Security researchers say a widely-used airport security scanner can be fooled fairly simply. Although the model in question was dropped from airports last year, it’s still used in prisons and courthouses.

The model in question is the Rapiscan Secure 1000, which the TSA dropped after controversy over the way it produced what effectively appeared to be nude images of passengers. The TSA said it was unable to reconfigure the machines to avoid the effect and, publicly at least, the decision was nothing to do with security.

The scanner works with a backscatter X-ray, which puts together an image based on the way radiation is reflected, or scattered, differently by organic matter (such as the body) and by materials made up of heavier elements (such as aluminum or steel.) That’s in contrast to traditional X-ray which measures the way radiation passes through objects.

Researchers from UC San Diego, University of Michigan and Johns Hopkins University found three ways that weapons could be taken through the scanner without detection. The first was to take advantage of the way the scanner relies on contrast between a weapon and the body; the scanner is unable to detect the difference between a metal object and a blank space, both of which produce no reflection of the radiation.

The researchers found that by taping a pistol or knife to a specific position on the outside of the leg or sewing it in a pant leg, the scan looked exactly the same as if the weapon wasn’t there. They noted that this could be overcome by asking the passenger to turn for scans from either side rather than just from the front and back, but that this would make the process much less time-efficient.

Their second finding technique was to mask the weapon with a material that scattered the rays at a similar intensity to flesh. Doing this without producing an obvious suspect image proved difficult, but it proved possible by wrapping around 1.5 centimeters of Teflon around a knife and taping it to the spine (pictured). The researchers suggest this would be a risky strategy as it would require a perfect concealment to avoid detection.

The third strategy was to form a “pancake” of 200 grams of C4 plastic explosive to fit over the abdomen, with a metal-covered detonator the size and shape of the naval. The result was an image that resembled that of an ordinary abdomen.

In all three cases, the researchers say a would-be attacker would need access to a scanner to refine the technique enough to be confident of using it. However, the scanners are widely available to buy. Indeed, it was the TSA ditching them last year that led to a “fire sale” that now means they are used in secure facilities such as weapons. The model is also still used in some airports outside the US.