Fun at the Airport
by Evil Wrangler
I live in a major U.S. city which, like most major U.S. cities, has a major airport that has been infested with Transportation Safety Administration workers and idiotic, restrictive security policies designed to give the American public a false sense of safety and provide an artificial environment for inefficient and greedy airline companies to continue to do business.
Many suspect that the Emperor is, in fact, naked, and recently I took it upon myself to investigate whether the vaunted airport security implemented by the gargantuan TSA is thorough or not.
What is detailed in this narrative nudges very close to breaking U.S. laws. Under no circumstances should anyone reading this replicate what is written here. This account, while factual, is for information purposes only.
Recently, I was in the airport waiting for a flight that had been delayed. Wow, like that never happens. It was late at night - after 8:00 pm, and since I already had parked the car and had about an hour to kill, I decided that I would wander around and investigate the lay of the land. At the time I did this, I was dressed in jeans, sneakers, and a black t-shirt that proclaimed: I'm not a hacker, I'm a security professional." Really - this was what I was wearing. Why this matters will become evident shortly.
So I started by examining the physical layout of the terminal building. Bottom floor for arrivals and baggage claim, main floor for tickets and check-in, and a mezzanine for offices and food.
Arrivals is boring - by then all the fun's over. The main floor, with ticketing and check-in, is where the TSA does their security dance. Basically there's a section of the floor that allows passengers to pass through from the ticket counters to the side with the gates and aircraft and overpriced shopping. Passengers stand in long lines, remove their shoes, and occasionally a TSA person pulls a grandmother out of the line and gives her "the wand" which is a more thorough physical search designed to detect that yet another American's liberties are being violated.
Unfortunately for the TSA (and us, perhaps) airport architects were not aware that the U.S. would become a terrorist target and therefore when they laid out the floor plans they designed them to facilitate access, not restrict it. So TSA has to make up for their shortsightedness by physically blocking off access using those elastic rope-and-pole gizmos accompanied by a TSA goon or two.
In addition, the entire terminal floor, from the entrance ways down to the gates, is being monitored by CCTV. So in the event somebody somewhere does something to someone sometime, it gets recorded on videotape for later network and cable broadcast, and for the trial of course.
In my particular unnamed major city airport there are two large sections of the floor staffed with TSA goons with their conveyor belts, elastic ropes, X-ray machines, and other paraphernalia.
There also are a couple of areas, blocked off with elastic ropes and manned by TSA goons, where flight crew, wheelchair passengers, etc. can proceed from one side of the terminal to the other. Basically, if you want to get to the gates, you have to walk past a TSA station. Or do you? Well, that's what I decided to find out.
For starters I went up to the mezzanine, above the terminal.
Originally this floor was designed to allow people to stand and gawk at the air travelers while enjoying their lattes. It has a terrific view of the airfield, and is perfect for small children who want to practice spitting on helpless travelers.
However, since the terrorists might try something more extreme than spitting, the entire mezzanine floor above the gate concourse has been glassed off, from the balcony to the ceiling, fusing thick (but not bulletproof) glass panels and silicone sealant.
At the end of the mezzanine walkway there is a smaller panel cut to fill the remaining space (of course the architect did not think to design a mezzanine to be a multiple of the length of the glass panels). That panel, on the end far away from TSA, only had silicone sealant bonding it to another panel - it was not bonded to the wall.
For those not familiar with silicone sealant, acetone, also known as nail polish remover, will dissolve it quite effectively. So your garden variety terrorist need only walk into the airport, take the escalator or elevator up to the next floor, walk to the end where there are no people, fasten a suction cup or other apparatus to the glass, and with a couple of minutes with some acetone and maybe a utility knife (remember, I never went through security so I can have whatever I want to do this) that glass panel is going to come loose.
What a budding terrorist would do after that is a matter of conjecture - start shooting, throw explosives, or just dump out your handy container of sarin or anthrax or whatever and wait for the fun to begin. Or else they could simply climb over the railing and drop to the floor below, or use a rope and rappel if they're going for that whole "commando terrorist" look.
But most of us aren't terrorists - a fact that appears to have been lost on the U.S. government.
Why would we want to risk injury climbing over the railing and dropping ten or fifteen feet when we could just walk down the stairs? That's right, in my particular airport I observed several staircases that led directly from the mezzanine down to the gate side of the terminal main floor.
Two had imposing signs mounted on the door saying "Restricted Access - Do Not Enter" and one had absolutely no sign at all. That's called "security by obscurity" and it's always a bad idea. All three stairwells were open and none of them had so much as an alarm. I personally verified these facts. Had I desired an extended stay with the federal authorities I easily could have walked down the stairs and exited onto the terminal floor on the gate side of the terminal without having gone through security. My entry would have been recorded by security cameras. Talk about meeting you at the gate!
Not inclined to do a lot of walking? Lazy or fat hackers can take the elevator.
In my particular airport there are several elevators between the three floors. One elevator is built so that it lets you out on the main) floor in a narrow hallway adjacent to the women's bathroom. If that's not enticing enough, you can just turn around and walk though the unlocked door to the gate side of the terminal. The sign on the door reads "Restricted Access - Do Not Enter," but there's absolutely no physical barrier preventing someone from walking though the door.
If you're male, and you'd rather use the men's bathroom, you can walk past the elevator, around the TSA checkpoint which is situated between two dividing walls, and past the men's room to the other labeled and unlocked door. Again, security cameras will record your intrusion, but besides that there's absolutely no barrier to entry.
Up on the mezzanine you get a terrific view, mostly of cleavage and construction dust, but also of the security camera layout. Most of the cameras are hardwired together and routed to a hidden security outpost.
However some of the cameras are - I am not making this up - connected to wireless routers plugged into electrical sockets nearby. Those familiar with the old X10 camera hack - if you're not just Google for 2600 and warspying - will realize that with a laptop and some inexpensive hardware, it is possible to override the signal of the cameras.
A cute Hollywood illustration of this is available in the original Speed movie where, unfortunately, it fails to fool terrorist Dennis Hopper. But if you wanted to get through one of those doors I mentioned earlier all you'd do is record a small video clip of nothing happening on one of the cameras, and then replay that clip as a loop on the camera's frequency while you browse the bookstores and luggage shops on the gate side of the terminal.
There were other enticing finds up on the top floor, including empty offices with Simplex door locks (some with default combinations and some that would require either a few good guesses or else Google for the 2600 article "Simplex Locks: An Illusion of Security" by Scott Skinner and Emmanuel Goldstein) as well as a nursery and the offices of the TSA. That's right, I walked around and past the security offices several times without being observed or challenged.
Also up on the mezzanine was a closed and locked branch of a large U.S. bank that was, in spite of several cameras pointing at the front, open and accessible from the back side.
Behind the teller desk there were offices with their network connected Windows workstations, unlocked, and their telephones. I literally had the opportunity to rob a bank branch at the airport. Besides a picture of me walking past the closed and locked teller windows on the security cameras, there would have been no way that I could have been linked to the crime had I taken some elementary forensic preparations.
Needless to say I passed up this golden opportunity to spend several years in a state penitentiary, but the security holes remain as I write this, waiting for someone with fewer scruples (and maybe better at climbing over high walls) to take advantage of them.
Having identified these (and other) chinks in the vaunted TSA armor, it was time for me to approach the TSA workers. I rode the escalator down to the main terminal floor (still on the street side of the terminal, not having passed through security) and began to interact with the TSA workers.
At this point I'd been walking around the terminal for about an hour, unmolested, wearing my black t-shirt. I approached three TSA goons/guards and asked about the configuration of the escalators, namely the one going upstairs was not adjacent to the one going up from the floor below.
The TSA person told me that they did not know but I could go ask Information. I explained that the name of the information department was a misnomer and that I would be more likely to get an answer from maintenance. They told me that they did not know where maintenance was. I thanked them and walked back upstairs to stare down on them in disgust.
i rode the escalator down from the mezzanine level and stood in front of three TSA workers wearing a hacker t-shirt, having previously walked by them several times in the past 60 minutes, and they neither noticed me nor considered me suspicious. Only in America...
Next I approached another group of TSA workers at a different checkpoint and struck up a conversation about an antique airplane mounted from the ceiling of the terminal. One of the TSA workers asked me something like "Are you here to pick up someone or are you here doing something else?" I assured them, truthfully, that I was there for the purpose of meeting an arriving passenger.
That satisfied them. I soon became bored and went downstairs to the arrivals area, partly to be consistent with my story, but also to scope out the lower floor.
Arriving passengers descend from the gate area to the baggage claim area. They then proceed to the baggage carousel. To keep the riffraff out, there is an overhead rig consisting of motion sensors and flashing blue lights mounted above the base of the descending escalators.
This post is manned by a TSA worker. Apparently if someone tries to walk from the baggage area to go up the down escalator, the lights flash and a recorded voice shouts "Warning! Warning! Do not proceed!" or "Danger!, Will Robinson" or something equally urgent. Problem was, I only saw it activated when passengers came down the escalator, creating false positives which the TSA worker dutifully ignored.
In the interest of learning I approached the TSA workers (by now there were two) and asked them what they referred to this device as, what was its name? They seemed not to understand me.
I tried asking the question a different way. After the third attempt the one that kind of spoke English explained to the one that obviously did not speak English that I was inquiring about the term that they used to describe their particular security device.
The best answer that the two TSA ESL candidates could produce was the one that I ventured for them - sensor. Unless these two were martial arts teachers moonlighting as security goons, there was no hope that they would be able to withstand any sort of brute force attack, let alone something simple like me distracting them while someone else snuck behind them and scooted up the escalator (or stairs - there also were stairs, but lazy American passengers always seemed to use the escalator to descend to the baggage claim area).
Finally, it was time for me to pick up my arriving passenger.
Their plane had arrived, so I went upstairs to the mezzanine and called their cell phone. I watched through the not-bulletproof glass that I could easily detach as their plane taxied to the gate and disgorged them, neither safe nor sound, into my city's major airport terminal.
In summary, there are two points to take away.
The first is that security is an illusion and that the Emperor is, indeed, quite naked, if you simply begin looking.
The second, more disturbing point, is that the government both is lying to us and is spending shitloads of tax money on nonsensical contrivances like the Transportation Safety Administration, which should be dismantled IMHO and replaced with something that actually could identify the small number of potential terrorists rather than forcing the entire population of the country to endure the misanthropic groping of an uneducated illiterate workforce.
End of soapbox - happy hacking!