Just desserts

Back in April I blogged that I had little sympathy for Chris Roberts who was arrested after he tweeted onboard a flight:

“Find myself on a 737/800, lets see Box-IFE-ICE-SATCOM, ? Shall we start playing with EICAS messages? “PASS OXYGEN ON” Anyone ? :)” his tweet read.

It turns out he did more than tweet about hacking planes – he actually did it – and often.

Stuff reports:

A security researcher hijacked an airplane’s engines after hacking its in-flight entertainment systems, according to the US Federal Bureau of Investigation. 

Chris Roberts, a well-known US security researcher, told FBI agents in February that he’d hacked in-flight entertainment systems on over a dozen flights and on one occasion hijacked an aircraft’s thrust management computer and briefly altered its course. 

“[Roberts] stated that he thereby caused one of the airplane engines to climb resulting in a lateral or sideways movement of the plane during one of these flights,” FBI agent Mark Hurleywrote in a warrant application filed in April and obtained by technology publication Wired on Friday. 

The FBI seized Roberts’ computers and questioned him after he was escorted off a United Airlines flight last month, because he’d posted a tweet — apparently in jest — hinting he could tap into the aircraft’s crew alert system and cause passenger oxygen masks to drop. 

According to the document, during interviews in February and March, Roberts said he’d compromised in-flight entertainment systems on 15 to 20 flights between 2011 and 2014. Each time he’d pried open the cover of the electronics box located under passenger seats and would connect his laptop to the system with an ethernet cable. He’d also scan the network for security flaws and monitored communications from the cockpit. 

I have even less sympathy for him now. Taking over a plane by hacking is not a world different from taking it over with a gun.

Details of the warrant emerged as United Airlines launched a new program that will reward researchers with up to one million frequent flyer miles when they report to it new security flaws in its apps, websites and portals but not in-flight systems. 

The program takes a leaf from bug bounties run by Google and Microsoft, which collectively paid millions of dollars last year to researchers.

That’s a good idea. A true security professional would have immediately reported any vulnerability.