Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

United Airlines Stops Researcher Who Tweeted about Airplane Network Security

eff.org

Post reply on HN
Print view View original

121–128 of 128 posts

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#121

Post by kragen »

tptacek wrote: post #59
kragen wrote: post #25

Earlier quoted context omitted.

The way we keep airplanes full of passengers from falling out of the sky is that we talk openly about the risks up front, so that the people who created those risks get fired or demoted, and their bosses (or, failing that, regulatory authorities) make sure the risks get fixed. It isn’t a smart idea to short-circuit that process; that’s how we ended up with things like the Ukrainian famine, the Great Leap Forward, Lys…

"I am on a plane messing with what I believe to be control systems" is a threatening message, even if it isn't intended to be. Moreover: every computer system in the world is vulnerable. The process of finding those flaws is disruptive. It can't be the case that knowing in the abstract about those flaws is a predicate to allowing people to disrupt systems to find specific instances of them.

You are right.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#122

Post by sneak »

grkvlt wrote: post #100
sneak wrote: post #89

Earlier quoted context omitted.

What you are describing is thoughtcrime. Criminal intent is not illegal. Only actions.

Not necessarily. Otherwise it would be impossible to prosecute someone for meticulously planning a terrorist action, who is only stopped when they are just about to purchase the materiel required to carry out the act. No action has tajen place - actual terrorism has not occurred, and there are no physical tools or similar present. But the intent (or Mens Rea, guilty mind) is there, so you can be prosecuted. And, of c…

Mens rea is a required component of many crimes, yes, however it is not sufficient alone to be criminal. Research with malicious intent is not a crime. What you describe is not criminal.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#123

Post by dragonwriter »

grkvlt wrote: post #100
sneak wrote: post #89

Earlier quoted context omitted.

What you are describing is thoughtcrime. Criminal intent is not illegal. Only actions.

Not necessarily. Otherwise it would be impossible to prosecute someone for meticulously planning a terrorist action, who is only stopped when they are just about to purchase the materiel required to carry out the act. No action has tajen place - actual terrorism has not occurred, and there are no physical tools or similar present. But the intent (or Mens Rea, guilty mind) is there, so you can be prosecuted. And, of c…

A crime requires the confluence of the required mens rea and the required actus reus; the former alone is not sufficient.

For the kind of plot you describe, prosecution would usually occur when there are multiple persons involved based on conspiracy charges, which require an overt act in furtherance of the conspiracy (which can be a fairly minor act, but it still requires an act.)

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#124

Post by grkvlt »

sneak wrote: post #122
grkvlt wrote: post #100

Earlier quoted context omitted.

Not necessarily. Otherwise it would be impossible to prosecute someone for meticulously planning a terrorist action, who is only stopped when they are just about to purchase the materiel required to carry out the act. No action has tajen place - actual terrorism has not occurred, and there are no physical tools or similar present. But the intent (or Mens Rea, guilty mind) is there, so you can be prosecuted. And, of c…

Mens rea is a required component of many crimes, yes, however it is not sufficient alone to be criminal. Research with malicious intent is not a crime. What you describe is not criminal.

And yet, people in the UK have certainly been prosecuted for looking up jihadi websites with the intent to download bomb-making instructions... Although, the actual crime may be posession of said information? It's hard to tell, particularly living in a country where 'glorifying terrorism' is now a crime - http://en.wikipedia.org/wiki/Terrorism_Act_2006 - as is 'encouraging terrorism' too.

I bet the prosecutors are kicking themselves for not thinking of that one earlier, as well - they could have simply rocked up to certain pubs in Belfast and arrested and jailed everone singing IRA songs ;)

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#125

Post by tptacek »

freehunter wrote: post #109
tptacek wrote: post #106

Earlier quoted context omitted.

How about this: don't publish a message to the world on Twitter saying that you are tinkering with what you believe to be flight control systems on an actual aircraft in transit ?

The problem is, he's done it before. And reported it to the airlines. And they've done nothing about it. I've heard him talk for years. Same thing every year. So seeing what I saw on Twitter was no surprise. He's not publishing an exploit on Twitter, he's making a joke to the followers he has that all know what he's done. He's making the joke that this year, again, the flight control systems are still vulnerable to l…

Choose your own adventure:

(a) There is no real flaw here, other than the potential for maybe sending scary messages to people's In Flight Entertainment screens, and so the disruption he's causing by suggesting that there might be a flaw has no upside.

(b) There is a real flaw here, for instance a message he can send across in-flight wireless that would deploy an oxygen mask, and his broadcast that he intended to tinker with that system is actually threatening.

Am I missing a case (c) here?

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#126

Post by ocdtrekkie »

csirac2 wrote: post #2

We live in shitty knee-jerk reactionary times, but did anyone else see his tweet at the time? At best, it seemed in poor taste. At worst, the outcome seems depressingly predictable. I don't know what I'm trying to contribute here, except that whilst I have no problem with EFF working on this, their article here seems overly shrill and over-reactionary at how shrill and over-reactionary the airline was in their respon…

I absolutely think the EFF is making poor use of their funds defending someone who was doing penetration testing on live planes with people aboard.

If the security is as bad as he claims, the risk his testing might inadvertently put people in danger could be pretty high. And he was a repeat offender, as by his own admission he'd hacked planes 15-20 times so far in a live environment. That's incredibly dangerous, and it takes an incredible amount of ego and an incredible lack of consideration to fail to realize that he could be putting people at risk himself.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#127

Post by ocdtrekkie »

appleflaxen wrote: post #70
csirac2 wrote: post #2

We live in shitty knee-jerk reactionary times, but did anyone else see his tweet at the time? At best, it seemed in poor taste. At worst, the outcome seems depressingly predictable. I don't know what I'm trying to contribute here, except that whilst I have no problem with EFF working on this, their article here seems overly shrill and over-reactionary at how shrill and over-reactionary the airline was in their respon…

Yes, it's a stupid tweet. But essentially saying "I could bring this plane down with my laptop hackery" is a statement about security, not about intent. The guy has bad judgment, but he's not saying anything that should trigger any action against him (they should investigate the basis for his claim, not him as an individual).

The issue is that he was hacking the plane. Intent is irrelevant. The reality is he could inadvertently damage an aircraft system while playing around. A responsible security researcher would not put 200 people at risk to do his testing.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#128

Post by chrismcb »

ghshephard wrote: post #113
keevie wrote: post #92

Earlier quoted context omitted.

Really? I would have no problem bringing a wrapped gift from a friend or colleague, the contents of which I do not know on a plane. And lying about packing my bags myself. In fact, I don't see why anyone would have a problem with that...it's a constant and (imo) fair assumption of mine that my friends are not trying to kill me.

As someone else has noted, the set of things that won't harm you, aren't necessarily the same set of things that you are allowed to carry on a plane (leatherman), or check (LiOn batteries). Also - while you can be trusted to make judgements about your own safety, the airlines have to make somewhat more conservative decisions about the safety of everyone else on the plane. And carrying packages for someone else is jus…

The airlines don't care if you are carrying a package for someone else. Although if a stranger asks you to carry a package, then it is suspicious. But these questions don't really do anything to reduce the attack surface.
Post reply on HN