Skip to main content

Can you hack a security checkpoint metal detector? Yeah, we already did.

To get straight to the point - walkthrough metal detectors are a security technology to attempt to detect and thus remove weapons and dangerous items from individuals to make a safe space. What if they were much more fallible than expected? 

I'm not here to fear-monger either - these problems are preventable with proper use and changed in guidelines. Like many security controls, their exploitation is commonly due to those who implement and monitor them. However, in order to create these changes, more proof-of-concepts and solutions need to be tested. We already have a few to start. 

The walkthrough metal detector (WTMD) research was not my original idea. It started out of research projects from PHSI and another Garrett 6500i was donated to our lab. This machine was not ours and we did not have permission to modify or conduct digital attacks on the detector. We were supposed to use physical modifications to hide or modify the results of the screening. 

One colleague in particular Pat Glass created a wooden rig that would allow student researchers to test passing items through the detector consistently and accurately. PHSI students tested common suggestions and ideas on getting pass the detector. They tried wrapping items in Mylar, changing the item's surface area, and other tricks to get the metal detector to create a false negative. More information about that research can be watched in my GrrCon talk. Thank you to the researcher who named that metal detector Mr. Den City - Katie

So here's the general plan for evaluating this technology:

Done
  • Test materials on person to create false negative ✓
  • Change properties on items passing through to create false negative ✓
  • Attempt to incorrectly screen resulting in false negatives ✓
  • Attempt to incorrect screen resulting in a false positives ?
  • Audit common guidelines expected results to tested outcomes ✓
    • When venues set their WTMD levels, are the capturing the results they are expecting?
      • spoiler: not really. 
In-Progress
  • Attempt material changes resulting in false positive
  • Re-evaluate original threatening materials versus newer threatening materials and access proper WTMD levels
    • What levels should they be in order to detect what we originally thought was dangerous, and what we now evaluate to be dangerous in 2020?
Future Work
I'm obligated in the interest of PHSI to redact a few details. 
  • Re-test and document the previous work and complete the in-progress work
  • Access other avenues of intentional false positives
  • Get a second WTMD 6500i
  • Install the module typically in use at venues and security checkpoints which utilize multiple WTMDs together. 
  • Access the vulnerabilities associated with multiple WTMD use.
    • This does not refer to the human error associated with Lane Consistency that I wrote about in my thesis. This is a technology centered inquiry. 
      Someone once told me that your Master's thesis will be your worst work, and goodness is that the case for me. When I get my first prof appointment I'll re-work and update it. Anyway...
  • A couple of surprises
    • hint: there's a local area network here

I hope this has answered a couple questions or at least has a few people interested in the project! I'll do my best to share updates as they come up there. 

Comments

Popular posts from this blog

How to Wardrive: Know where to go

Inspired by others, and my goal of getting a golden WiGLE badge, I went wardriving for my birthday. I was hoping for 50k, and I ended up with just over 61k. I'm less than 80k away from my goal! But how do you pick a place to wardrive, and how do you actually do  it? The easiest way is to download WiGLE on an android phone, get some transportation, and be set on your way. But if you want more detail or some tips, keep reading.  Avon Lady Method : Find a city within reasonable distance of travel Examine the results for the past few years of the area; do not use the overall coverage of all time.  Verify if the city is desirable for wardriving Little coverage in the past few years Most residential areas are not covered Use maps to search and define high density residential areas (i.e. apartments, town homes).  Create an order that allows for little overlapping and in a convenient driving pattern. Use landmarks around the city to define the internal roads Wardrive Profit ("internet

Goal Setting: Creating a vision board

 Hey y'all! I know I've missed my 2022 resolution to post once a month on the blog. It's something I think about frequently. I have been pouring my efforts into other areas of my life and haven't set enough time to create content or write blog posts. I've recently been reinvigorated after coming back from GrrCON 2022. Not only was GrrCON so much fun, I presented a pretty good talk: Hey Ma' Where's Malware Come From? It'll have it's own blog post once all the content is ready.  If you want to follow along, make your own vision board for free here .  I have a lot on my plate of tasks I don't attend to; things I want to do and things I need to do. I decided to help me clarify my goals and give myself some good mile markers via a vision board. Here's what the board means to me: (from left to right) Fox: I want to strive to do my best a work and position myself for future career growth and opportunities. I value where I work and want to be a helpf

#WardrivingWednesday

 I've attempted, with mixed results, to establish a hashtag on Mastodon on Wednesdays for wardriving. Why? Because I feel like it. There are so many awesome people in the wardriving space that could probably do it better, but I'm going to do it instead.  I cannot recall where I heard this general rule of thumb, but I believe it was Dragorn who said " For every adapter you can go about 10mph ". I wonder how true that is, and I wonder more how I would begin to test that theory. This is something I'd like to figure out, and will likely need some assistance.  I also plan on remaking my rigs with raspberry pi alternatives. Right now there is a lot of drama surrounding raspberry pi, but I'm doing it just because of the cost and supply issues. There are many alternatives now, and I'm sure they'll make a few rigs. I'll keep the updates posted under the hashtag on Wednesday. If you're interested in wardriving you should join the RF Sanctuary Discord.