Security Researcher Discovers Vulnerabilities: Detained by FBI

CommanderFrank

CommanderFrank

Cat Can't Scratch It
Joined
May 9, 2000
Messages
75,399
If you happen to stumble across a vulnerability in security pertaining to anything federal, do yourself a serious favor and either don’t report it or do it anonymously to prevent being detained or possibly arrested for doing your civic duty. Chris Roberts, a security intelligence expert, found this out the hard way.

The government should be thanking its lucky stars that a benevolent force such as Chris Roberts was the one who found this exploit, rather than someone who might actually wish to do harm.
Click to expand...
 
I wonder how this will be handled, now that the new Bill regarding information sharing between private and government agencies had a provision that protects researchers from reparations on reporting vulnerabilities?

Philip
 
Not to discount his work in the field, but you sure don't go on twitter to brag / advertise airline vulnerabilities when you're traveling on the said airline.
 
Nice way to help the wrong people get their hands on it, if well-meaning efforts don't patch it then the next step is for someone to exploit it for nefarious purposes eventually.
 
MajorDomo said:
If you happen to stumble across a vulnerability in security pertaining to anything federal, do yourself a serious favor and either don’t report it or do it anonymously to prevent being detained or possibly arrested for doing your civic duty. Chris Roberts, a security intelligence expert, found this out the hard way.
Click to expand...

Is there such a thing as reporting something "anonymously" anymore with the NSA reading all communications practically as they are typed?

Tweak42 said:
Not to discount his work in the field, but you sure don't go on twitter to brag / advertise airline vulnerabilities when you're traveling on the said airline.
Click to expand...

Thing is that none of these mega-companies take computer security that seriously until someone pull their pants down and wraps them around their head.

Look at all the credit card hacks of the last 2 years. How many of the complicit victim companies came out and admitted what happened...or even the scope of the problem? None of them.
 
It is irresponsible disclosure to post a joke about what you might do on an airliner to your social media feeds. This guy is a joke of a security researcher.
 
ocellaris said:
It is irresponsible disclosure to post a joke about what you might do on an airliner to your social media feeds. This guy is a joke of a security researcher.
Click to expand...

It is irresponsible for a security researcher to draw public attention to the extent of a vulnerability via satire....that he is probably more than aware will never be fixed unless brought to very public attention. Got it.


Guess he should have followed procedure. Reported it to the airline, and then been summarily ignored until someone actually used the vulnerability maliciously.
 
Skripka said:
It is irresponsible for a security researcher to draw public attention to the extent of a vulnerability via satire....that he is probably more than aware will never be fixed unless brought to very public attention. Got it.


Guess he should have followed procedure. Reported it to the airline, and then been summarily ignored until someone actually used the vulnerability maliciously.
Click to expand...

Why assume someone at the airline would ignore it? The majority of security reports are taken seriously, the only ones we here about online are the ones that go for X months with no action. This type of thinking is like assuming a cop is going to beat your ass because you saw a video of a cop beating some asses online.
 
ocellaris said:
Why assume someone at the airline would ignore it? The majority of security reports are taken seriously, the only ones we here about online are the ones that go for X months with no action. This type of thinking is like assuming a cop is going to beat your ass because you saw a video of a cop beating some asses online.
Click to expand...

Because, historically, the only time airlines have given two shits about anything that costs them hard cash to fix is when people are killed because of it. FAA regs are written most often in blood. Because design faults in airliners are underestimated or ignored, up until planes go down because of them.


Hell, I'll wager money corp IT knew about it right now. But higher-ups said, "no that will cost money to fix".
 
Skripka said:
Because, historically, the only time airlines have given two shits about anything that costs them hard cash to fix is when people are killed because of it. FAA regs are written most often in blood. Because design faults in airliners are underestimated or ignored, up until planes go down because of them.


Hell, I'll wager money corp IT knew about it right now. But higher-ups said, "no that will cost money to fix".
Click to expand...

How many ariliners have gone down / forced emergency landings because flyers in the passenger compartment could access plane functions? Zero? Clearly they don't take things like this seriously.
 
ocellaris said:
How many ariliners have gone down / forced emergency landings because flyers in the passenger compartment could access plane functions? Zero? Clearly they don't take things like this seriously.
Click to expand...

"Yet."

The corporate and governmental attitude toward actual computer security of these vital systems is "that would cost money to fix". Look at Congress and the "debates" going on regarding "cybersecurity"....they're largely arguing over how much more power the NSA should have rather than actual security shit like this, on Congresses part that is understandable as most don't understand how to even use their own email nevermind secure their own personal websites using HTTPS (something ironically not even [H]ard|Forum has chosen to do, yes [H] is still in the dark ages like Congress).

Look at Target. Look at Niemann....Hell I'm not going to even bother listing the big ones of even 2014-2015-as the list is a ton bigger than anyone noticed:

http://www.forbes.com/sites/moneybuilder/2015/01/13/the-big-data-breaches-of-2014/

All because we in the USA use primitive credit card tech from the 60s and 70s, that any teenager can defraud these days...that no one mega-corporation has any desire to spend a small bit of money to fix. The problem is the same as airline computer security. The problems and issues are known, but it would cost money to fix. And spending money is bad for stock performance. The upside to airliners is when something goes wrong everyone knows about it and fast...unlike credit card breaches where no one admits how bad they are for months or years.
 
Ever since 9-11, making any sort of jokes about damaging an aircraft or any sort of airline safety threat has been met with little levity ... he could have presented a paper on this at one of the many security conferences (like the one he was on the way to) ... he could have lobbied Congress to get one of them to champion this ... he could have taken any number of different routes

He chose to tweet a joke about committing a criminal act on an airplane (just a short time after an airline had been deliberately crashed into a mountain) ... color me not very surprised that he ended up in trouble with the law ... he was acting like a douche, got caught, and now is whining about it trying to make it look like he was the wronged party ... it doesn't appear as if he will face any real legal consequences and airlines are within their rights to ban anyone from travel (as long as it isn't discriminatory in nature ... which this is not) ... the airlines ability to ban passengers has already been to the supreme court and decided in the airlines favor ... he is just having some sour grapes about a poor choice in judgement and humor ;)
 
kbrickley said:
Ever since 9-11, making any sort of jokes about damaging an aircraft or any sort of airline safety threat has been met with little levity ... he could have presented a paper on this at one of the many security conferences (like the one he was on the way to) ... he could have lobbied Congress to get one of them to champion this ... he could have taken any number of different routes

He chose to tweet a joke about committing a criminal act on an airplane (just a short time after an airline had been deliberately crashed into a mountain) ... color me not very surprised that he ended up in trouble with the law ... he was acting like a douche, got caught, and now is whining about it trying to make it look like he was the wronged party ... it doesn't appear as if he will face any real legal consequences and airlines are within their rights to ban anyone from travel (as long as it isn't discriminatory in nature ... which this is not) ... the airlines ability to ban passengers has already been to the supreme court and decided in the airlines favor ... he is just having some sour grapes about a poor choice in judgement and humor ;)
Click to expand...

LMAO. Lobbying Congress to do something? Are you that foolish, or are you trying to be funny? Remember what I just said about Congressional reps not knowning how to use email (McCain has said this), or the chair of the cybersecurity appropriations committee saying "I don't have a clue how this stuff works"? Or how most all of Congress doesn't use HTTP for their own official websites...or how Congress doesn't even encrypt their own official email correspondence...or encrypt their office phone lines?

I know, lobby Congress to fix computer security on airlines! F'in brilliant idea!!!!

http://www.theguardian.com/commenti...ss-cannot-be-taken-seriously-on-cybersecurity


/herp derp
 
Skripka said:
LMAO. Lobbying Congress to do something? Are you that foolish, or are you trying to be funny? Remember what I just said about Congressional reps not knowning how to use email (McCain has said this), or the chair of the cybersecurity appropriations committee saying "I don't have a clue how this stuff works"? Or how most all of Congress doesn't use HTTP for their own official websites...or how Congress doesn't even encrypt their own official email correspondence...or encrypt their office phone lines?

I know, lobby Congress to fix computer security on airlines! F'in brilliant idea!!!!

http://www.theguardian.com/commenti...ss-cannot-be-taken-seriously-on-cybersecurity


/herp derp
Click to expand...

Congress does love publicity though ... if he doesn't want to lobby Congress he could approach they FAA instead ... if the flaw is such a significant threat and he is such an expert on it why doesn't he present papers on this at the various conferences ... or better yet, propose a conference on only airline security ... don't joke about taking over a plane's computer while you are on it and then act surprised when the government and the airline are perturbed with you ... he screwed up and is now trying to make it look like he didn't ... some people clearly buy his line on this but I think the more balanced approach is to agree that all parties messed up here to a certain extent but that he kind of made his own bed here and is now refusing to lie in it ;)
 
Skripka said:
LMAO. Lobbying Congress to do something? Are you that foolish, or are you trying to be funny? Remember what I just said about Congressional reps not knowning how to use email (McCain has said this), or the chair of the cybersecurity appropriations committee saying "I don't have a clue how this stuff works"? Or how most all of Congress doesn't use HTTP for their own official websites...or how Congress doesn't even encrypt their own official email correspondence...or encrypt their office phone lines?

I know, lobby Congress to fix computer security on airlines! F'in brilliant idea!!!!

http://www.theguardian.com/commenti...ss-cannot-be-taken-seriously-on-cybersecurity


/herp derp
Click to expand...

*HTTPS, damn lack of edit.
 
kbrickley said:
Congress does love publicity though ... if he doesn't want to lobby Congress he could approach they FAA instead ... if the flaw is such a significant threat and he is such an expert on it why doesn't he present papers on this at the various conferences ... or better yet, propose a conference on only airline security ... don't joke about taking over a plane's computer while you are on it and then act surprised when the government and the airline are perturbed with you ... he screwed up and is now trying to make it look like he didn't ... some people clearly buy his line on this but I think the more balanced approach is to agree that all parties messed up here to a certain extent but that he kind of made his own bed here and is now refusing to lie in it ;)
Click to expand...

One researcher, won't get taken seriously.

That simple.

Cheaper to ignore a problem you probably know about and pretend you'll do something about it. The point of public exposure is to make sure something like this won't get ignored and gets front page treatment as an issue. How many conferences are there a year on computer security that get any popular attention? That is right. None.
 
Skripka said:
One researcher, won't get taken seriously.

That simple.

Cheaper to ignore a problem you probably know about and pretend you'll do something about it. The point of public exposure is to make sure something like this won't get ignored and gets front page treatment as an issue. How many conferences are there a year on computer security that get any popular attention? That is right. None.
Click to expand...

He is not the only researcher talking about this ... although he appears to be the only researcher using the flaw to promote his own publicity ... this flaw has been known for awhile ... the FAA has been working with the airlines and the airline manufacturers on this ... it is unclear exactly what the status is

His desire for publicity on this seems to be less about insuring the public good and more about trying to embarrass an airline that has now given him a lifetime ban ... personally United would be the last airline I would choose (I would take American, Delta, and Southwest first) but I also wouldn't publicly embarrass an airline while threatening the security of the plane and its passengers and then act surprised when the airline refuses to let me fly on them anymore
 
kbrickley said:
He is not the only researcher talking about this ... although he appears to be the only researcher using the flaw to promote his own publicity ... this flaw has been known for awhile ... the FAA has been working with the airlines and the airline manufacturers on this ... it is unclear exactly what the status is

His desire for publicity on this seems to be less about insuring the public good and more about trying to embarrass an airline that has now given him a lifetime ban ... personally United would be the last airline I would choose (I would take American, Delta, and Southwest first) but I also wouldn't publicly embarrass an airline while threatening the security of the plane and its passengers and then act surprised when the airline refuses to let me fly on them anymore
Click to expand...

How is it unclear what the status is? The flaw is is still there. It is 1030PM right now, and it is unclear if the sun is out or not...we're not sure, we may need to ask Congress, and start an inquiry there, maybe by the time humans are extinct Congress's Sunset/Sunrise Oversight Committee can return an answer as to whether or not at 1030PM CDT on 4/25/2015 the sun was in fact below the horizon.

Embarrass the dirtbags. They deserve it. They were so willfully stupid as to leave the flaw there uncorrected. I have no concern for the modesty of corrupt willful idiocy committed in the name of saving a few $$$ by a multi-billion dollar megacorporation.
 
I have no problem with independent researchers finding faults in security systems and reporting it.
I do have problem with the reporting done being publicly.

I'm sure that it was well intentioned. But it takes time to fix any security flaws. It's not like flipping a switch. In the mean while, holes in the security are now public for anyone to exploit.

He should have reported the flaw privately to the responsible authorities, not announced it to the world.
 
HFBallad said:
I have no problem with independent researchers finding faults in security systems and reporting it.
I do have problem with the reporting done being publicly.

I'm sure that it was well intentioned. But it takes time to fix any security flaws. It's not like flipping a switch. In the mean while, holes in the security are now public for anyone to exploit.

He should have reported the flaw privately to the responsible authorities, not announced it to the world.
Click to expand...

Who are the responsible authorities? Since you don't name any, I presume you can't think of anyone to call attention to this to either.

And remember that by discovering this flaw the guy probably technically violated 50 or so computer security laws intended to catch credit card thieves....and also remember that as a lone wolf researcher and not an airline employee he has no whistleblower protections whatsoever.

Whether the guy posted on Twitter about it or not, he'd probably be charged with a few dozen federal felonies and sent to jail.
 
Skripka said:
How is it unclear what the status is? The flaw is is still there. It is 1030PM right now, and it is unclear if the sun is out or not...we're not sure, we may need to ask Congress, and start an inquiry there, maybe by the time humans are extinct Congress's Sunset/Sunrise Oversight Committee can return an answer as to whether or not at 1030PM CDT on 4/25/2015 the sun was in fact below the horizon.

Embarrass the dirtbags. They deserve it. They were so willfully stupid as to leave the flaw there uncorrected. I have no concern for the modesty of corrupt willful idiocy committed in the name of saving a few $$$ by a multi-billion dollar megacorporation.
Click to expand...

Embarrass all you want, just don't complaint about the repercussions ... with the Northwest v. Ginsberg suit decided by SCOTUS the airlines are allowed to suspend any passenger's frequent flyer status without warning or reparation ... they have already had the ability to blacklist troublesome travelers for some time

So joke about deploying oxygen masks and creating a panic on the plane all you want ... just don't complain when the airline gives you a lifetime ban and suspends your frequent flyer miles ... and don't try to justify your tasteless joke as a public service :cool:

He wanted publicity and now he has it ... he shouldn't expect the airlines to roll over and congratulate him though ... if he wants to continue with this publicity hunt he can tweet about crashing the airplane every time he gets on a flight and keep the airlines on their toes ... besides, if he is that worried about this flaw he shouldn't fly commercial airlines at all ... there are lots of private airlines I am sure are much safer ;)
 
kbrickley said:
Embarrass all you want, just don't complaint about the repercussions ... with the Northwest v. Ginsberg suit decided by SCOTUS the airlines are allowed to suspend any passenger's frequent flyer status without warning or reparation ... they have already had the ability to blacklist troublesome travelers for some time

So joke about deploying oxygen masks and creating a panic on the plane all you want ... just don't complain when the airline gives you a lifetime ban and suspends your frequent flyer miles ... and don't try to justify your tasteless joke as a public service :cool:

He wanted publicity and now he has it ... he shouldn't expect the airlines to roll over and congratulate him though ... if he wants to continue with this publicity hunt he can tweet about crashing the airplane every time he gets on a flight and keep the airlines on their toes ... besides, if he is that worried about this flaw he shouldn't fly commercial airlines at all ... there are lots of private airlines I am sure are much safer ;)
Click to expand...

If he reported the flaw privately to the airline or the FAA, he'd probably be facing jail time anyway....and no one would even know about the flaws.
 
Skripka said:
If he reported the flaw privately to the airline or the FAA, he'd probably be facing jail time anyway....and no one would even know about the flaws.
Click to expand...

I would be more impressed with the immediate threat this presents if he publicly refused to fly commercial airliners and only took private jets instead ... if he is willing to save a few bucks and fly commercial he is clearly not too worried about an immediate threat in this area ... or he has a death wish, in which case he is a threat ;)
 
That plane and its electronic systems are private property. It doesn't matter one inkling who he is, what he's doing, and why he's doing it - outside of the fact that he broke into a "secure" / private electronic system without authorization and then advertised it.

I don't care if he's a security "researcher." You want to conduct pen testing? Get authorization from the proper authorities. Don't know who the proper authorities are? Figure it out. You're a security researcher and i assume intelligent enough to find out.

Otherwise - get off my plane, dummy.
 
Skripka said:
If he reported the flaw privately to the airline or the FAA, he'd probably be facing jail time anyway....and no one would even know about the flaws.
Click to expand...

You keep assuming that this guy was telling the truth about being able to hack these systems and that the systems are even hackable. It's not inconceivable that he was straight up lying to get publicity. If he actually had the capable software, don't you think the FBI would have kept him?
 
DocSavage said:
You keep assuming that this guy was telling the truth about being able to hack these systems and that the systems are even hackable. It's not inconceivable that he was straight up lying to get publicity. If he actually had the capable software, don't you think the FBI would have kept him?
Click to expand...

Given how woefully insecure all corporate systems seem these days (practically daily breaches at credit card processors, that no one seems to be talking about doing anything about)...I'm more than willing to give him the benefit of the doubt on having a working exploit. The rule of the last year seems to be: the bigger the corporation is the more their security of systems is like Swiss cheese.


Granted I haven't been keeping an ear to the ground....but you'd think if the airline and FAA figured out he was full of crap regarding having an active exploit, the FAA would be airing a news conference on CNN right now about this guy being a lying sack.
 
fairlane said:
I wonder how this will be handled, now that the new Bill regarding information sharing between private and government agencies had a provision that protects researchers from reparations on reporting vulnerabilities?

Philip
Click to expand...

Won't change a thing for this guy. The Feds aren't after him for reporting a vulnerability. they are after him because he is trying to "push" them and the airlines into fixing the vulnerability in a timeline that is 'reasonable to him". That's what his tweet is about, it's a threat, he's saying "You guys better fix this before someone screws with a plane.

But here are the problems.

1st, Roberts based is work on another guy's work where this other dude got ahold of some airline simulators and software and ran tests and decided there were vulnerabilities. The Airlines replied that the guy's simulators and software were not exact replicas of the real deal and that no vulnerability exists.

2nd Roberts and others won't actually hack a plane cause they don't like prison, but they are stuck on this crusade. At the same time they have a completely unrealistic view in what it would take and how long it would take to correct the problem even if it exists.

3rd, If the Aircraft manufacturers are trying to correct a problem, they are not going to be talking about it because that would alert others that yes, a problem really exists, and therefore the planes are vulnerable.

Oh, and we already went over this topic last week, it's old news rehashed.
 
Skripka said:
Is there such a thing as reporting something "anonymously" anymore with the NSA reading all communications practically as they are typed?



Thing is that none of these mega-companies take computer security that seriously until someone pull their pants down and wraps them around their head.

Look at all the credit card hacks of the last 2 years. How many of the complicit victim companies came out and admitted what happened...or even the scope of the problem? None of them.
Click to expand...

Oh, I bet Mr. Roberts is realizing just how serious they are taking this.
 
lcpiper said:
Oh, I bet Mr. Roberts is realizing just how serious they are taking this.
Click to expand...

Which "this"? And which "they"?

The security flaw....or the egg they splattered all over their face by leaving a security flaw open?

The airline ITS people...or the federales who have gotten $peeched into putting this guy on trial for exposing idiocy?
 
Skripka said:
Which "this"? And which "they"?

The security flaw....or the egg they splattered all over their face by leaving a security flaw open?

The airline ITS people...or the federales who have gotten $peeched into putting this guy on trial for exposing idiocy?
Click to expand...

Skripa, no one has proven a flaw exists in the first place.

If Mr. Roberts had hacked that plane he would be in Jail this moment.

The man doesn't know if the Aircraft manufacturers have taken him seriously or not. They say there is no vulnerability and Robert's can't prove it without hacking a plane and it seems he isn't ready to go that far.

So until there is proof of a vulnerability this is all just bullshit.
 
lcpiper said:
Skripa, no one has proven a flaw exists in the first place.

If Mr. Roberts had hacked that plane he would be in Jail this moment.

The man doesn't know if the Aircraft manufacturers have taken him seriously or not. They say there is no vulnerability and Robert's can't prove it without hacking a plane and it seems he isn't ready to go that far.

So until there is proof of a vulnerability this is all just bullshit.
Click to expand...

The fact that he is willing to frequently fly on the planes he suggests are so dangerous could also speak to the fact that the issue is not as risky as he would suggest ;)

I think he made a bad joke and is now using the government and airline reaction to milk every dollar of free publicity out of this that he can ... for the good of the public of course ;)
 
Back in the day (early 00's), I reported a few things to various companies (open FTP servers giving access to root drive and all subfolders, etc., nothing real hard or anything). I was met with a thank you or a threat that I accessed their system...
 
Well, there are people in this country who never lock the doors of their house and still leave their keys in the ignition of their cars. Now you can run around the country looking for unlocked doors if you want to, but if you find one I suggest you just leave a note and walk on cause if they find you inside you'll probably be meeting them from the business end of a gun.

just saying.
 
lcpiper said:
Skripa, no one has proven a flaw exists in the first place.

If Mr. Roberts had hacked that plane he would be in Jail this moment.

The man doesn't know if the Aircraft manufacturers have taken him seriously or not. They say there is no vulnerability and Robert's can't prove it without hacking a plane and it seems he isn't ready to go that far.

So until there is proof of a vulnerability this is all just bullshit.
Click to expand...

Here we go, looks like this guy needs to spend alive time or so in prison:

http://arstechnica.com/security/201...-hacking-plane-in-flight-causing-it-to-climb/
 
You must log in or register to reply here.
Back
Top