News for hackers. Stuff that matters.
Re:Pulling the Curtain on Airport Security [pdf] by idlewords on Sunday August 24, 2014 @06:36PM (#8219894)
I wish there was a transcript to go with these slides, or some context. It looks like an amazing talk.

One thing that jumped out at me right away is that the explosives sniffer is also configured to detect narcotics, amphetamine and marijuana. Is this standard procedure at American domestic airports?

Re:Pulling the Curtain on Airport Security [pdf] by ubernostrum on Sunday August 24, 2014 @08:39PM (#8220121)
TSA has more than a bit of scope creep going on. In theory, all they're supposed to do is a basic administrative search to prevent weapons or explosives from being brought onto a plane. In practice, the perception in the public mind that they are a more general law-enforcement body allows them to easily perform other tasks on behalf of agencies that don't have the same general search powers.

The classic example is searching for large sums of cash. Detecting large quantities of traveling cash and ensuring it's been properly declared is CBP's (Customs and Border Protection) job, not TSA's. But because TSA gets to X-ray and search every bag and body-scan every passenger, they catch that stuff, and then hold the passenger and go get CBP.

The result is that the number of outside-the-mandate things that can end up happening as an "incidental" result of TSA's screening is staggering.

Re:Pulling the Curtain on Airport Security [pdf] by tedunangst on Sunday August 24, 2014 @10:36PM (#8220345)
Is searching for cash the classic example or a one time example involving Ron Paul's cash courier, which then led to a rule change instructing TSA to ignore cash?
Re:Pulling the Curtain on Airport Security [pdf] by DanBC on Monday August 25, 2014 @06:02AM (#8221168)
TSA claim they don't search for eg drugs; they claim to search for expsi es and incidentally find drugs. This is the classic mission creep example.

There are people who hide drugs in jars of peanut butter. This shows up on TSA screens as a jar with different stuff in, which they claim to view as suspicious because it looks like explosive.

Re:Pulling the Curtain on Airport Security [pdf] by tedunangst on Monday August 25, 2014 @08:32AM (#8221467)
There seems to be some goal post creep as well. How many classic examples are there?
Re:Pulling the Curtain on Airport Security [pdf] by DanBC on Tuesday August 26, 2014 @10:55AM (#8227395)
Well, I do wonder if there's any benefit to the TSA for finding drugs? Perhaps I should trawl theough the reports to see if the TSA uses drug-finds as part of their results to support their work?
Re:Pulling the Curtain on Airport Security [pdf] by seanmcdirmid on Monday August 25, 2014 @05:15AM (#8221094)
The TSA does not search in-bound people, and CBP does not search out-bound people, so this doesn't really make sense.
Re:Pulling the Curtain on Airport Security [pdf] by cushychicken on Monday August 25, 2014 @08:29AM (#8221457)
CBP does not ALWAYS search outbound people, but retains the right to do so (at least in the US).
Re:Pulling the Curtain on Airport Security [pdf] by seanmcdirmid on Monday August 25, 2014 @09:48AM (#8221702)
Where would they do it? At boarding? Most US airports have no wall between domestic and international flights.
Re:Pulling the Curtain on Airport Security [pdf] by faster on Monday August 25, 2014 @11:31AM (#8222198)
Totally anecdotal, but I was once pulled aside on the jetway by a woman with a Treasury badge and a burly guy who was probably a sheriff though he never said anything. She wanted to know how much cash I was carrying. I was flying from SF to Frankfurt, and I think it was 1994. My net worth then was about $30k, so I laughed and told her I had about $200 and a credit card.

So maybe CBP doesn't check outbound travelers, but Treasury did at least once.

Re:Pulling the Curtain on Airport Security [pdf] by ubernostrum on Wednesday August 27, 2014 @02:46PM (#8233964)
CBP can and does in fact carry out checks for undeclared cash exports in the jetway for international departures. Not every departure, obviously, and I don't think the selection mechanism is public, but it's a thing they're documented as doing.
Re:Pulling the Curtain on Airport Security [pdf] by basseq on Monday August 25, 2014 @10:17AM (#8221800)
I have seen them set up in the jetway after you show your ticket to the airline attendant.
Re:Pulling the Curtain on Airport Security [pdf] by granos on Monday August 25, 2014 @08:32AM (#8221469)
You do get searched by TSA if you are coming from outside the country. In recent years I've flown in from Mexico, Spain, India and the Dominican Republic. For each flight, the boarding gate was blocked from general access and the only way to get in was to go through a TSA search. They only had metal detectors, but my bags were still searched. Had I been carrying a large sum of cash (or anything else that needs to be declared) they could have contacted CBP at my departure airport.
Re:Pulling the Curtain on Airport Security [pdf] by seanmcdirmid on Monday August 25, 2014 @09:47AM (#8221698)
That is not the TSA doing the checks though. In Beijing, there is gate screening just as you described, but it is done by locals who don't speak English, and they definitely aren't looking for cash.
Re:Pulling the Curtain on Airport Security [pdf] by ubernostrum on Wednesday August 27, 2014 @03:30PM (#8234238)
Based on reports from flyertalk and other places, it appears that there is a requirement that a certain minimum percentage of US-bound international passengers undergo at least a TSA-style boarding-pass-and-ID check.

Typically this involves stationing agents at the departure gate. Anecdotal evidence suggests AMS is a popular place for this.

Re:Pulling the Curtain on Airport Security [pdf] by granos on Monday August 25, 2014 @10:43AM (#8221959)
All of the people who screened my flights in these situations were wearing TSA uniforms.
Re:Pulling the Curtain on Airport Security [pdf] by seanmcdirmid on Monday August 25, 2014 @08:09PM (#8224968)
Interesting, I have never seen this in Asia.
Re:Pulling the Curtain on Airport Security [pdf] by tptacek on Sunday August 24, 2014 @09:02PM (#8220163)
I wonder how the THC thing could possibly work. I opt out at every checkpoint, and each time, they maximize body contact and then generate an input to those machines. Wouldn't it go off for anyone who had smoked up earlier in the day, or the preceding day? It seems like they'd be spending all their time doing drug searches.

(Don't get me wrong: drug searches at TSA checkpoints are extremely alarming, because TSA has been given a near all-access pass to mechanically searching people).

Fun fact: if you do any welding before you get on a flight, there's a good chance you'll set those things off.

Re:Pulling the Curtain on Airport Security [pdf] by GauntletWizard on Monday August 25, 2014 @02:03AM (#8220749)
I've literally spent a night putting on a fireworks show, gotten up and flown the next day, and not set off the alarm. I've also at a different time been completely clean, set off the alarm for gunpowder (I could see the screen), and then had the TSA wave me through.

They don't know, they don't care, they don't do anything. Their sole purpose is to make people more comfortable with invasive government overreach.

Re:Pulling the Curtain on Airport Security [pdf] by tombrossman on Monday August 25, 2014 @07:03AM (#8221254)
Similar experience here. I was at a party the evening before a flight and had loads of rockets and small mortars stuffed in my cargo shorts, which we were running around and shooting at each other (alcohol may have been involved).

Next morning at the airport was my first time seeing these machines. As the machines doors opened and closed, jets of air puffing at the passengers ahead of me, I wondered about the shorts which I still had on. I looked down at the empty pockets and they were literally sparkling with gunpowder and other residue from the fireworks the night before. 'Let's see what happens' was my only thought and I felt a bit let down when I got through with no problem.

Edit: Shorts sparkling in the light with some kind of crystalline residue from the fireworks, not sparkling like a lit sparkler, which would have been even more impressive.

Re:Pulling the Curtain on Airport Security [pdf] by neonhomer on Monday August 25, 2014 @11:34AM (#8222210)
> Their sole purpose is to make people more comfortable with invasive government overreach.

Amen.

Re:Pulling the Curtain on Airport Security [pdf] by tehwebguy on Monday August 25, 2014 @08:08AM (#8221391)
I set the hand wipe and scan machine off once. Had to go to additional screening, it was my hair product.
Re:Pulling the Curtain on Airport Security [pdf] by js2 on Sunday August 24, 2014 @09:22PM (#8220193)
I most recently triggered it at SFO after wearing clothing I had gone go carting in the day before. First time for me. The enhanced screening was fun. Aside, SFO security is a contractor, not TSA.
Re:Pulling the Curtain on Airport Security [pdf] by leftcoaster on Monday August 25, 2014 @09:41AM (#8221666)
Contractor probably measured by throughput, not capture rate. Hence incentives are to push people through.
Re:Pulling the Curtain on Airport Security [pdf] by bane on Monday August 25, 2014 @01:29AM (#8220731)
Also, if you spend lots of time outdoors around fertilizer you can set it off.
Re:Pulling the Curtain on Airport Security [pdf] by tagawa on Monday August 25, 2014 @03:37AM (#8220931)
Yes, this happened to me after a couple of hours on the golf course.
Re:Pulling the Curtain on Airport Security [pdf] by eli on Sunday August 24, 2014 @11:30PM (#8220472)
It's a confusing UI, but I'm pretty sure the "selected" column indicates that drug alerts are not configured to alert.
Re:Pulling the Curtain on Airport Security [pdf] by VonGuard on Sunday August 24, 2014 @10:21PM (#8220317)
Must not work that well. I flew alongside someone who smoked before a flight, and had the opt-out pat down... No alerts from the machine.
Re:Pulling the Curtain on Airport Security [pdf] by potatolicious on Sunday August 24, 2014 @06:54PM (#8219930)
There's a sticker from the inside of the machine that indicates it belonged to the US prisons system at some point. Narcotics detection would seem very relevant to that application.

Some of these vulnerabilities are shocking. This goes beyond carelessness and straight into incompetence.

Re:Pulling the Curtain on Airport Security [pdf] by vesche on Sunday August 24, 2014 @08:33PM (#8220112)
It's from blackhat USA 2014 (Aug 6/7), when the video is uploaded it should be posted here: https://www.youtube.com/user/BlackHatOfficialYT/videos
Re:Pulling the Curtain on Airport Security [pdf] by zerohm on Monday August 25, 2014 @11:38AM (#8222227)
+1
Re:Pulling the Curtain on Airport Security [pdf] by Implicated on Sunday August 24, 2014 @07:09PM (#8219948)
They don't seem to be detecting marijuana in their currently configured state.
Re:Pulling the Curtain on Airport Security [pdf] by rustyfe on Sunday August 24, 2014 @08:41PM (#8220124)
This isn't correct. They are checking for THC, tetrahydrocannabinol, the active ingredient in marijuana.
Re:Pulling the Curtain on Airport Security [pdf] by eli on Sunday August 24, 2014 @09:58PM (#8220268)
The "selected" column indicates "no" for drugs.