of passengers from falling out of the sky is that we talk openly about the risks up front, so that the people who created those risks get fired or demoted, and their bosses (or, failing that, regulatory authorities) make sure the risks get fixed. It isn’t a smart idea to short-circuit that process; that’s how we ended up with things like the Ukrainian famine, the Great Leap Forward, Lys…

What would your response be to the person who "joked" that they were pissed off with United Airlines, and would like to remind them that his house was on the approach path to SFO, and the next time United lost his luggage, he would be more than happy to repay them by taking a few potshots at their 747s with his trusty .22? Sometimes the way we keep airplanes full of passengers from falling out of the sky, is by looki…

I’d tell him that if he wants to waste law enforcement’s time, he’d need to come up with a more realistic threat, and suggest that maybe instead he ought to try going dancing, or maybe relax on the beach. Also, maybe call him up next time there’s a falling bullet injury in Hunters Point.