Hacker News Reader

> They take the devices away for some period, but if they’re securely locked, TSA won’t be able to get anything from them.

It is well documented that there is no cell phone that cannot be unlocked.

And once it's unlocked, who knows what the real goal is. On the surface, one suspects that it's to examine its contents. But other possibilities include sideloading spyware, or even targeted viruses. Some random NGO secretary may not be the actual target, but could be the vector that allows a program to spread to one or more other targets within or without the organization.

I liked it better when this was the sort of thing that people on shortwave radio with tinfoil hats would rant about. Now it's almost weekly headlines in the NY Times, Guardian, WSJ, etc...

I’m not aware of anything better than brute force attacks for any vaguely recent iPhone.

To my knowledge this hasn’t been either verified or disproven, and no methods disclosed, but apparently CellBrite claims to be able to unlock iOS 11.

http://iphone.appleinsider.com/articles/18/02/26/cellebrite-...

When that was discussed on HN, the consensus seemed to be that Cellebrite had found a way to allow brute forcing passcodes, but that they would be ineffective against a good password.

> It is well documented that there is no cell phone that cannot be unlocked.

Citation needed?

For iPhones: https://www.forbes.com/sites/thomasbrewster/2018/02/26/gover...

For every other phone, Google is your friend.

So that's what's happening? The TSA takes your phone, teleports it to cellebrite who unlock and clone it in ten minutes, then they teleport it back?

Can you think of a better location to place a phone's unlocking and cloning machine than the TSA's examination office? Do they really need to teleport the phone?

It's unlikely to be a push-button machine. It's more likely to be a complicated procedure involving desoldering chips and placing components in specialized harnesses, which would be difficult to replicate at an airport.

That's a difficult thing to cite, I would say it's more along the the lines of the saying "There's no such thing as non-buggy code" or "there's no un-hackable system."

I get it, burden of proof. The blanket statement by OP also doesn't consider the ol' "baseball bat" ceiling of hacking strategies - at what point is it easier to just break someone's fingers until they tell you what you want to know?

(don't break someone's fingers that's not good)

> It is well documented that there is no cell phone that cannot be unlocked.

Ok, probably true, but that doesn't necessarily mean that any unlock can happen quickly, or that the TSA has that capability broadly deployed to agents, or that the TSA even wants to unlock devices.

> If I understand it correctly, the TSA is not forcing anyone to unlock devices.

I'm sure they also don't shrug their shoulders and say "Locked? Oh well.". Varying degrees of coercion, threat, implicit or otherwise, relying on passenger ignorance to their rights.

I wonder how many have unlocked it at their request too, which is specifically different from "forced".

What makes you so sure of that? I’ve had them swab electronics for explosives before and they never even try to turn the things on. I’m pretty sure I’ve had them ask me once or twice to prove that a laptop was real by turning it on, and they never asked for it to be unlocked.

That’s my whole point: this article appears to be written to make you assume that a lot more is going on than they actually describe.

I have been always asked to turn my devices on after a search for explosives (and whatever other substances they look for). They do that "to be sure you don't only carry the structure of the device to hide stuff inside". This happens in european flights.

This. I've had TSA request "a personal device, like a phone or laptop" twice at the Austin airport. The first time, I (pretty defensively) refused and started asking why they needed it. Turns out I had been randomly selected for an explosives swab, and they wanted to test my devices rather than my person. Both times the test was performed with the devices powered off, and with me present.

>coercion, threat

This is what bothers me the most about TSA and Border Agents stamping on rights - there's the implicit "we're going to waste at least 1,300$ of your money by forcing you to take another flight and rebook hotels." I get so stressed about it I show up at least 3 hours early for any flight, sometimes even 4 for international.

>>They take the devices away for some period, but if they’re securely locked, TSA won’t be able to get anything from them.

You have no way of knowing that, or if they are doing anything to the hardware, cloning the SIM, adding tracking, or simply cloning the flash for possible evaluation later

Further it should be considered unconstitutional for them to even take it for 1 second.

> If it’s some fancy explosives sniffing (like they already do to my contact lens solution) then it’s nothing interesting.

I would find it interesting and "bad", they should not need to remove the device from your view to do explosive sniffing.

It is very troubling to me how much invasion of and infringement on a persons liberties the average person is willing to accept in the name of Security Theater

I trust the crypto used by my devices.

Searching electronics for explosives isn’t security theater. That’s a real threat vector and an effective counter to that threat.

It is theatre if it is applied randomly. It is not if all devices are tested equally. The same goes for testing of people. Unless all are tested, random checks are just about useless, since there will be a pattern to the selection of people for "random" testing.

If the screening is being rendered ineffective by bad profiling, then it’s the profiling that’s theater, not the screening being profiled for.

If you are relying on "profiling" as a precursor to screening then you have made all of it theatre. You either screen everyone or screen no-one. To "randomly" choose someone to screen by the use of "profiling" makes nobody "safe", you may as well not screen anyone.

Sure. But it can be done right (screening everyone, or using actual randomness), and if it’s not, that’s a problem with the profiling, not with the actual screening of actual potential bomb casings.

Al-Shabaab used a laptop bomb on a plane out of Somalia after successfully getting it through X-ray machines. It blew a hole in the plane, but they managed to land it successfully.

Swabbing laptops for explosives doesn’t sound like security theatre to me.

https://en.m.wikipedia.org/wiki/Daallo_Airlines_Flight_159

Something being a valid attack vector does not make their security process and procedure valid, effective nor anything other than Theater to make people feel safe.

Countless of time they have failed Red Team testing, TSA is useless if your goal is actual security, they are pretty good if you want to shift people in to accepting more and more intrusive violation of their rights...