7 ms·

Security Analysis of a Full-Body Scanner

113 points by jakemask 12y ago

jakemask 12y ago
And the USENIX page: https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/mowery https://www.usenix.org/conference/usenixsecurity14/technical...
devindotcom 12y ago
They removed these machines from airports in 2013 but are still using them elsewhere - prisons, gov't offices. So while you may not be able to bomb a plane, you can still take a gun into court. Lovely!
- nardi 12y ago
  The airports I frequent (in particular San Jose International) are very much still using full-body scanners. Edit: Do you mean this particular model is no longer in use? If so, are newer models not susceptible to these attacks?
  - SomeCallMeTim 12y ago
    Backscatter x-ray technology was removed from airports. [1] All airports now use millimeter wave technology. [2] [1] https://en.wikipedia.org/wiki/Backscatter_X-ray https://en.wikipedia.org/wiki/Backscatter_X-ray [2] https://en.wikipedia.org/wiki/Millimeter_wave_scanner https://en.wikipedia.org/wiki/Millimeter_wave_scanner
    - jamoes 12y ago
      Millimeter wave scanners still subject the body to radiation, even though they don't have the work "X-Ray" in the name. Radiation damage to your body is cumulative throughout your life, so if you care about your longevity, you'd be wise to opt-out of subjecting your body to this radiation whenever possible.
      - darkmighty 12y ago
        Note that this view of "cumulative ratiation" is a myth, and a costly one. A recent note on this: http://atomicinsightscom.c.presscdn.com/wp-content/uploads/Cuttler-2014_-Leukemia-incidence-of-96000-Hiroshima-survivors_ArchToxicol.pdf http://atomicinsightscom.c.presscdn.com/wp-content/uploads/C... (there's not only a treshold, there may also be some hormesis, i.e. a slight decline in cancer rate for small doses)
        lvs 12y ago
        This one page paper with one figure and six data points from an author nobody knows in a journal nobody has heard of is right. The generally accepted models of radiation dose must be thrown out the window.
      - CamperBob2 12y ago
        Sigh. Using bullshit to argue against bullshit just leaves the whole world shittier.
      - toufka 12y ago
        Millimeter wave scanners are of an entirely different kind of 'radiation' than backscatter X-rays in the same way 'red light' is of a different kind of radiation from 'alpha particles'. Yes, technically they are are the "radiation" of an emitted particle from an interaction. But they are of significantly, quantitatively, and oncogenically different kinds of 'radiation'. Backscatter X-ray radiation is of very high intensity and almost certainly can cause damage to biological surface tissue. Millimeter wave uses non-ionizing radiation - it does not have the capability of causing what we generally refer to when we speak of biological damage by radiation. It might do something else - though this seems to be debatable, and largely hypothetical, it is simply incapable of the damage that a backscatter X-ray machine could realistically cause. Here's the letter authored by significant scientists written to the White House in regards to their thoughts on the backscatter machines [1]. [1] http://www.ucsf.edu/sites/default/files/legacy_files/concern.pdf http://www.ucsf.edu/sites/default/files/legacy_files/concern...
      - tedunangst 12y ago
  - devindotcom 12y ago
    Sorry, yes, different models with different techniques - but the result is largely the same (and I would guess the weaknesses as well).
- Calcite 12y ago
  Aren't the machines in use today using the same technology? Instead of showing the full image, they are applying pattern matching and only showing suspect regions to the operators. Supposedly to protect privacy...
  - saryant 12y ago
    Backscatter machines (the big blue boxes) were removed. Millimeter wave machines (the clear plastic cylinder) are still in place.
dangerlibrary 12y ago
From the paper: "To a degree that surprised us, our attacks benefited from testing on the device itself. Our first attempts at implementing a new attack strategy were often visible to the scanner, and reliable concealment was made possible only by iteration and refinement. [...] The effectiveness of such a strategy depends critically on the difficulty of obtaining access to the machine. In addition to the device we purchased, at least one other Secure 1000 was available for sale on eBay for months after we obtained ours. We do not know whether it sold, or to whom."
- x1798DE 12y ago
  If the attack you are worried about is terrorism (which I imagine it must be, since that's the thing these things purport to stop, I suppose), then I don't think this is a big problem. Terrorists get about as much bang for their buck whether or not they get caught, so they can presumably just try out their strategies a few times and see if they get caught.
tehwebguy 12y ago
From the FAQ: > Q. Isn’t it bad to publish details of possible attacks? > We have omitted a small number of sensitive details from our attacks in order to avoid providing recipes that would allow an attacker to reliably defeat the screening process without having access to a machine for testing.
joshfraser 12y ago
These machines are such a blatant violation of our Constitutional rights. We shouldn't be searched like this without probable cause or a search warrant. Whether they are effective or not is irrelevant.
- jodrellblank 12y ago
  We don't have a constitution. (Not everyone on the internet is American, and of those who are, none can do anything about erosion of your rights. Complain to your local political representative, who potentially can).
  - jonknee 12y ago
    To be fair this paper is about machines deployed by the TSA.
  - joshfraser 12y ago
    Sorry for the US-centric comment. All people are created equal with unalienable rights, so we shouldn't be trampling the human rights of foreigners either. It's just easier to point out the abuses when we have governing documents that explicitly say we shouldn't be doing the thing that we're doing.
    - wdewind 12y ago
      > It's just easier to point out the abuses when we have governing documents that explicitly say we shouldn't be doing the thing that we're doing. Can you explain what part of it is unconstitutional? Because while I'm totally against it, I think it is pretty much entirely constitutional because airlines are a private business that no one is being forced to go through. But I clearly don't know much about this and would welcome an education.
      - joshfraser 12y ago
        The TSA is a government agency, not a private organization. Options for flying without undergoing a grope down or subjecting oneself to the nudie photo maker are limited to those wealthy enough to fly private.
kmowery 12y ago
Hi! Lead author here. We'll be giving a talk on this work tomorrow at the USENIX Security, but I'm happy to answer any questions you have here before then.
- dangerlibrary 12y ago
  Theoretically, how many of these (or similar) techniques would work against the millimeter wave scanners currently deployed in US airports?
  - kmowery 12y ago
    We don't have one of those machines to test on, so we can't say for sure. We think it's likely that they went through the same sort of evaluation process that put the Secure 1000 into service, and that they should be publicly reviewed by independent researchers.
  - iak8god 12y ago
    Don't the millimeter wave machines perform a 360 degree scan? That would at least eliminate the really facepalm-inducing "put your gun on the side of your body" attack.
    - ben1040 12y ago
      Doesn't seem that way. The sensor revolves around the subject being scanned, but the images that have always been shown as coming from the machine are just front and back images. From L3's sales site for the ProVision MMW machine, sample images: http://storage.pardot.com/16582/23361/product_provision_L_3_composite_300dpi.jpg http://storage.pardot.com/16582/23361/product_provision_L_3_... Their "ATD" model that includes image analysis to automatically flag "anomalies" only seems to show front and back, too. http://storage.pardot.com/16582/23381/products_ait_ProVision_ATD_Mannequin_300.jpg http://storage.pardot.com/16582/23381/products_ait_ProVision... In 2012, the "TSA Out Of Our Pants" guy previously documented the "conceal a metal object on the side of your body" attack, and did so against the MMW machines with the ATD software on them: http://tsaoutofourpants.wordpress.com/2012/03/06/1b-of-nude-body-scanners-made-worthless-by-blog-how-anyone-can-get-anything-past-the-tsas-nude-body-scanners/ http://tsaoutofourpants.wordpress.com/2012/03/06/1b-of-nude-...
ck2 12y ago
As everyone knows, they aren't there for security. They are there for theater. Meanwhile the number of TSA "officers" arrested continues to grow each month http://tsascandals.wordpress.com/ http://tsascandals.wordpress.com/
- jkestner 12y ago
  I always opt out for this reason, even when I'm risking missing my plane. Paying contractors a lot of taxpayer money for a public placebo is offensive, and this makes me feel true to myself, but I wish I knew a more effective method of protesting. Currently no one really wonders about the odd out-out.

113 points by jakemask 12y ago

And the USENIX page: https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/mowery https://www.usenix.org/conference/usenixsecurity14/technical...

devindotcom 12y ago

They removed these machines from airports in 2013 but are still using them elsewhere - prisons, gov't offices. So while you may not be able to bomb a plane, you can still take a gun into court. Lovely!

nardi 12y ago
The airports I frequent (in particular San Jose International) are very much still using full-body scanners. Edit: Do you mean this particular model is no longer in use? If so, are newer models not susceptible to these attacks?
- SomeCallMeTim 12y ago
  Backscatter x-ray technology was removed from airports. [1] All airports now use millimeter wave technology. [2] [1] https://en.wikipedia.org/wiki/Backscatter_X-ray https://en.wikipedia.org/wiki/Backscatter_X-ray [2] https://en.wikipedia.org/wiki/Millimeter_wave_scanner https://en.wikipedia.org/wiki/Millimeter_wave_scanner
  - jamoes 12y ago
    Millimeter wave scanners still subject the body to radiation, even though they don't have the work "X-Ray" in the name. Radiation damage to your body is cumulative throughout your life, so if you care about your longevity, you'd be wise to opt-out of subjecting your body to this radiation whenever possible.
    - darkmighty 12y ago
      Note that this view of "cumulative ratiation" is a myth, and a costly one. A recent note on this: http://atomicinsightscom.c.presscdn.com/wp-content/uploads/Cuttler-2014_-Leukemia-incidence-of-96000-Hiroshima-survivors_ArchToxicol.pdf http://atomicinsightscom.c.presscdn.com/wp-content/uploads/C... (there's not only a treshold, there may also be some hormesis, i.e. a slight decline in cancer rate for small doses)
      - lvs 12y ago
        This one page paper with one figure and six data points from an author nobody knows in a journal nobody has heard of is right. The generally accepted models of radiation dose must be thrown out the window.
    - CamperBob2 12y ago
      Sigh. Using bullshit to argue against bullshit just leaves the whole world shittier.
    - toufka 12y ago
      Millimeter wave scanners are of an entirely different kind of 'radiation' than backscatter X-rays in the same way 'red light' is of a different kind of radiation from 'alpha particles'. Yes, technically they are are the "radiation" of an emitted particle from an interaction. But they are of significantly, quantitatively, and oncogenically different kinds of 'radiation'. Backscatter X-ray radiation is of very high intensity and almost certainly can cause damage to biological surface tissue. Millimeter wave uses non-ionizing radiation - it does not have the capability of causing what we generally refer to when we speak of biological damage by radiation. It might do something else - though this seems to be debatable, and largely hypothetical, it is simply incapable of the damage that a backscatter X-ray machine could realistically cause. Here's the letter authored by significant scientists written to the White House in regards to their thoughts on the backscatter machines [1]. [1] http://www.ucsf.edu/sites/default/files/legacy_files/concern.pdf http://www.ucsf.edu/sites/default/files/legacy_files/concern...
    - tedunangst 12y ago
- devindotcom 12y ago
  Sorry, yes, different models with different techniques - but the result is largely the same (and I would guess the weaknesses as well).
Calcite 12y ago
Aren't the machines in use today using the same technology? Instead of showing the full image, they are applying pattern matching and only showing suspect regions to the operators. Supposedly to protect privacy...
- saryant 12y ago
  Backscatter machines (the big blue boxes) were removed. Millimeter wave machines (the clear plastic cylinder) are still in place.

dangerlibrary 12y ago

From the paper: "To a degree that surprised us, our attacks benefited from testing on the device itself. Our first attempts at implementing a new attack strategy were often visible to the scanner, and reliable concealment was made possible only by iteration and refinement. [...] The effectiveness of such a strategy depends critically on the difficulty of obtaining access to the machine. In addition to the device we purchased, at least one other Secure 1000 was available for sale on eBay for months after we obtained ours. We do not know whether it sold, or to whom."

x1798DE 12y ago
If the attack you are worried about is terrorism (which I imagine it must be, since that's the thing these things purport to stop, I suppose), then I don't think this is a big problem. Terrorists get about as much bang for their buck whether or not they get caught, so they can presumably just try out their strategies a few times and see if they get caught.

tehwebguy 12y ago

From the FAQ: > Q. Isn’t it bad to publish details of possible attacks? > We have omitted a small number of sensitive details from our attacks in order to avoid providing recipes that would allow an attacker to reliably defeat the screening process without having access to a machine for testing.

joshfraser 12y ago

These machines are such a blatant violation of our Constitutional rights. We shouldn't be searched like this without probable cause or a search warrant. Whether they are effective or not is irrelevant.

jodrellblank 12y ago
We don't have a constitution. (Not everyone on the internet is American, and of those who are, none can do anything about erosion of your rights. Complain to your local political representative, who potentially can).
- jonknee 12y ago
  To be fair this paper is about machines deployed by the TSA.
- joshfraser 12y ago
  Sorry for the US-centric comment. All people are created equal with unalienable rights, so we shouldn't be trampling the human rights of foreigners either. It's just easier to point out the abuses when we have governing documents that explicitly say we shouldn't be doing the thing that we're doing.
  - wdewind 12y ago
    > It's just easier to point out the abuses when we have governing documents that explicitly say we shouldn't be doing the thing that we're doing. Can you explain what part of it is unconstitutional? Because while I'm totally against it, I think it is pretty much entirely constitutional because airlines are a private business that no one is being forced to go through. But I clearly don't know much about this and would welcome an education.
    - joshfraser 12y ago
      The TSA is a government agency, not a private organization. Options for flying without undergoing a grope down or subjecting oneself to the nudie photo maker are limited to those wealthy enough to fly private.

kmowery 12y ago

Hi! Lead author here. We'll be giving a talk on this work tomorrow at the USENIX Security, but I'm happy to answer any questions you have here before then.

dangerlibrary 12y ago
Theoretically, how many of these (or similar) techniques would work against the millimeter wave scanners currently deployed in US airports?
- kmowery 12y ago
  We don't have one of those machines to test on, so we can't say for sure. We think it's likely that they went through the same sort of evaluation process that put the Secure 1000 into service, and that they should be publicly reviewed by independent researchers.
- iak8god 12y ago
  Don't the millimeter wave machines perform a 360 degree scan? That would at least eliminate the really facepalm-inducing "put your gun on the side of your body" attack.
  - ben1040 12y ago
    Doesn't seem that way. The sensor revolves around the subject being scanned, but the images that have always been shown as coming from the machine are just front and back images. From L3's sales site for the ProVision MMW machine, sample images: http://storage.pardot.com/16582/23361/product_provision_L_3_composite_300dpi.jpg http://storage.pardot.com/16582/23361/product_provision_L_3_... Their "ATD" model that includes image analysis to automatically flag "anomalies" only seems to show front and back, too. http://storage.pardot.com/16582/23381/products_ait_ProVision_ATD_Mannequin_300.jpg http://storage.pardot.com/16582/23381/products_ait_ProVision... In 2012, the "TSA Out Of Our Pants" guy previously documented the "conceal a metal object on the side of your body" attack, and did so against the MMW machines with the ATD software on them: http://tsaoutofourpants.wordpress.com/2012/03/06/1b-of-nude-body-scanners-made-worthless-by-blog-how-anyone-can-get-anything-past-the-tsas-nude-body-scanners/ http://tsaoutofourpants.wordpress.com/2012/03/06/1b-of-nude-...

ck2 12y ago

As everyone knows, they aren't there for security. They are there for theater. Meanwhile the number of TSA "officers" arrested continues to grow each month http://tsascandals.wordpress.com/ http://tsascandals.wordpress.com/

jkestner 12y ago
I always opt out for this reason, even when I'm risking missing my plane. Paying contractors a lot of taxpayer money for a public placebo is offensive, and this makes me feel true to myself, but I wish I knew a more effective method of protesting. Currently no one really wonders about the odd out-out.