Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

United Airlines Stops Researcher Who Tweeted about Airplane Network Security

eff.org

Post reply on HN
Print view View original

61–70 of 128 posts

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#61

Post by neurotech1 »

makeitsuckless wrote: post #42

I have a problem with the often used phrase "legitimate researchers", because it suggests that certain freedoms should only apply to certain people. "legitimate researcher" is not a specific job, researching is an activity any citizen can and should be free to conduct within the confines of the law, and all of that is "legitimate". The whole "legitimate researcher" creates a huge loophole through which the powers tha…

I agree with your problem with the phrase "legitimate researcher". I'm usually supportive of the EFFs position on most issues, but sending a Tweet like this guy did was pretty dumb. Even the disruption from a "overreaction" is a problem.

Also, the gateway between the aircraft safety systems and the CANBUS is one-way. The worst he could have done is shutdown the In-Flight Entertainment system, and inconvenienced a bunch of passengers.

I'm not saying that the possibility of security flaw isn't there, only that this CANBUS issue isn't it.

A legitimate researcher would arrange a ground test, or even a test flight, and not experiment on an airliner with passengers. They can do "hardware in the loop" tests on the ground, with minimal risks. The FAA are actually involved in requesting security assessments on airline systems with safety implications.

IMHO This guy come very close to crossing the line of "interfering with the safety of an airliner" when he conducted previous tests, and that is most certainly is illegal. People have gone to prison for less.

The EFF should be pushing for further evaluation of the actual issues, whatever they may be, in an appropriate manner. If Boeing/Airbus blow off the EFF, push back harder.

A well trained crew can operate a 737 quite safely using the Standby Flight Instruments for an emergency landing, even if some sort of compromise shut down the primary Flight Management System and Primary Flight Displays.

I happen to know several computer programmers/security researchers who are also test pilots. More than one called the CANBUS risks "inconvenience" and not safety of flight.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#63

Post by aw3c2 »

underwater wrote: post #46
aw3c2 wrote: post #40

Earlier quoted context omitted.

Proper archives > screenshots. https://web.archive.org/web/*/https://twitter.com/Sidragon1/... https://archive.today/ysTzt

You should always make your own copy in cases like this. Archive.org will delete everything on request. For example if you add a robots.txt file blocking them they will automatically remove the entire history for your domain

Yes but no one put yourself can trust your copy. People can reasonably trust independent third-party sites.

Archive.org will not delete anything, they do censor though. In case of court orders there should be no problem getting hidden content from them.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#64

Post by jhildings »

marbletiles wrote: post #26
jhildings wrote: post #24

Earlier quoted context omitted.

The baggage questions is so stupid, IF you wanted to do some evil with things packed, WHY would you say something that isn't the "right" answer to them?

Because you might not be aware that you're being used. I can't find the reference right now, but that question started being asked after a man put an explosive in his wife's luggage (when she was flying without him, naturally)

I see, thank you

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#65

Post by neurotech1 »

UnoriginalGuy wrote: post #57
briandear wrote: post #14

Earlier quoted context omitted.

Could someone be so kind as to translate this tweet so that those of us that aren't security experts can understand what was said? Or perhaps point me in the direction of some recommended, intro-level reading? I feel distinctly ignorant at the moment!

> Find myself on a 737/800, lets see Box-IFE-ICE-SATCOM, ? Shall we start playing with EICAS messages? "PASS OXYGEN ON" Anyone ? :) 737/800: is the type of aircraft and specific model (Boeing 737, stretched version (800)). Box-IFE-ICE-SATCOM: Is a theoretical (or actual?) exploitation path. Box: I'm assuming is in-flight WiFi IFE: Is the in-flight entertainment system ICE: Is also part of the IFE, but I'm guessing he…

I'm somewhat familiar with avionics system on a 737, and that above is a pretty accurate description. The FMS* basically forwards the messages through CANBUS for the IFE, via a gateway.

At worst this guy could send a fake message to other passengers, and maybe cause a IFE system warning in the cockpit. Oxygen Masks are controlled by a completely separate system to the IFE.

* The 737NG has various displays for warnings, but its not quite the same as the Airbus EICAS

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#66

Post by pyre »

forgottenpass wrote: post #35
droopybuns wrote: post #7

Earlier quoted context omitted.

This person was an absolute clown. I think the infosec community needs to grow up. We all hate when legislators use the word 'cyber.' Title 18 is a mess. The new computer crime proposals are worse. Every couple of years we get the occasional story about licensing security professionals. It is because of exactly this type of clownish behavior. There are consequences for the attention seeking type of behavior. This idi…

I think the infosec community needs to grow up. Vauge non-specific demands of a loose and fluid group with little to no control over it's members set the group up for inevitable failure. Without critical thought, it appears to be a reasonable request. Which is why the people who never want to listen to The Cavalry or EFF say it, and why the rest of us propagate the idea. But it's a trap.

> little to no control over it's members

There is some amount of control when you are accepting and possibly celebratory in response to behaviour that should be discouraged.

For example, if you never sexually harass someone yourself, but you are silent while other do so, you are ceding a control that you have over the situation.

If more people that were respected in the community called out these behaviours when they happen, you may see them happen less (though this isn't an absolute control, so they wouldn't go away completely).

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#67

Post by mml »

notduncansmith wrote: post #52

As someone who's flying United today, this is a bit disconcerting. Note to self: don't crack jokes.

Milos Kundera has an entire book "The Joke", about this very thing. I often think about it when contemplating saying something ill-advised.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#68

Post by pyre »

ghshephard wrote: post #49
Lorento wrote: post #39

Earlier quoted context omitted.

It's one thing to unobtrusively investigate a suspicious person, but actually interrupting their life just because your heuristics aren't good enough sound like a ding to free speech. If everyone joked about hacking planes, that would no longer be a risk factor.

I learned at the age of five or six to never make jokes about airplane safety - and that was 20 years prior to 9/11. Most adults in North America have enough common sense, particularly after 9/11, not to start mouthing off about endangering airplane security. It's like being humorous regarding the safety of the president - it's just one of those things that if you do it, you know are going to get a visit by the autho…

> I don't find it surprising whatsoever that United Airlines does not want him flying on their planes.

This is more a function of the airlines just being stupid though. There was a case where an Arabic family was taken off of an airplane because on of the teenagers asked how safe it was to sit in a seat next to the wing. The FBI cleared them, but the airline refused to allow them back on a plane.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#70

Post by appleflaxen »

csirac2 wrote: post #2

We live in shitty knee-jerk reactionary times, but did anyone else see his tweet at the time? At best, it seemed in poor taste. At worst, the outcome seems depressingly predictable. I don't know what I'm trying to contribute here, except that whilst I have no problem with EFF working on this, their article here seems overly shrill and over-reactionary at how shrill and over-reactionary the airline was in their respon…

Yes, it's a stupid tweet. But essentially saying "I could bring this plane down with my laptop hackery" is a statement about security, not about intent.

The guy has bad judgment, but he's not saying anything that should trigger any action against him (they should investigate the basis for his claim, not him as an individual).

Post reply on HN