8 ms·

We live in shitty knee-jerk reactionary times, but did anyone else see his tweet at the time? At best, it seemed in poor taste. At worst, the outcome seems depr

by csirac2 11y ago

We live in shitty knee-jerk reactionary times, but did anyone else see his tweet at the time? At best, it seemed in poor taste. At worst, the outcome seems depressingly predictable. I don't know what I'm trying to contribute here, except that whilst I have no problem with EFF working on this, their article here seems overly shrill and over-reactionary at how shrill and over-reactionary the airline was in their response to what (admittedly, in hindsight) could have easily been interpreted as a threat by an over-zealous corporate drone blind to smily-face emoticons.

deleted 11y ago
[deleted]
ehmmm 11y ago
Seems to be a decent warning to security experts on how are you going to be treated in such situations, and a remainder to act accordingly.
mentat 11y ago
Don't imply you're going to harm an aircraft when you're on it. Also, airlines, don't imply you're going to allow someone to travel when you're not.
- TazeTSchnitzel 11y ago
  Yeah. Don't say: This plane has <security vulnerability> ... shall we play with it and do <bad thing>? It's just asking for trouble. On the other hand, maybe this would go down better: Oh god, this plane has <security vulnerability>. That does not make me feel safe. What if someone did <bad thing>? D:
  - DanBC 11y ago
    (Using four spaces and long lines makes those lines unreadable on mobile.) > Oh god, this plane has <security vulnerability>. That does not make me feel safe. What if someone did <bad thing>? D: No! There are plenty of examples of people who stumbled over a security vulnerability, and who responsibly, confidentially, reported those vulns to the companies, and who then faced scary legal action. I agree that the actions taken against him are far too severe; and that there should be a way for people to talk about security flaws without facing this level of harassment.
- Confusion 11y ago
  If he was going to harm the aircraft, he wouldn't have announced it in a tweet. If the FBI already had reasonable suspicion he would, they shouldn't have let him get on the plane in the first place. There is no rational reason for their action. This is simply a PR move by United and the FBI. Which leads to the same conclusion: just don't tweet things like this. Not because you're wrong, but because they are assholes.
  - DanBC 11y ago
    > If he was going to harm the aircraft, he wouldn't have announced it in a tweet. You can't know that. > If the FBI already had reasonable suspicion he would, they shouldn't have let him get on the plane in the first place. They may well have stopped him getting on the plane if he'd made similar tweets beforehand. "I'm going on a plane next month. What should I do with EICAS ;-)" would probably have had the same effect. He shouldn't have had his stuff confiscated, but he has no excuse for not knowing how "they" reacted. Their over reaction is entirely predictable, not just from theory but from their past behaviour.
  - ghshephard 11y ago
    "If he was going to harm the aircraft, he wouldn't have announced it in a tweet." Many, Many bad actors have a pretty good trail/history of signals that made it clear that they were going to do something stupid. And a lot of them are stopped because authorities stepped in when those signals were reported. Would you want to be the person who was notified that someone was communicating they were considering interfering with the proper operation of an aircraft, and ignored them, only to discovery they later on did do damage to the aircraft? I think at the very least, people responsible for flight safety can engage with those making claims they are going to endanger airplanes, and subject them to a strenuous interview to determine what their actual intent is.
    - Lorento 11y ago
      It's one thing to unobtrusively investigate a suspicious person, but actually interrupting their life just because your heuristics aren't good enough sound like a ding to free speech. If everyone joked about hacking planes, that would no longer be a risk factor.
droopybuns 11y ago
This person was an absolute clown. I think the infosec community needs to grow up. We all hate when legislators use the word 'cyber.' Title 18 is a mess. The new computer crime proposals are worse. Every couple of years we get the occasional story about licensing security professionals. It is because of exactly this type of clownish behavior. There are consequences for the attention seeking type of behavior. This idiot is catnip for government regulation. It isn't exactly his fault though. Our community has been doing this to garner press attention for the sake of the attention. He is following the pattern that has long been set. Stunt hacking scares the shit out of normal people. Eventually people will demand regulatory intervention.
- tokenizerrr 11y ago
  > Stunt hacking scares the shit out of normal people. Eventually people will demand regulatory intervention. Good. Maybe they'll actually start caring about security instead of obscurity through law.
  - Joeri 11y ago
    They don't want to be secure, they want to feel secure. That's why when somebody shows how insecure people are the common reaction is to want to punish that person. They didn't make people less secure, but they made them feel less secure.
  - droopybuns 11y ago
    This is exactly what I am trying to call attention to. I have tremendous sympathy for the sentiment you are expressing. Unfortunately, the splash damage of flasy exploitation publicity as an incentive for vulns remediation is government regulation of security professionals. The flashy stories have been happening for close to 20 years now. Are vulnerabilities becoming more rare?
- forgottenpass 11y ago
  I think the infosec community needs to grow up. Vauge non-specific demands of a loose and fluid group with little to no control over it's members set the group up for inevitable failure. Without critical thought, it appears to be a reasonable request. Which is why the people who never want to listen to The Cavalry or EFF say it, and why the rest of us propagate the idea. But it's a trap.
jamesbrownuhh 11y ago
This isn't exactly a new phenomenon - even before 9/11, a careless joke at baggage check-in ("Did you pack your own luggage today, Sir?" - "No, my wife probably put a bomb in there.") would often result in the joke not being recognised or treated as such. Said jokester gets taken to one side, scrutinised by the boys in blue, and eventually told that they "will not be flying today, sir." In the age of Twitter, such hijinks are amplified further due to their world-readable nature. The problem with innocent, uncomfortable-but-well-intentioned jokes is that you have to consider how it will play with someone whose job it is to flag up and respond to any and all threats, no matter how credible. Fundamentally it's your joke versus a member of staff who is not in a position to deviate from the procedure and brush it aside. Plus, who'd want to be the guy who gets their face on the news after an incident because they ignored a threat and thought it was a joke? They won't, and often CAN'T, take that risk - they are simply not in a position where they are allowed to do so. As you say, we live in shitty knee-jerk reactionary tines, but whatever the rights and wrongs, in this kind of situation it's prudent to moderate one's comedy appropriately.
- tomp 11y ago
  > whose job it is to flag up and respond to any and all threats, no matter how credible. That's exactly the problem, right there. Such jobs should not exist, because non-credible/joking threats are not threats, they are just jokes.
  - jamesbrownuhh 11y ago
    Absolutely, but a credible security researcher, on a plane, talking about its configuration and asking "shall we start playing with EICAS messages?" is not a joke that can be disambiguated in real time. That is achieved through men with badges, confiscation of property, the disruption of travel, and the kind of inconvenience being written about here.
- jhildings 11y ago
  The baggage questions is so stupid, IF you wanted to do some evil with things packed, WHY would you say something that isn't the "right" answer to them?
Confusion 11y ago
It seems reasonable to allow someone to joke about their own research when it becomes applicable in their real life.
- getsat 11y ago
  In that case, it was potentially VERY applicable to the other people's lives who also were on the plane in question.
  - Confusion 11y ago
    People make harmless jokes that are applicable to your life at a daily basis, you're just not party to them. Thinking a joke is dangerous just because you observe it is a base rate fallacy.
    - ghshephard 11y ago
      But, at the same time, thinking that "a joke" is safe when observed, is also not necessarily true. Good judgement needs to be taken into account. I recall having to "reapply" for my temporary job in the computing center every semester (because, of course, it was "temporary") - and one of my fellow students, after having done this for a couple years, and having a bit of ego, basically just scrawled on his application form, "Hire me again or I will murder all of you." You see, if you knew him, it was actually really, really funny. We were all a close group, and everyone on the team thought it was hilarious. The HR organization that unbeknownst to this student, screened all applications, and had no idea who he was, took a decidedly different perspective on his application. The proper response was to alert security, and thankfully his hiring managers - who then de-escalated the situation. The problem with the airline situation - their is no easy "oracle" who can confirm that this person is most decidedly not a threat.
    - rhino369 11y ago
      People in general are very afraid of flying despite the fact it is reasonably safe. Making a joke about fucking with an airplane is in poor taste considering many people are on edge. It'd be like making a rape joke when you pass a woman on a dark street.
patcon 11y ago
> their article here seems overly shrill and over-reactionary I totally disagree and am confused how that could be your reading
- SixSigma 11y ago
  Op doesn't understand what "reactionary" means.
appleflaxen 11y ago
Yes, it's a stupid tweet. But essentially saying "I could bring this plane down with my laptop hackery" is a statement about security, not about intent. The guy has bad judgment, but he's not saying anything that should trigger any action against him (they should investigate the basis for his claim, not him as an individual).
- ssully 11y ago
  If he were to announce to the passengers on the plane, "I could bring this plane down with my laptop hackery", people would be terrified and want him off the plane. They don't give a shit about intent, they just know the guy is talking about being able to bring down the plane they are on.
- ocdtrekkie 11y ago
  The issue is that he was hacking the plane. Intent is irrelevant. The reality is he could inadvertently damage an aircraft system while playing around. A responsible security researcher would not put 200 people at risk to do his testing.
pla3rhat3r 11y ago
This is the world we live in. Question, detain, and let the courts handle the interpretation of the law. Whether it's the NSA, FBI, CIA, it matters very little to them. After 9/11 we as a country wrote them a blank check. And while this guy shouldn't have taken to twitter to say planes can be hacked pretty easily, it's not shocking to see what happened after he did.
ocdtrekkie 11y ago
I absolutely think the EFF is making poor use of their funds defending someone who was doing penetration testing on live planes with people aboard. If the security is as bad as he claims, the risk his testing might inadvertently put people in danger could be pretty high. And he was a repeat offender, as by his own admission he'd hacked planes 15-20 times so far in a live environment. That's incredibly dangerous, and it takes an incredible amount of ego and an incredible lack of consideration to fail to realize that he could be putting people at risk himself.

by csirac2 11y ago

deleted 11y ago

[deleted]

ehmmm 11y ago

Seems to be a decent warning to security experts on how are you going to be treated in such situations, and a remainder to act accordingly.

mentat 11y ago

Don't imply you're going to harm an aircraft when you're on it. Also, airlines, don't imply you're going to allow someone to travel when you're not.

TazeTSchnitzel 11y ago
Yeah. Don't say: This plane has <security vulnerability> ... shall we play with it and do <bad thing>? It's just asking for trouble. On the other hand, maybe this would go down better: Oh god, this plane has <security vulnerability>. That does not make me feel safe. What if someone did <bad thing>? D:
- DanBC 11y ago
  (Using four spaces and long lines makes those lines unreadable on mobile.) > Oh god, this plane has <security vulnerability>. That does not make me feel safe. What if someone did <bad thing>? D: No! There are plenty of examples of people who stumbled over a security vulnerability, and who responsibly, confidentially, reported those vulns to the companies, and who then faced scary legal action. I agree that the actions taken against him are far too severe; and that there should be a way for people to talk about security flaws without facing this level of harassment.
Confusion 11y ago
If he was going to harm the aircraft, he wouldn't have announced it in a tweet. If the FBI already had reasonable suspicion he would, they shouldn't have let him get on the plane in the first place. There is no rational reason for their action. This is simply a PR move by United and the FBI. Which leads to the same conclusion: just don't tweet things like this. Not because you're wrong, but because they are assholes.
- DanBC 11y ago
  > If he was going to harm the aircraft, he wouldn't have announced it in a tweet. You can't know that. > If the FBI already had reasonable suspicion he would, they shouldn't have let him get on the plane in the first place. They may well have stopped him getting on the plane if he'd made similar tweets beforehand. "I'm going on a plane next month. What should I do with EICAS ;-)" would probably have had the same effect. He shouldn't have had his stuff confiscated, but he has no excuse for not knowing how "they" reacted. Their over reaction is entirely predictable, not just from theory but from their past behaviour.
- ghshephard 11y ago
  "If he was going to harm the aircraft, he wouldn't have announced it in a tweet." Many, Many bad actors have a pretty good trail/history of signals that made it clear that they were going to do something stupid. And a lot of them are stopped because authorities stepped in when those signals were reported. Would you want to be the person who was notified that someone was communicating they were considering interfering with the proper operation of an aircraft, and ignored them, only to discovery they later on did do damage to the aircraft? I think at the very least, people responsible for flight safety can engage with those making claims they are going to endanger airplanes, and subject them to a strenuous interview to determine what their actual intent is.
  - Lorento 11y ago
    It's one thing to unobtrusively investigate a suspicious person, but actually interrupting their life just because your heuristics aren't good enough sound like a ding to free speech. If everyone joked about hacking planes, that would no longer be a risk factor.

droopybuns 11y ago

This person was an absolute clown. I think the infosec community needs to grow up. We all hate when legislators use the word 'cyber.' Title 18 is a mess. The new computer crime proposals are worse. Every couple of years we get the occasional story about licensing security professionals. It is because of exactly this type of clownish behavior. There are consequences for the attention seeking type of behavior. This idiot is catnip for government regulation. It isn't exactly his fault though. Our community has been doing this to garner press attention for the sake of the attention. He is following the pattern that has long been set. Stunt hacking scares the shit out of normal people. Eventually people will demand regulatory intervention.

tokenizerrr 11y ago
> Stunt hacking scares the shit out of normal people. Eventually people will demand regulatory intervention. Good. Maybe they'll actually start caring about security instead of obscurity through law.
- Joeri 11y ago
  They don't want to be secure, they want to feel secure. That's why when somebody shows how insecure people are the common reaction is to want to punish that person. They didn't make people less secure, but they made them feel less secure.
- droopybuns 11y ago
  This is exactly what I am trying to call attention to. I have tremendous sympathy for the sentiment you are expressing. Unfortunately, the splash damage of flasy exploitation publicity as an incentive for vulns remediation is government regulation of security professionals. The flashy stories have been happening for close to 20 years now. Are vulnerabilities becoming more rare?
forgottenpass 11y ago
I think the infosec community needs to grow up. Vauge non-specific demands of a loose and fluid group with little to no control over it's members set the group up for inevitable failure. Without critical thought, it appears to be a reasonable request. Which is why the people who never want to listen to The Cavalry or EFF say it, and why the rest of us propagate the idea. But it's a trap.

jamesbrownuhh 11y ago

This isn't exactly a new phenomenon - even before 9/11, a careless joke at baggage check-in ("Did you pack your own luggage today, Sir?" - "No, my wife probably put a bomb in there.") would often result in the joke not being recognised or treated as such. Said jokester gets taken to one side, scrutinised by the boys in blue, and eventually told that they "will not be flying today, sir." In the age of Twitter, such hijinks are amplified further due to their world-readable nature. The problem with innocent, uncomfortable-but-well-intentioned jokes is that you have to consider how it will play with someone whose job it is to flag up and respond to any and all threats, no matter how credible. Fundamentally it's your joke versus a member of staff who is not in a position to deviate from the procedure and brush it aside. Plus, who'd want to be the guy who gets their face on the news after an incident because they ignored a threat and thought it was a joke? They won't, and often CAN'T, take that risk - they are simply not in a position where they are allowed to do so. As you say, we live in shitty knee-jerk reactionary tines, but whatever the rights and wrongs, in this kind of situation it's prudent to moderate one's comedy appropriately.

tomp 11y ago
> whose job it is to flag up and respond to any and all threats, no matter how credible. That's exactly the problem, right there. Such jobs should not exist, because non-credible/joking threats are not threats, they are just jokes.
- jamesbrownuhh 11y ago
  Absolutely, but a credible security researcher, on a plane, talking about its configuration and asking "shall we start playing with EICAS messages?" is not a joke that can be disambiguated in real time. That is achieved through men with badges, confiscation of property, the disruption of travel, and the kind of inconvenience being written about here.
jhildings 11y ago
The baggage questions is so stupid, IF you wanted to do some evil with things packed, WHY would you say something that isn't the "right" answer to them?

Confusion 11y ago

It seems reasonable to allow someone to joke about their own research when it becomes applicable in their real life.

getsat 11y ago
In that case, it was potentially VERY applicable to the other people's lives who also were on the plane in question.
- Confusion 11y ago
  People make harmless jokes that are applicable to your life at a daily basis, you're just not party to them. Thinking a joke is dangerous just because you observe it is a base rate fallacy.
  - ghshephard 11y ago
    But, at the same time, thinking that "a joke" is safe when observed, is also not necessarily true. Good judgement needs to be taken into account. I recall having to "reapply" for my temporary job in the computing center every semester (because, of course, it was "temporary") - and one of my fellow students, after having done this for a couple years, and having a bit of ego, basically just scrawled on his application form, "Hire me again or I will murder all of you." You see, if you knew him, it was actually really, really funny. We were all a close group, and everyone on the team thought it was hilarious. The HR organization that unbeknownst to this student, screened all applications, and had no idea who he was, took a decidedly different perspective on his application. The proper response was to alert security, and thankfully his hiring managers - who then de-escalated the situation. The problem with the airline situation - their is no easy "oracle" who can confirm that this person is most decidedly not a threat.
  - rhino369 11y ago
    People in general are very afraid of flying despite the fact it is reasonably safe. Making a joke about fucking with an airplane is in poor taste considering many people are on edge. It'd be like making a rape joke when you pass a woman on a dark street.

patcon 11y ago

> their article here seems overly shrill and over-reactionary I totally disagree and am confused how that could be your reading

SixSigma 11y ago
Op doesn't understand what "reactionary" means.

appleflaxen 11y ago

Yes, it's a stupid tweet. But essentially saying "I could bring this plane down with my laptop hackery" is a statement about security, not about intent. The guy has bad judgment, but he's not saying anything that should trigger any action against him (they should investigate the basis for his claim, not him as an individual).

ssully 11y ago
If he were to announce to the passengers on the plane, "I could bring this plane down with my laptop hackery", people would be terrified and want him off the plane. They don't give a shit about intent, they just know the guy is talking about being able to bring down the plane they are on.
ocdtrekkie 11y ago
The issue is that he was hacking the plane. Intent is irrelevant. The reality is he could inadvertently damage an aircraft system while playing around. A responsible security researcher would not put 200 people at risk to do his testing.

pla3rhat3r 11y ago

This is the world we live in. Question, detain, and let the courts handle the interpretation of the law. Whether it's the NSA, FBI, CIA, it matters very little to them. After 9/11 we as a country wrote them a blank check. And while this guy shouldn't have taken to twitter to say planes can be hacked pretty easily, it's not shocking to see what happened after he did.

ocdtrekkie 11y ago

I absolutely think the EFF is making poor use of their funds defending someone who was doing penetration testing on live planes with people aboard. If the security is as bad as he claims, the risk his testing might inadvertently put people in danger could be pretty high. And he was a repeat offender, as by his own admission he'd hacked planes 15-20 times so far in a live environment. That's incredibly dangerous, and it takes an incredible amount of ego and an incredible lack of consideration to fail to realize that he could be putting people at risk himself.