TSA Baggage Scanners Hackable - InformationWeek
IoT
IoT
Government // Cybersecurity
News
2/12/2014
10:35 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
RELATED EVENTS
Building Security for the IoT
Nov 09, 2017
In this webcast, experts discuss the most effective approaches to securing Internet-enabled system ...Read More>>

TSA Baggage Scanners Hackable

Researchers reveal weak security that could allow malicious insiders or attackers to spoof the contents of carry-on baggage.

KASPERSKY SECURITY ANALYST SUMMIT 2014 -- Punta Cana, Dominican Republic -- A widely deployed carry-on baggage X-ray scanner used in most airports could easily be manipulated by a malicious TSA insider or an outside attacker to sneak weapons or other banned items past airline security checkpoints.

Billy Rios, director of threat intelligence at Qualys, said Tuesday that said he and colleague Terry McCorkle purchased a secondhand Rapiscan 522 B X-ray system via eBay and found several blatant security weaknesses that leave the equipment vulnerable to abuse: It runs on the outdated Windows 98 operating system, stores user credentials in plain text, and includes a feature called Threat Image Projection used to train screeners by injecting .bmp images of contraband, such as a gun or knife, into a passenger carry-on in order to test the screener's reaction during training sessions. The weak logins could allow a bad guy to project phony images on the X-ray display.

"The worst-case scenario is someone manipulates this in a way that the operator doesn't know a threat is in the bag ... by design, the software allows you to manipulate the image for training [purposes]," he said.

"The TSA requires this super-dangerous feature on all of these baggage scanners," Rios said.

Read the rest of this story on Dark Reading.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
StuffyB341
50%
50%
StuffyB341,
User Rank: Apprentice
2/14/2014 | 8:23:45 AM
Re: Presumably
At least get the headline correct: the body of the article points to checkpoint equipment; there is a HUGE difference between checked baggage scanners and the checkpoint X-Ray.  Presumably, the x-ray system projects whatever the detector sees onto the screen and the process of scanning is done by the operator -- project enough clutter onto the screen and a bag check is called -- more likely to slow down the process than to allow prohibited items through.  Most airports are updating their x-ray equipment, so the relevance is spurious at best.
WKash
50%
50%
WKash,
User Rank: Author
2/13/2014 | 4:34:31 PM
Re: Presumably
Whoopty, you don't know how much fun you're missing!  I would imagine it wouldn't be too hard for someone to slip through as a contractor on routine maintenance and make a few adjustments on the scanners. 
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
2/12/2014 | 11:12:52 AM
Presumably
Presumably though, the "hackers" would need some sort of access to the machine? I've never been through a US airport, but do they often leave these terminals unguarded? 
How Enterprises Are Attacking the IT Security Enterprise
How Enterprises Are Attacking the IT Security Enterprise
To learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Register for InformationWeek Newsletters
White Papers
Current Issue
2017 State of IT Report
In today's technology-driven world, "innovation" has become a basic expectation. IT leaders are tasked with making technical magic, improving customer experience, and boosting the bottom line -- yet often without any increase to the IT budget. How are organizations striking the balance between new initiatives and cost control? Download our report to learn about the biggest challenges and how savvy IT executives are overcoming them.
Video
Slideshows
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll