TSA Baggage Scanners Hackable
Researchers reveal weak security that could allow malicious insiders or attackers to spoof the contents of carry-on baggage.
KASPERSKY SECURITY ANALYST SUMMIT 2014 -- Punta Cana, Dominican Republic -- A widely deployed carry-on baggage X-ray scanner used in most airports could easily be manipulated by a malicious TSA insider or an outside attacker to sneak weapons or other banned items past airline security checkpoints.
Billy Rios, director of threat intelligence at Qualys, said Tuesday that said he and colleague Terry McCorkle purchased a secondhand Rapiscan 522 B X-ray system via eBay and found several blatant security weaknesses that leave the equipment vulnerable to abuse: It runs on the outdated Windows 98 operating system, stores user credentials in plain text, and includes a feature called Threat Image Projection used to train screeners by injecting .bmp images of contraband, such as a gun or knife, into a passenger carry-on in order to test the screener's reaction during training sessions. The weak logins could allow a bad guy to project phony images on the X-ray display.
"The worst-case scenario is someone manipulates this in a way that the operator doesn't know a threat is in the bag ... by design, the software allows you to manipulate the image for training [purposes]," he said.
"The TSA requires this super-dangerous feature on all of these baggage scanners," Rios said.
Read the rest of this story on Dark Reading.
About the Author
You May Also Like
2024 InformationWeek US IT Salary Report
Aug 15, 20242024 InformationWeek US IT Salary Report
May 29, 20242022 State of ITOps and SecOps
Jun 21, 2022