Researchers reveal weak security that could allow malicious insiders or attackers to spoof the contents of carry-on baggage.
KASPERSKY SECURITY ANALYST SUMMIT 2014 -- Punta Cana, Dominican Republic -- A widely deployed carry-on baggage X-ray scanner used in most airports could easily be manipulated by a malicious TSA insider or an outside attacker to sneak weapons or other banned items past airline security checkpoints.
Billy Rios, director of threat intelligence at Qualys, said Tuesday that said he and colleague Terry McCorkle purchased a secondhand Rapiscan 522 B X-ray system via eBay and found several blatant security weaknesses that leave the equipment vulnerable to abuse: It runs on the outdated Windows 98 operating system, stores user credentials in plain text, and includes a feature called Threat Image Projection used to train screeners by injecting .bmp images of contraband, such as a gun or knife, into a passenger carry-on in order to test the screener's reaction during training sessions. The weak logins could allow a bad guy to project phony images on the X-ray display.
"The worst-case scenario is someone manipulates this in a way that the operator doesn't know a threat is in the bag ... by design, the software allows you to manipulate the image for training [purposes]," he said.
"The TSA requires this super-dangerous feature on all of these baggage scanners," Rios said.
Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
How Enterprises Are Attacking the IT Security EnterpriseTo learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Digital Transformation Myths & TruthsTransformation is on every IT organization's to-do list, but effectively transforming IT means a major shift in technology as well as business models and culture. In this IT Trend Report, we examine some of the misconceptions of digital transformation and look at steps you can take to succeed technically and culturally.