BETA
This is a BETA experience. You may opt-out by clicking here

More From Forbes

Elite Russian Hackers Claim To Have Breached Three Major U.S. Antivirus Makers
School Lunch Business Rivalry Leads To Hacking Charges
Cybercriminals Steal $1.75 Million From An Ohio Church
Ransomware Hits Yet Another U.S. Airport
A Free Wi-Fi Finder App Exposed Passwords To Millions Of Networks
A Ransomware Attack Knocked The Weather Channel Off The Air
Edit Story
ForbesInnovationCybersecurity

Gun Ammo, Bomb Supplies, Commandeered Cars And Planes: Dangerous Tweets For Alleged Flight Hacker

Thomas Brewster
Forbes Staff
Senior writer at Forbes covering cybercrime, privacy and surveillance.
Following
This article is more than 8 years old.

Though the issues Chris Roberts, alleged plane hacker and co-founder of security research firm One World Labs, has raised in recent weeks are bigger than just one man, looking through his past tweets provide all in the industry with a timely reminder of what maybe shouldn’t be said in public, or even private, discussions.

Going back through Roberts’ Twitter feed reveals numerous tweets that more rectitudinous types would deem inadvisable (Roberts can, of course, tweet whatever he wants, being a human with free will and a resident of a country, America, that supposedly protects freedom of speech). There are repeated references to his work on planes, most of which are delivered on board aircraft, as was the fateful tweet on 15 April in which he referenced flight communications systems, landing him in legal hot water. In September, Roberts sent an ostensibly tongue-in-cheek comment about a "broken" Airbus A320, and in 2012 he indicated he could hack a Boeing 787. In the run up to the 2012 US Presidential election, he tweeted about engine control systems on Air Force One (according to an FBI affidavit filed this month, Roberts claimed to have taken over engine controls to make a plane move sideways).

Roberts is also a self-proclaimed petrolhead. But according to his Twitter activity, he doesn’t mind hacking into vehicles he doesn’t own. In two messages he claims to have breached the infotainment systems on rental cars systems, including one in a Ford, much to the annoyance of the rental companies.

Then there are some tweets about trying to hack into the Large Hadron Collider and the Mars Rover…

Not to mention a collection of ammo and what appears to be amateur bomb-making material (thermite being a mixture of powdered aluminum and iron oxide that is used in incendiary bombs). I'm told there is a get together every year at a firing range during Defcon, where attendees bring ammo and thermite exploding targets, so it's all harmless fun...

Roberts’ LinkedIn page isn’t your typical anodyne affair either. Backing up claims from former co-workers who wished to remain anonymous, it appears Roberts has had a turbulent time with ex-employers. His description of his time at anti-virus firm Webroot reads: “Tried to do lots of things… Management challenges.” As for his employment at Sports Authority, he says: “Interesting, yet challenged company.......... [long ellipsis is Roberts’] Their focus is IT as a mechanism rather than an enabler.”

Over on YouTube, one can find a host of presentations by Roberts on attacks on physical systems. Some of the claims are dubious, though startling if true.

He gave a talk, entitled "Planes, Trains and Automobiles", about hacking into various forms of public transport back in 2010, at the Las Vegas B-Sides conference, which he rehashed for GrrCon 2011 conference, viewable below. He talks about using Bluetooth to hack into cars, attacking planes and other transport attacks, including on helicopters. At one point, just before and after the 30 minute mark, Roberts talks about taking over flight control and autopilot systems. He says: "My idea was to basically just fly the aeroplane up, drop the engines and watch it come down and see what happened. Chris [Nickerson, a fellow security researcher] figured that was a little too drastic and figured out we should probably land the aeroplane and preserve some life. Emphasis on 'some life'." Again, perhaps not advisable comments, if not exactly clear.

In a later talk, from the 2012 GrrCon conference, he talks about breaking through the firewall of a Boeing 787, the same model of aircraft he had previously tweeted about hacking, saying attendees should "have some fun" with flights using Gogo wireless. Later in that talk, as originally noticed by Ars Technica, he claims to have “messed around with the [International] Space Station”, saying he and some colleagues (some of whom may now be losing their jobs) “adjusted the temperature on it. It was quite fun”. He also talks of hacking someone else’s Volvo car, apparently “shutting off some cylinders”, and other peoples’ Mercedes vehicles over Bluetooth to put them all in neutral, as well as some buses in Oslo, the Norwegian capital he says he is unlikely to ever be invited back to. And he claims he was previously interviewed by law enforcement officials after researching military missiles.

If any of these claims are true, Roberts has been hacking transport systems and others’ vehicles the world over, with little regard for the potential physical impact, even if he’s only trying to highlight insecurities in critical systems (a worthy pursuit when done responsibly). There may be some embellishment involved, perhaps to make manufacturers wake up to the issues.

Regardless of the factual accuracy of Roberts’ public claims, it’s apparent such public statements could come back to haunt him, especially if charges are filed by the authorities in Denver who are looking into his past activities. For now, Roberts is offering no comment, according to an email from Hanni Fakhoury, senior staff attorney at the Electronic Frontier Foundation, who is now working with the researcher’s legal representatives at Keker and Van Nest.

Not all his tweets have been risqué, far from it. Indeed, though Roberts apparently commandeered and manipulated a plane’s controls at some point in the last few years, according to the FBI affidavit, he does have some concerns about flight safety. In particular, the adherence to the flight safe mode rules on take-off and landing.

Thomas Brewster
Thomas Brewster