Skip to main content

Can you hack a security checkpoint metal detector? Yeah, we already did.

To get straight to the point - walkthrough metal detectors are a security technology to attempt to detect and thus remove weapons and dangerous items from individuals to make a safe space. What if they were much more fallible than expected? 

I'm not here to fear-monger either - these problems are preventable with proper use and changed in guidelines. Like many security controls, their exploitation is commonly due to those who implement and monitor them. However, in order to create these changes, more proof-of-concepts and solutions need to be tested. We already have a few to start. 

The walkthrough metal detector (WTMD) research was not my original idea. It started out of research projects from PHSI and another Garrett 6500i was donated to our lab. This machine was not ours and we did not have permission to modify or conduct digital attacks on the detector. We were supposed to use physical modifications to hide or modify the results of the screening. 

One colleague in particular Pat Glass created a wooden rig that would allow student researchers to test passing items through the detector consistently and accurately. PHSI students tested common suggestions and ideas on getting pass the detector. They tried wrapping items in Mylar, changing the item's surface area, and other tricks to get the metal detector to create a false negative. More information about that research can be watched in my GrrCon talk. Thank you to the researcher who named that metal detector Mr. Den City - Katie

So here's the general plan for evaluating this technology:

Done
  • Test materials on person to create false negative ✓
  • Change properties on items passing through to create false negative ✓
  • Attempt to incorrectly screen resulting in false negatives ✓
  • Attempt to incorrect screen resulting in a false positives ?
  • Audit common guidelines expected results to tested outcomes ✓
    • When venues set their WTMD levels, are the capturing the results they are expecting?
      • spoiler: not really. 
In-Progress
  • Attempt material changes resulting in false positive
  • Re-evaluate original threatening materials versus newer threatening materials and access proper WTMD levels
    • What levels should they be in order to detect what we originally thought was dangerous, and what we now evaluate to be dangerous in 2020?
Future Work
I'm obligated in the interest of PHSI to redact a few details. 
  • Re-test and document the previous work and complete the in-progress work
  • Access other avenues of intentional false positives
  • Get a second WTMD 6500i
  • Install the module typically in use at venues and security checkpoints which utilize multiple WTMDs together. 
  • Access the vulnerabilities associated with multiple WTMD use.
    • This does not refer to the human error associated with Lane Consistency that I wrote about in my thesis. This is a technology centered inquiry. 
      Someone once told me that your Master's thesis will be your worst work, and goodness is that the case for me. When I get my first prof appointment I'll re-work and update it. Anyway...
  • A couple of surprises
    • hint: there's a local area network here

I hope this has answered a couple questions or at least has a few people interested in the project! I'll do my best to share updates as they come up there. 

Comments

Popular posts from this blog

Wardriving OSINT & SE

 Disclaimer: do NOT use this information to be a jerk. Don’t try to get the location of my examples, or you’re a big meanie. There's already a post out there about tracking people with wifi. It's helpful for those who use a hotspot or maybe a vehicle hotspot. I believe a personal device that broadcasts Bluetooth is more likely than a hotspot.  Tracking What wardriving can’t do = track people via Bluetooth devices Or shouldn’t be able to work. Most modern Bluetooth devices use MAC randomization, which changes the MAC address of the Bluetooth device at random. Even if you can track a device it may only be short-term, as it’ll change again.  But sometimes they don't turn over to a randomized MAC. Do what you will with that. If you want to see how easy it is to make a random MAC go here . But what if you only need a short-term answer? Better start stumblin’. Let’s forget the purpose of needing that MAC address long-term. With all MAC addresses, OUI can tell you what the

The big list of remote job openings

From a conversation in my Discord ; one member brought up a lot of the best remote jobs and job boards come from Twitter. This is a decentralized way of distributing information, which is better than not sharing the information but can be hard to find.  This list is not a replacement for that, but it's pretty close. Here's the master remote vacancy list for remote jobs in the United States. This job board is in no way just for IT jobs, there are all sorts of jobs from sales, teaching, upper management, data entry, design, customer service, and more. Take a look if you're looking for a new job.  Some Tips: Try searching the full row for the job in Google. There are better job boards where the job posting is more up to date; instead of using the link provided. Don't spam one company, make sure if you're using the shotgun approach, you aren't letting the companies you're applying for know that There's a lot of advice on how to get a job online. Some of you

Common techniques for accessing phishing attacks

Can't load the phishing site that you know is there? Here to do some incident response or some SOC tasks? If you’re attempting to respond to an incident or just investigate some phishing pages, you may find that they are inconsistently accessible. Fraudsters will make phishing sites less available to their non-targets to curb their detection. Here’s what to know about phishing attacks and how to access them. What is a fake 404 page? It’s pretty easy to make a fake 404 page to display. <html><head> <title>404 Not Found</title> </head><body><h1>Not Found</h1>                  <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p>                    <hr>                    <address>Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 Server at localhost Port 80                                <style>