Hacker Briefly Flies Plane Sideways After Accessing Engine Systems, FBI Says

[Silvaire]

I agree that he's getting more credibility than he should (and not just from those people who saw "The Fast and Furious 7" and believe it was based on a true story ) but that can mostly be blamed on the media.

He was however tweeting that hey, I'm here on a commercial airline flight committing a Federal crime so the FBI is probably appropriate as is confiscating his MacBook and other paraphernalia either indefinitely or permanently. He wanted attention, he got it.

 

[Rigged4Flight]

Why send out supercops for a harmless mouthy punk? Send a regular local cop to pick him up. The reaction gives him more credibility then his claims.

Because the crime he says he did falls under the auspices of those supercops. Just like if you were to make an online threat to harm the president, even if you had no intention or ability to follow through, you would get a visit from the secret service.

 

[denverpilot]

If they are competent bad guy catchers that would suggest he was successful at something

Not really. So far he's only been successful at getting the attention of investigators who have all day to figure out what to charge him with. Not a smart place to be if you plan on holding down a security job.

It means he's a professional attention seeker.

Ding ding ding.

Because the crime he says he did falls under the auspices of those supercops. Just like if you were to make an online threat to harm the president, even if you had no intention or ability to follow through, you would get a visit from the secret service.

There you go. It's their job to investigate.

Making him very uncomfortable is probably also pretty high on the priorities list, but not technically their job. A perk of their job, I guess.

Plastering his name on the news and letting his peers see unprofessional behavior will sink his career, quick. The last thing you want to do in the security biz is announce that you've found a really big security problem in the press and be flat wrong.

Try getting hired to do real security work with this story as the first page full of results in a quick Google search on your name.

Security clearance? Bye bye. You messed with an airliner.

Background check? Oh, it's THAT guy.

They find enough evidence to charge him with a Federal crime... Checkmate.

Resume, meet trash can...

He's done doing professional security work, unless he's right... and even then he's probably done anyway, other than doing self-funded research.

 

[Palmpilot]

...He's done doing professional security work, unless he's right... and even then he's probably done anyway, other than doing self-funded research.

Yeah, I think one of the news articles mentioned that investors were pulling out of the company he's involved in.

 

[denverpilot]

Yeah, I think one of the news articles mentioned that investors were pulling out of the company he's involved in.

The company was not profitable anyway, as best as I can figure. It was also not his only source of income. But he's "rumored" to have lost the other one also. ("Rumored" as in, no... I didn't talk to someone who knows who fired him, Your Honor. That's none of my business. Heh.)

A security company unable to make a profit in the target-rich environment of modern network and systems security, is quite rare.

That says something without saying anything at all.

One can make a good living just auditing other's security systems, tactics, and procedures, just about anywhere these days.

One of my favorite auditors in recent years is a guy who couldn't secure a system to save his life. But he's detail oriented, and has a great checklist...

If companies implemented half of what he checked for, they'd never have a security breach in a million years. But they'd also go broke doing it. We wrote a lot of thoughtful documentation as to why we needed variances from his evil checklist. And he got paid well, to show up every quarter and torture us sysadmins for a week.

It's free money just waiting to be taken at places that need 3rd Party security audits for [insert business reason here].

To not be able to make a profitable business out of it probably means you aren't really serious about it or have no idea how to run a business.

Starting SANS got Northcutt a nice extra house on Maui, I hear. Not bad for a business that had their students write all of their training materials.

 

[Silvaire]

...Try getting hired to do real security work with this story as the first page full of results in a quick Google search on your name...

I really don't know anything about this dude but first impressions are that he's not a person looking for "work" or a real "job"

 

[denverpilot]

I really don't know anything about this dude but first impressions are that he's not a person looking for "work" or a real "job"

Everybody has to eat.

Let's just say that maybe I know there's a local company that isn't paying for his Top Ramen anymore. And they didn't part ways amicably.

 

[Maxed-out]

The "noise" continues about the alleged 737 hack and just when I'm convinced that I've had enough of this story and Chris Roberts is nothing but an attention-seeking lunatic, I see the following story.

An unapologetic history of plane hacking: Beyond the hype and hysteria

Excerpt from story:

An FAA request to change Boeing 777 security filed on the US Federal Register website in 2013, and another one last year on Boeing's 737 line, tell us more about Boeing and the FAA's relationship with onboard network security.
According to a 2013 special conditions modification request titled Electronic System Security Protection From Unauthorized Internal Access, Boeing was worried about the IFE being connected to critical systems of the aircraft.
Boeing requested the Federal Aviation Administration for permission to add a "network extension device" to separate the various systems from each other, stating:

The existing regulations and guidance material did not anticipate this type of system architecture or electronic access to aircraft systems. Furthermore, regulations and current system safety assessment policy and techniques do not address potential security vulnerabilities, which could be caused by unauthorized access to aircraft data buses and servers.
​

In June 2014, another FAA/Boeing modifications under special conditions filing -- a request for comment on security proposals -- addressed the Boeing models of interest to Chris Roberts: The 737 line.

In the filing, Boeing proposed special conditions and a means of compliance to "ensure that the security (i.e., confidentiality, integrity, and availability) of airplane systems is not compromised by unauthorized wired or wireless electronic connections."
It specifically acknowledged that, "The architecture and network configuration may allow the exploitation of network security vulnerabilities resulting in intentional or unintentional destruction, disruption, degradation, or exploitation of data, systems, and networks critical to the safety and maintenance of the airplane."

These "special conditions and a means of compliance" were so vague that during the comments period, one anonymous security researcher expressed serious concerns about the efficacy of the proposal. The comment urged FAA and Boeing to adopt some security industry basics: Namely, independent evaluation and penetration testing. The 737 filing was subsequently withdrawn from public comment because the FAA didn't want to "delay issuance of the design approval and thus delivery of the affected aircraft."

Unfortunately, the FAA also said that dismissing the comment period was acceptable because there weren't any important comments anyway. It stated, "these special conditions has been subject to the public comment process in several prior instances with no substantive comments received."

 

[olasek]

I see the following story.

Interesting title "beyond the hype and hysteria" whereas the article itself is nothing more than "hype and hysteria".

 

[Silvaire]

The "noise" continues about the alleged 737 hack and just when I'm convinced that I've had enough of this story and Chris Roberts is nothing but an attention-seeking lunatic, I see the following story.

An unapologetic history of plane hacking: Beyond the hype and hysteria

Go beyond the article and read the actual document. Once again we are reading about proposed future systems that do not yet exist. Unless the guy has a time machine...

 

[AcroGimp]

Special Conditions exist to deal with novel design concepts that the existing regulations did not account for or cannot deal with. This is nothing new, most Type Certificate Data Sheets will have 10-20 Special Conditions, along with another dozen or so Exemptions and Optional regulation statements.

Reading the actual Special Conditions all it says is that Boeing wanted to add equipment to the system, and in so doing had to address security requirements that 'may' result from the additional equipment - nothing more. The new equipment, read that not yet installed, was considered to pose a potential security threat so as part of the proposed new equipment, Boeing suggested a new security approach that was outside the existing design.

This happens all the time with new Type Design as well as Supplemental Type Certificate programs and is evidence of Boeing doing nothing more than the right thing, not trying to cover-up some pre-existing SNAFU on security.

There is no 'there' there.

'Gimp