Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

United Airlines Stops Researcher Who Tweeted about Airplane Network Security

eff.org

Post reply on HN
Print view View original

71–80 of 128 posts

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#71

Post by appleflaxen »

droopybuns wrote: post #7
csirac2 wrote: post #2

We live in shitty knee-jerk reactionary times, but did anyone else see his tweet at the time? At best, it seemed in poor taste. At worst, the outcome seems depressingly predictable. I don't know what I'm trying to contribute here, except that whilst I have no problem with EFF working on this, their article here seems overly shrill and over-reactionary at how shrill and over-reactionary the airline was in their respon…

This person was an absolute clown. I think the infosec community needs to grow up. We all hate when legislators use the word 'cyber.' Title 18 is a mess. The new computer crime proposals are worse. Every couple of years we get the occasional story about licensing security professionals. It is because of exactly this type of clownish behavior. There are consequences for the attention seeking type of behavior. This idi…

The fact that somebody scares the uninformed public shouldn't be the determining factor for whether it's appropriate. Especially if it's true: "a hacker can bring down the plane" is an important claim to investigate. Even if you disagree with how he said it (and I certainly do), it shouldn't be forbidden just because it's sensational.

The appropriate sanction is the professional scorn that he's already beginning to receive.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#72

Post by appleflaxen »

616c wrote: post #13

So for aspiring infosec people, can someone explain how he can crack the encryption of EICAS? Different commenters on different site articles claim that the 737 never had EICAS, or maybe they mean that the Oxygen Mask On light is of course not connected to the internal avionics network. Are there people who know this stuff better and have pointers? I would love to know more.

You probably just put yourself on the no-fly list.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#73

Post by neurotech1 »

616c wrote: post #13

So for aspiring infosec people, can someone explain how he can crack the encryption of EICAS? Different commenters on different site articles claim that the 737 never had EICAS, or maybe they mean that the Oxygen Mask On light is of course not connected to the internal avionics network. Are there people who know this stuff better and have pointers? I would love to know more.

EICAS is the Airbus terminology.

The 737NG engine instrument display is somewhat similar, except non-engine warnings are on other displays. Some warnings go on the Primary Flight Display. The 737NG also has a warning panel with lightbulbs.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#74

Post by larrys »

tptacek wrote: post #51
droopybuns wrote: post #7

Earlier quoted context omitted.

This person was an absolute clown. I think the infosec community needs to grow up. We all hate when legislators use the word 'cyber.' Title 18 is a mess. The new computer crime proposals are worse. Every couple of years we get the occasional story about licensing security professionals. It is because of exactly this type of clownish behavior. There are consequences for the attention seeking type of behavior. This idi…

Every response to this I've seen from "the infosec community" (my connection to that community tends sharply towards vulnerability researchers, since that's my background) has been critical of this guy. I can't think of anyone I've seen cheerleading him. I've even seen rare glimmers of people criticizing EFF for trying to make a cause celebre of him. But you're taking things too far by casting aspersions on all of "s…

"I've even seen rare glimmers of people criticizing EFF for trying to make a cause celebre of him."

Perhaps it's entirely possible that the EFF is just like any other organization that needs to find ways to justify their existence. The same with security researchers cloaking many of the things that they do in some quest for the greater good (the "if it wasn't for us" argument).

You know locksmith tools are available for purchase over the internet. But that's not enough! We should teach lock picking in schools so that people develop new and better ways to prevent their own locks from being picked and invest in more security against people that have been trained to pick locks. Because disclosure and transparency makes everything better and nobody thinks there is any value at all in obscurity or making things a bit more difficult by not being so out in the open.

Pretending that finding some security flaw is not about capturing the flag and all about saving humanity really bothers me to no end.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#75

Post by hobs »

pyre wrote: post #66
forgottenpass wrote: post #35

Earlier quoted context omitted.

I think the infosec community needs to grow up. Vauge non-specific demands of a loose and fluid group with little to no control over it's members set the group up for inevitable failure. Without critical thought, it appears to be a reasonable request. Which is why the people who never want to listen to The Cavalry or EFF say it, and why the rest of us propagate the idea. But it's a trap.

> little to no control over it's members There is some amount of control when you are accepting and possibly celebratory in response to behaviour that should be discouraged. For example, if you never sexually harass someone yourself, but you are silent while other do so, you are ceding a control that you have over the situation. If more people that were respected in the community called out these behaviours when they…

At the same time, you can always claim that "the community isnt doing enough" because "enough" and "the community" as so ill defined that you can always castigate "the community".

It is a complete waste of time.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#76

Post by ssully »

appleflaxen wrote: post #70
csirac2 wrote: post #2

We live in shitty knee-jerk reactionary times, but did anyone else see his tweet at the time? At best, it seemed in poor taste. At worst, the outcome seems depressingly predictable. I don't know what I'm trying to contribute here, except that whilst I have no problem with EFF working on this, their article here seems overly shrill and over-reactionary at how shrill and over-reactionary the airline was in their respon…

Yes, it's a stupid tweet. But essentially saying "I could bring this plane down with my laptop hackery" is a statement about security, not about intent. The guy has bad judgment, but he's not saying anything that should trigger any action against him (they should investigate the basis for his claim, not him as an individual).

If he were to announce to the passengers on the plane, "I could bring this plane down with my laptop hackery", people would be terrified and want him off the plane. They don't give a shit about intent, they just know the guy is talking about being able to bring down the plane they are on.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#77

Post by yeukhon »

I second the motion that this is dumb. But weakness of airplane security is not unknown. Numerous presentations had been done at BlackHat and DefCon over the last few years, and people generally received good responses. But does anyone know if these presenters ever contacted the airline authority before they went on stage?

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#78

Post by rhino369 »

Confusion wrote: post #20
getsat wrote: post #16

Earlier quoted context omitted.

In that case, it was potentially VERY applicable to the other people's lives who also were on the plane in question.

People make harmless jokes that are applicable to your life at a daily basis, you're just not party to them. Thinking a joke is dangerous just because you observe it is a base rate fallacy.

People in general are very afraid of flying despite the fact it is reasonably safe. Making a joke about fucking with an airplane is in poor taste considering many people are on edge.

It'd be like making a rape joke when you pass a woman on a dark street.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#79

Post by nitrogen »

larrys wrote: post #74
tptacek wrote: post #51

Earlier quoted context omitted.

Every response to this I've seen from "the infosec community" (my connection to that community tends sharply towards vulnerability researchers, since that's my background) has been critical of this guy. I can't think of anyone I've seen cheerleading him. I've even seen rare glimmers of people criticizing EFF for trying to make a cause celebre of him. But you're taking things too far by casting aspersions on all of "s…

"I've even seen rare glimmers of people criticizing EFF for trying to make a cause celebre of him." Perhaps it's entirely possible that the EFF is just like any other organization that needs to find ways to justify their existence. The same with security researchers cloaking many of the things that they do in some quest for the greater good (the "if it wasn't for us" argument). You know locksmith tools are available…

With physical locks you are exposed to the few people that can walk up to the lock without attracting attention. With digital security, you are potentially exposed to every connected system on the planet. An invisible attacker can't pick your lock, but could hack your security system. That is why digital security is paramount.

Robots are not going door to door picking locks, but that is exactly what happens every second of every day to every system on the Internet. It only takes one, and there are lot of disenfranchised smart people around the globe.

Re: United Airlines Stops Researcher Who Tweeted about Airplane Network Security

#80

Post by liffingford »

billpollock wrote: post #69

United Airlines is THE worst. http://www.nytimes.com/2013/01/29/business/passenger-vs-airl... In my case they almost apologized for having had Federal Air Marshals detain me.

I don't get what happened. The airline put up a sign saying don't go past this curtain. You went past the curtain. You were surprised when they told you off?

The people in business class (or whatever it was in front of you) have paid more to be less crowded. Therefore the airline puts up a curtain and asks you not to cross it. That seems super reasonable to me.

You don't like the curtain and sign. A reasonable response might be to fly a different airline or pay to get in that section next time.

Deliberately ignoring the sign, going out of your way to tell them that you're going to do that, and then filming the poor guy when he stops you, that seems pretty far off into psycho land to be honest.

In fact, I'm glad that they went out of their way to protect the people in the seats in front of you from being unnecessarily bothered by people like you hiking past.

Am I missing part of the story?

Post reply on HN