A new study shows the Rapiscan scanner, which was used in airports by the Transport Security Administration, does not always detect weapons.
The study was conducted by three universities, who were able to slip guns past the scanner without being detected.
"It is possible to conceal knives, guns and explosives from detection by exploiting properties of the device's backscatter X-ray technology," said the paper.
While the Rapiscan Secure 1000 has been retired from airport use, it is still used in various environments such as court houses and prisons.
"Frankly, we were shocked by what we found," said J. Alex Halderman, a professor at the University of Michigan. "A clever attacker can smuggle contraband past the machines using surprisingly low-tech techniques."
The researchers were able to buy the Rapiscan scanner from eBay, from a seller who got hold of the item from a surplus auction at a government facility in Europe in 2012.
A researcherblamed the security flaws on Rapiscan's assumption attackers would not be able to buy and test the Rapiscan Secure 1000 themselves. This however proves to be untrue based on the methods used by the researchers involved in the study.
The researchers were able to conceal a gun using two methods - by carefully taping the gun to someone's leg, and by sewing it to the inside of pants.
"In each case, the pistol is invisible against the dark background, and the attachment method leaves no other indication of the weapon's presence," the paper explained.
The scanner is also vulnerable to items that scatter X-rays at the same intensity of human flesh. For example, covering an 18-inch knife with 1.5cm of Teflon tape, which scatters X-rays, hid the knife enough so that it looked to be part of the person's spine.
Furthermore, simulated plastic explosives, such as C-4, look to be part of a person's stomach area if shaped in a thin pancake. A metal detonator was also placed in a person's navel, which appeared normal on the scanner.
The scanners were also vulnerable to malicious software. If someone was to gain physical access to a scanner, it would be easy to upload malware to the scanner's computer. The researchers even developed malware that hid scanned images for later retrieval.
The scanners cost between $150,000 and $180,000, with 150 were installed at airports in 2010 alone.
