They run on
Windows 98.
I'm not making this up:
KASPERSKY SECURITY ANALYST SUMMIT 2014 -- Punta Cana,
Dominican Republic -- A widely deployed carry-on baggage X-ray scanner
used in most airports could easily be manipulated by a malicious TSA
insider or an outside attacker to sneak weapons or other banned items
past airline security checkpoints.
Billy Rios, director of threat intelligence at Qualys, here today said
he and colleague Terry McCorkle purchased a secondhand Rapiscan 522 B
X-ray system via eBay and found several blatant security weaknesses that
leave the equipment vulnerable to abuse: It runs on the outdated
Windows 98 operating system, stores user credentials in plain text, and
includes a feature called Threat Image Projection used to train
screeners by injecting .bmp images of contraband, such as a gun or
knife, into a passenger carry-on in order to test the screener's
reaction during training sessions. The weak logins could allow a bad guy
to project phony images on the X-ray display.
But fear not, Citizen. The TSA is
staffed by professionals. And Government processes will ensure that the outcome is over determined:
"This reminded me a lot of voting machines. When you design these
government systems under procurement rules, you end up using old stuff.
No one is paying attention to updating it, so security is crap because
no one is analyzing it," says Bruce Schneier, CTO of Co3 Systems. "Stuff
done in secret gets really shoddy security ... We know what gives us
security is the constant interplay between the research community and
vendors."
Yeah, good luck with that here.
"These bugs are actually embarrassing. It was embarrassing to report
them to DHS -- the ability to bypass the login screen. These are really
lame bugs," Rios says.
Wonder if they're going to put him on the No-Fly list now.
2 comments:
That's a belt-fed baggage scanner. Not many pervs will be getting their kicks watching laptops, shoes, and tiny bottles of shampoo slide by.
Heh now, we JUST got upgraded to XP... :-)
Post a Comment