9 ms·

I wish there was a transcript to go with these slides, or some context. It looks like an amazing talk. One thing that jumped out at me right away is that the e

I wish there was a transcript to go with these slides, or some context. It looks like an amazing talk. One thing that jumped out at me right away is that the explosives sniffer is also configured to detect narcotics, amphetamine and marijuana. Is this standard procedure at American domestic airports?

potatolicious 12y ago
There's a sticker from the inside of the machine that indicates it belonged to the US prisons system at some point. Narcotics detection would seem very relevant to that application. Some of these vulnerabilities are shocking. This goes beyond carelessness and straight into incompetence.
Implicated 12y ago
They don't seem to be detecting marijuana in their currently configured state.
- rustyfe 12y ago
  This isn't correct. They are checking for THC, tetrahydrocannabinol, the active ingredient in marijuana.
  - eli 12y ago
    The "selected" column indicates "no" for drugs.
vesche 12y ago
It's from blackhat USA 2014 (Aug 6/7), when the video is uploaded it should be posted here: https://www.youtube.com/user/BlackHatOfficialYT/videos https://www.youtube.com/user/BlackHatOfficialYT/videos
- zerohm 12y ago
  +1
ubernostrum 12y ago
TSA has more than a bit of scope creep going on. In theory, all they're supposed to do is a basic administrative search to prevent weapons or explosives from being brought onto a plane. In practice, the perception in the public mind that they are a more general law-enforcement body allows them to easily perform other tasks on behalf of agencies that don't have the same general search powers. The classic example is searching for large sums of cash. Detecting large quantities of traveling cash and ensuring it's been properly declared is CBP's (Customs and Border Protection) job, not TSA's. But because TSA gets to X-ray and search every bag and body-scan every passenger, they catch that stuff, and then hold the passenger and go get CBP. The result is that the number of outside-the-mandate things that can end up happening as an "incidental" result of TSA's screening is staggering.
- tedunangst 12y ago
  Is searching for cash the classic example or a one time example involving Ron Paul's cash courier, which then led to a rule change instructing TSA to ignore cash?
  - DanBC 12y ago
    TSA claim they don't search for eg drugs; they claim to search for expsi es and incidentally find drugs. This is the classic mission creep example. There are people who hide drugs in jars of peanut butter. This shows up on TSA screens as a jar with different stuff in, which they claim to view as suspicious because it looks like explosive.
    - tedunangst 12y ago
      There seems to be some goal post creep as well. How many classic examples are there?
      - DanBC 12y ago
        Well, I do wonder if there's any benefit to the TSA for finding drugs? Perhaps I should trawl theough the reports to see if the TSA uses drug-finds as part of their results to support their work?
tptacek 12y ago
I wonder how the THC thing could possibly work. I opt out at every checkpoint, and each time, they maximize body contact and then generate an input to those machines. Wouldn't it go off for anyone who had smoked up earlier in the day, or the preceding day? It seems like they'd be spending all their time doing drug searches. (Don't get me wrong: drug searches at TSA checkpoints are extremely alarming, because TSA has been given a near all-access pass to mechanically searching people). Fun fact: if you do any welding before you get on a flight, there's a good chance you'll set those things off.
- js2 12y ago
  I most recently triggered it at SFO after wearing clothing I had gone go carting in the day before. First time for me. The enhanced screening was fun. Aside, SFO security is a contractor, not TSA.
  - leftcoaster 12y ago
    Contractor probably measured by throughput, not capture rate. Hence incentives are to push people through.
- VonGuard 12y ago
  Must not work that well. I flew alongside someone who smoked before a flight, and had the opt-out pat down... No alerts from the machine.
- eli 12y ago
  It's a confusing UI, but I'm pretty sure the "selected" column indicates that drug alerts are not configured to alert.
- bane 12y ago
  Also, if you spend lots of time outdoors around fertilizer you can set it off.
  - tagawa 12y ago
    Yes, this happened to me after a couple of hours on the golf course.

potatolicious 12y ago

There's a sticker from the inside of the machine that indicates it belonged to the US prisons system at some point. Narcotics detection would seem very relevant to that application. Some of these vulnerabilities are shocking. This goes beyond carelessness and straight into incompetence.

Implicated 12y ago

They don't seem to be detecting marijuana in their currently configured state.

rustyfe 12y ago
This isn't correct. They are checking for THC, tetrahydrocannabinol, the active ingredient in marijuana.
- eli 12y ago
  The "selected" column indicates "no" for drugs.

vesche 12y ago

It's from blackhat USA 2014 (Aug 6/7), when the video is uploaded it should be posted here: https://www.youtube.com/user/BlackHatOfficialYT/videos https://www.youtube.com/user/BlackHatOfficialYT/videos

zerohm 12y ago
+1

ubernostrum 12y ago

TSA has more than a bit of scope creep going on. In theory, all they're supposed to do is a basic administrative search to prevent weapons or explosives from being brought onto a plane. In practice, the perception in the public mind that they are a more general law-enforcement body allows them to easily perform other tasks on behalf of agencies that don't have the same general search powers. The classic example is searching for large sums of cash. Detecting large quantities of traveling cash and ensuring it's been properly declared is CBP's (Customs and Border Protection) job, not TSA's. But because TSA gets to X-ray and search every bag and body-scan every passenger, they catch that stuff, and then hold the passenger and go get CBP. The result is that the number of outside-the-mandate things that can end up happening as an "incidental" result of TSA's screening is staggering.

tedunangst 12y ago
Is searching for cash the classic example or a one time example involving Ron Paul's cash courier, which then led to a rule change instructing TSA to ignore cash?
- DanBC 12y ago
  TSA claim they don't search for eg drugs; they claim to search for expsi es and incidentally find drugs. This is the classic mission creep example. There are people who hide drugs in jars of peanut butter. This shows up on TSA screens as a jar with different stuff in, which they claim to view as suspicious because it looks like explosive.
  - tedunangst 12y ago
    There seems to be some goal post creep as well. How many classic examples are there?
    - DanBC 12y ago
      Well, I do wonder if there's any benefit to the TSA for finding drugs? Perhaps I should trawl theough the reports to see if the TSA uses drug-finds as part of their results to support their work?

tptacek 12y ago

I wonder how the THC thing could possibly work. I opt out at every checkpoint, and each time, they maximize body contact and then generate an input to those machines. Wouldn't it go off for anyone who had smoked up earlier in the day, or the preceding day? It seems like they'd be spending all their time doing drug searches. (Don't get me wrong: drug searches at TSA checkpoints are extremely alarming, because TSA has been given a near all-access pass to mechanically searching people). Fun fact: if you do any welding before you get on a flight, there's a good chance you'll set those things off.

js2 12y ago
I most recently triggered it at SFO after wearing clothing I had gone go carting in the day before. First time for me. The enhanced screening was fun. Aside, SFO security is a contractor, not TSA.
- leftcoaster 12y ago
  Contractor probably measured by throughput, not capture rate. Hence incentives are to push people through.
VonGuard 12y ago
Must not work that well. I flew alongside someone who smoked before a flight, and had the opt-out pat down... No alerts from the machine.
eli 12y ago
It's a confusing UI, but I'm pretty sure the "selected" column indicates that drug alerts are not configured to alert.
bane 12y ago
Also, if you spend lots of time outdoors around fertilizer you can set it off.
- tagawa 12y ago
  Yes, this happened to me after a couple of hours on the golf course.