Hacker News Reader

Comment by droopybuns | Hacker News Reader

This person was an absolute clown.

I think the infosec community needs to grow up. We all hate when legislators use the word 'cyber.' Title 18 is a mess. The new computer crime proposals are worse. Every couple of years we get the occasional story about licensing security professionals. It is because of exactly this type of clownish behavior.

There are consequences for the attention seeking type of behavior. This idiot is catnip for government regulation.

It isn't exactly his fault though. Our community has been doing this to garner press attention for the sake of the attention. He is following the pattern that has long been set. Stunt hacking scares the shit out of normal people. Eventually people will demand regulatory intervention.

View on HN

Every response to this I've seen from "the infosec community" (my connection to that community tends sharply towards vulnerability researchers, since that's my background) has been critical of this guy. I can't think of anyone I've seen cheerleading him. I've even seen rare glimmers of people criticizing EFF for trying to make a cause celebre of him.

But you're taking things too far by casting aspersions on all of "stunt hacking".

The problem with this idiotic tweet is that, if there is a vulnerability in the electronics of an airplane, this is exactly the thing you'd expect to see before some moron accidentally forced an emergency landing by tinkering with it. Vulnerability researchers disrupt and disable systems all the time without trying to.

The same is not true of people using logic analyzers on car CANbus systems (the archetypical example of stunt hacking).

The real criticism I've seen of stunt hacking is that (a) we don't learn all that much from it and (b) it's not particularly difficult ("look at this debugger debugging", as a friend of mine summarizes most stunt hacking talks).

"I've even seen rare glimmers of people criticizing EFF for trying to make a cause celebre of him."

Perhaps it's entirely possible that the EFF is just like any other organization that needs to find ways to justify their existence. The same with security researchers cloaking many of the things that they do in some quest for the greater good (the "if it wasn't for us" argument).

You know locksmith tools are available for purchase over the internet. But that's not enough! We should teach lock picking in schools so that people develop new and better ways to prevent their own locks from being picked and invest in more security against people that have been trained to pick locks. Because disclosure and transparency makes everything better and nobody thinks there is any value at all in obscurity or making things a bit more difficult by not being so out in the open.

Pretending that finding some security flaw is not about capturing the flag and all about saving humanity really bothers me to no end.

With physical locks you are exposed to the few people that can walk up to the lock without attracting attention. With digital security, you are potentially exposed to every connected system on the planet. An invisible attacker can't pick your lock, but could hack your security system. That is why digital security is paramount.

Robots are not going door to door picking locks, but that is exactly what happens every second of every day to every system on the Internet. It only takes one, and there are lot of disenfranchised smart people around the globe.

I've seen a lot of people cheering for him. I've seen the man in person at various cons, and I think he's brilliant. The problem is, what are we supposed to do? Responsible disclosure: companies don't give a shit and will hide it. Full disclosure: you get sued and thrown in jail. Stunt hacking disclosure: people get scared even though it's easy to do. People demand something be done about it. The person who did the disclosure is alternatively viewed as a hero or a villain, but the thing is people are talking about the issue.

What's going to get people talking about security? "Target got hacked" "Oh, what a shame, I'll replace my card then go shopping at Target again". Or what about "I can bring down a plane while it is flying without needing a bomb. I can shut down hydroelectric dams from my living room and flood the entire state of Washington". Now you've got people talking.

"It's not particularly difficult" is the precise problem. It should be difficult. People should be demanding that gaining access to flight control and SCADA systems be made impossible by the general public. Dismissing a hack as "easy" means you're forgetting that it's a hack. It's not supposed to be possible, let alone trivial.

How about this: don't publish a message to the world on Twitter saying that you are tinkering with what you believe to be flight control systems on an actual aircraft in transit?

The problem is, he's done it before. And reported it to the airlines. And they've done nothing about it.

I've heard him talk for years. Same thing every year. So seeing what I saw on Twitter was no surprise. He's not publishing an exploit on Twitter, he's making a joke to the followers he has that all know what he's done. He's making the joke that this year, again, the flight control systems are still vulnerable to literally anyone with a laptop and an ethernet cable.

It's not that he's saying he's tinkering with what he believes to be flight control systems on an actual flight in transit. Of course he wouldn't do that... again. He's already done it once, years ago. Why was there no outrage then?

Choose your own adventure:

(a) There is no real flaw here, other than the potential for maybe sending scary messages to people's In Flight Entertainment screens, and so the disruption he's causing by suggesting that there might be a flaw has no upside.

(b) There is a real flaw here, for instance a message he can send across in-flight wireless that would deploy an oxygen mask, and his broadcast that he intended to tinker with that system is actually threatening.

Am I missing a case (c) here?

>>The person who did the disclosure is alternatively viewed as a hero or a villain, but the thing is people are talking about the issue.

This is what I have concerns with. It's this "ends justify the means" argument that disregards some important consequences.

There are many ways to breach these topics. You can go to the FAA. You can go to the individual companies. You can post on mailing lists. Ultimately, it may be a grind. But going the press route with inflammatory statements has consequences that exceed your own experiences with law enforcement. The legislators want to regulate infosec. It won't be pretty when they do.

We need people to understand that a successful disclosure doesn't require headlines in arstechnica. You have to be empathetic to interactions with large organizations. Flashy press may get attention to your issue, but it can also have disastrous consequences for the rest of the community. Is it worth it?

This is the first time I have heard about "stunt hacking" but that is a perfect descriptor for the behavior I have seen from some individuals.

> Stunt hacking scares the shit out of normal people. Eventually people will demand regulatory intervention.

Good. Maybe they'll actually start caring about security instead of obscurity through law.

They don't want to be secure, they want to feel secure. That's why when somebody shows how insecure people are the common reaction is to want to punish that person. They didn't make people less secure, but they made them feel less secure.

This is exactly what I am trying to call attention to. I have tremendous sympathy for the sentiment you are expressing. Unfortunately, the splash damage of flasy exploitation publicity as an incentive for vulns remediation is government regulation of security professionals.

The flashy stories have been happening for close to 20 years now. Are vulnerabilities becoming more rare?

I think the infosec community needs to grow up.

Vauge non-specific demands of a loose and fluid group with little to no control over it's members set the group up for inevitable failure.

Without critical thought, it appears to be a reasonable request. Which is why the people who never want to listen to The Cavalry or EFF say it, and why the rest of us propagate the idea. But it's a trap.

> little to no control over it's members

There is some amount of control when you are accepting and possibly celebratory in response to behaviour that should be discouraged.

For example, if you never sexually harass someone yourself, but you are silent while other do so, you are ceding a control that you have over the situation.

If more people that were respected in the community called out these behaviours when they happen, you may see them happen less (though this isn't an absolute control, so they wouldn't go away completely).

At the same time, you can always claim that "the community isnt doing enough" because "enough" and "the community" as so ill defined that you can always castigate "the community".

It is a complete waste of time.

Somewhat OT, but this is something I wish people could understand about groups like Occupy and GamerGate. The criticisms of both are often measured in such a way that the targets of the criticism can never do "enough".

The fact that somebody scares the uninformed public shouldn't be the determining factor for whether it's appropriate. Especially if it's true: "a hacker can bring down the plane" is an important claim to investigate. Even if you disagree with how he said it (and I certainly do), it shouldn't be forbidden just because it's sensational.

The appropriate sanction is the professional scorn that he's already beginning to receive.

Reply on news.ycombinator.com