Pulling Back the Curtain on Airport Security: Can a Weapon Get Past TSA?

By Billy Rios

Every day, millions of people go through airport security. While it is an inconvenience that could take a while, most are willing to follow the necessary procedures if it can guarantee their safety. Modern airport security checkpoints use sophisticated technology to help the security screeners identify potential threats and suspicious baggage. Have you ever wondered how these devices work? Have you ever wondered why an airport security checkpoint was set up in a particular configuration? Join us as we present the details on how a variety of airport security systems actually work, and reveal their weaknesses. We’ll present what we have learned about modern airport security procedures, dive deep into the devices used to detect threats, and we’ll present some the bugs we discovered along the way.

[noahhastings]

"Our software cannot be hacked or fooled" sounds like something that the North Korean govt would say

[benjaminmiddaugh]

Possibility 3: The TSA knows about the vulnerabilities but has decided that telling people there are no vulnerabilities is sufficient response.

[erictaylor]

"Our computers are unhackable." "Enigma ist unzerbrechlich" so said the Nazis. Even when the Allies behaved as if they knew what the orders were, the Nazis still insisted that the Enigma code was 100% secure. But due to a minor error the Enigma WAS breakable. The letter changing devise never substituted a letter with itself. It made breaking Enigma much easier.
Ironically the English adapted the code machines for itself, fixing that design error and used it for years.
Remember, the bad guys are going to place their cleverest people to the problem, and if there is anything you overlooked, they *WILL* find it and exploit it, just as the chaps in Bletchley Park did. Are you smarter than the smartest person the bad guys have?
Saying that the thing you want protected is 100% secure is incredibly foolish. You better have your cleverest people try to breach your security, because if you don't, the bad guys will. And they won't tell you what your weaknesses are, and they sure as hell will try to fuck you up.

[ingeborgsvensson]

In the year 2005 I flew from Amsterdam to Newark with an acquaintance. There was some delay with the baggage so we had to wait a while before we could collect it. He used a 4 inch pocket knife to split a piece of bread between the both of us and I was surprised. He told me he never travelled without his pocket knife and he had travelled the world with it. He simple put it in the tray before going through the metal detector, watch and wallet on top and nobody had ever checked it. So every time on board an air plane he always had his pocket knife in his pocket. It's not just the TSA, all over the world they are mot noticing what is in plain sight.

[AEtherstream]

"our system cant be hacked" the instant you think that its all over, nothing is perfect

[DustinDawind]

TSAnet? They have no sense of humor whatsoever. I would totally have called it SkyNet.

[Bonechew-]

First I wanna say I love your passion for what you work with. Your a strong, efficient teacher, that first comes out as arrogant but very quickly picks up and makes you entertaining and eay to learn from. Now its 2019, so my answer now would : Nothing is 100% safe, maybe 99.999% but that 0.001 will get hit.

[deineoma]

Wow first talk I've seen where he started explaining it in a very basic way, may be boring for the pros but I as a beginner could gain a lot from it 👍

[chimerablack]

My god, someone get this man a glass of water. My throat got dry just listening to him clear his throat over and over.

[MacMashPotato]

Thats a cool itemizer, but, does it run doom?

[itisjambo]

For some reason I'm just seeing this now, but I'm really glad YouTube brought it to me...

[JustAnotherAlchemist]

... back doors ...

My employer sent me home with a Defender brand CCTV DVR to fix. He got it used but couldn't get into it because the password was unknown (Defender makes changing it mandatory). I took off the cover, hooked up a 3v3 serial to USB adapter to the (already populated) debug header, fired up termite, and was blown away by the fact that the terminal output just printed the username and password for me (among other interesting things, Linux FTW?) You can't change this password either.
...

Let me reiterate, this is also a security specific device (CCTV DVR > "surveillance camera box").

[VisualBasic]

I work at the airport
if you think passing through the TSA is the way in, you're wrong.
there's much easier ways to the plane, so yeah.

[Knobsmacker]

I accidentally went from Peru to the US to Australia with a ~ 3 inch blade folding knife right at the bottom of my carry-on. It didn't get picked up...

[billyamer]

Fun fact : sainsburys (where I work) uses Kronos for staff clock ins and clock outs

[ckeilah]

I like that he doesn't call them "security", but what they are: checkpoints. But who checks the checkers? NO ONE!
Hehe. Nice Wargames reference.

[Compgeek]

So does this mean you can plug in a USB drive into the itemizer (at the time of this presentation) and have it automatically overwrite the config file to disable explosives/drug detection?

[gbear]

I once found a crocodile Dundee knife ON the plane (barely fit in the seatback pocket) since I was on the last flight, I took it and have it to this day. Sweet score.

[urgx]

My home router has better security than the devices used by the TSA...

[flamephlegm]

I am always surprised by how completely breakable much of the security is in our modern world.