A team of researchers from the University of California, San Diego, the University of Michigan, and Johns Hopkins University have discovered several security vulnerabilities in full-body backscatter X-ray scanners deployed to U.S. airports between 2009 and 2013.

In laboratory tests, the team was able to successfully conceal firearms and plastic explosive simulants from the Rapiscan Secure 1000 scanner. The team was also able to modify the scanner operating software so it presents an “all-clear” image to the operator even when contraband was detected. “Frankly, we were shocked by what we found,” said J. Alex Halderman, a professor of computer science at the University of Michigan. “A clever attacker can smuggle contraband past the machines using surprisingly low-tech techniques.”

“Secret testing should be replaced or augmented by rigorous, public, independent testing of the sort common in computer security,” said Prof. Shacham.

In airport settings, the Secure 1000 was typically used to take images of the front and back of a person while they stood still. Objects -- such as a gun or a knife -- would appear as dark areas against a bright silhouette of the person.

Shacham says a problem can occur when a metal gun is held at a person’s side. Such weapons absorb much of the X-ray. The gun appears as a dark area against a dark background, just off the silhouette. That can make guns and knives hard to see.

Shacham said the team also used “organic but translucent” material to successfully hide a knife from the scanner. Other concealment techniques were used to prevent the scanner from seeing knives and plastic explosives. And the machine’s software was manipulated in a way that made the scanner report that a person was not carrying contraband.

This isn’t the first time someone managed to sneak by a weapon past a TSA Rapiscan full-body X-ray scanner, but Wired reports that scientists have taken the procedure to a new level and have come up with various techniques to completely fool the security device.

The team of researchers, from the University of California at San Diego, the University of Michigan and Johns Hopkins, have figured out ways to conceal weapons, explosive devices, and even insert malware into the PC that controls the machine that can then be activated with a simple QR code printed on a piece of clothing.