US hacker Chris Roberts insists he's the good kind, but things are never black and white.
Roberts has lately found himself at the centre of controversy thanks to an off-the-cuff tweet about hacking a United Airlines flight's computer system.
More World News Videos
How easy is it to hack a plane?
British computer security expert says on-board entertainment systems offer hackers a gateway to in-flight systems.
The tweet — published via in-flight Wi-Fi on a two-leg journey to Syracuse New York — teased that Roberts could possibly activate the emergency oxygen system, and saw him detained by the US Federal Bureau of Investigation upon landing. The FBI seized his computer equipment and questioned him for five hours.
Roberts maintained the tweet was merely in jest, and that he had not in fact hacked into the aircraft's control systems ... at least, not on that occasion.
!['Fantastical': experts are split on whether Chris Roberts was actually able to control a passenger jet.](/web/20170415053753im_/http://www.theage.com.au/content/dam/images/g/h/4/r/q/q/image.related.articleLeadwide.620x349.gh4dkm.png/1432004669398.png)
An affidavit, since released, alleged Roberts told the FBI during questioning that he had exploited vulnerabilities in in-flight entertainment systems 15-20 times in the last few years, and had on at least one occasion successfully hacked into flight controls to make a plane, briefly, move sideways.
The vulnerability, Roberts alleged, lay in the aircraft's in-flight entertainment system: with a little hunting and expertise, hackers could connect their computer to a jack beneath each passenger row, circumvent firewalls and slip into the plane's cabin control system and satellite systems, which have access to the avionics system – in other words, the flight controls.
The Colorado resident, who founded security firm One World Labs five years ago, is highly respected in the "white hat" community – that is, hackers who go hunting for vulnerabilities in computer systems so administrators can be warned to fix the problem before an attack by a bad guy.
A security insider told Fairfax Media that Roberts was considered an "elder" at DEF CON – a global hacking and security conference regularly attended by law-enforcement agencies – as he had spoken there so often to share his expertise.
![US security researcher Chris Roberts, right, with John McAfee, founder of McAfee anti-virus.](/web/20170415053753im_/http://www.theage.com.au/content/dam/images/g/h/4/r/l/x/image.related.articleLeadwide.620x349.gh4dkm.png/1432004669398.jpg)
"He's a very respected figure in the media; he does a lot of talking about security to the betterment of us as a society," the insider, who didn't wish to be named, said.
Roberts' LinkedIn profile also underscores his philanthropic pursuits. In it, he notes his interest in taking on pro bono security consulting, and his involvement in Hackers for Charity, an Africa-based not-for-profit which sees technologists donate their time and expertise to disadvantaged communities.
But questions now hang over both the validity of Roberts' claims and the ethics of his alleged actions.
"My only interest has been to improve aircraft security," Roberts tweeted on Sunday. He maintained he notified aircraft manufacturers of the vulnerability as early as three years ago.
I think that's overstepped the line of a white hat into one of the grey areas - and close to a black.
IT security expert Ty Miller
We provided all the research to the manufacturers 2-3 years ago.... https://t.co/ZEwotkA2er
— Chris Roberts (@Sidragon1)
April 22, 2015
The April affidavit also shows he detailed the issue to the FBI in February during a previous round of questioning.
Roberts did not respond to Fairfax Media's request for comment, however he told the Security Weekly video podcast earlier this month that despite repeated warnings, rather than fixing the problem, Boeing issued a report which described him and his associates as "potential threats".
"We have tried to engage with both the airline manufacturers and a bunch of the airlines and haven't really had much luck," Roberts told the program.
Roberts said his original tweet came out of frustration at the industry's "lack of fixes", though later conceded it "should have been moderated".
Fair comment, and yes, frustration about the lack of fixes hit the peak and the tweet should have been moderated. https://t.co/9UcVu3BNya
— Chris Roberts (@Sidragon1)
April 21, 2015
The security insider Fairfax spoke to described the tweet as "out of character and out of context", and urged detractors to wait until all the facts about Roberts' discussions with industry were known before judging him.
"We're talking about someone who doesn't hack systems to cause trouble and mayhem; he does computer security research to bring vulnerabilities to attention in a manner that is responsible."
Yet however well-placed Roberts' intentions, his decision to broadcast the vulnerability on social media has been variously criticised as "silly" and "stupid" – and much worse – with some warning it could pave the way for malicious exploitation.
Cybersecurity experts are split on whether Roberts actually did manage to take control of flight controls through in-flight entertainment systems.
As far as this controversy about controlling aircraft from the entertainment system, I'll believe it when I see it otherwise I call bullshit
— Kevin Mitnick (@kevinmitnick)
May 17, 2015
At least one law-enforcement official has (anonymously) suggested they don't think it's plausible, while security consultants Desmond Ross and Kevin Mitnick have called it "fantastical" and "bullshit", respectively.
Aircraft manufacturers Boeing and Airbus have each rubbished the claims, with Boeing saying its entertainment systems are kept separate from flight and navigation systems.
Other pundits, however, say aircraft systems have become more interconnected in later models.
Threat Intelligence founder Ty Miller said Roberts had provided evidence of capturing traffic data from aircraft avionics systems, indicating in-flight entertainment systems on some aircraft were in fact "not separated sufficiently".
Whichever way it is, there is something about Roberts' claim to be acting for the greater good that does not quite add up.
Frustrations aside, is it worth risking passenger safety by tampering with a flight mid-air?
Amid all the drama surrounding Roberts, United Airlines last week announced a "bug bounty" program, whereby it will reward hackers up to 1 million frequent flyer miles for identifying a vulnerability.
The catch is the program only applies to the airline's public-facing website and apps – not to its internal staff networks, and definitely not to any computer equipment on an actual plane.
There's a clear reason for that.
"You don't want to be encouraging people to be breaking into the systems in the air," Miller said.
But that's exactly what Roberts did in a presentation back in 2012, which can still be viewed on YouTube.
Miller said a formal, on-the-ground penetration test, drawing on the expertise of aviation specialists was a better option than inviting white hats to tamper with passenger flights.
However strong a hacker's skills, and however good their intentions, there was always the very serious risk they might "mess something up", he said.
"I think that's overstepped the line of a white hat into one of the grey areas – and close to a black."
0 comments
New User? Sign up