Wednesday, July 9, 2008

Airline security: smart or not?


Bruce posts about some idiots that want to set up an Invisible Fence in a commercial airliner and give y'all a shock collar:
The bracelets remain inactive until a hijacking situation has been identified. At such time a designated crew member will activate the bracelets making them capable of delivering the punitive measure - but only to those that need to be restrained.
Bruce makes great points about qui custodiet ipsoes custodes, ending with the Question Of The Day:
I mean, what could POSSIBLY go wrong?
Well, Bruce, as a Full Service blog covering security issues, let me count the ways:
I'm just waiting for those crazy kidz at Defcon to make a homebrew airline "Shock 'o Matic" for everyone to take home on the flight from Vegas. Don't believe me? Follow the link: "Real time social networking for Ninjas". Cool time. Check out the lockpicking and hardware hacking sessions.

Let me close with a story from the Old Days of computer security - so old, it was even before my time (yes, kids, it's true!).

This man called himself Cap'n Crunch:

The reason is that he figured out that he could program the long distance telephone switches (remember, kids, these are computers) to give him free long distance calls. This was back when long distance was muy expensive.

How did he reprogram the switches? What specialized hax0R tools did he need? This:

That's right, the prize in the cereal box.

How on earth was this possible? Well, it mostly boiled down to:
  • "What if someone tries to ..."
  • "Don't worry. Nobody would ever try that."
  • "Besides, how ever would they get a whistle that plays precisly 2600 Hz/figure out the right combination of bits to beam via a laser"?
Of course, nobody who says anything like this has ever been to Defcon. Remember, kids, don't try this at home!

So Bruce, the answer to your question is "more than you can possibly imagine."

UPDATE, 7/10/2008 19:24: Looks like this is busted. Seems that someone proposed this to the TSA a while back, and the TSA said "thanks but no thanks." I still stand by the assertion that whoever proposed it had never been to Defcon.


ASM826 said...

Here the link.

Near the end of the article is this quote: Besides activation using the grid screen, the steward / stewardess will have a laser activator that can activate any bracelet as needed by simply pointing the laser at the bracelet - that laser dot only needs to be within 10 inches of the bracelet to activate it.

If you were a terrorist, getting your bracelet off would be your first step, wouldn't it? Taking that stewardess's laser activator would be step two.

Borepatch said...

You don't even need to get on the plane to have all sorts of fun. How about in the terminal? Just have someone randomly walking around shining a laser on the crowd.

If this happened in several airports over the course of, say, 2-3 days, it would have a huge impact on air ttravel. Instant terrorist headlines!