36 ms·

How to own an airline in 3 easy steps and grab the TSA nofly list along the way

1028 points by half-kh-hacker 4y ago

fomine3 4y ago
I'm not confident that is it safe to link to the site operated by such hacktivist. I prefer to see link for news article on HN headline, rather than criminal hacker's website itself, but I don't know rules.
thrtythreeforty 4y ago
Headline buries the real lede a bit in my opinion; the author has gotten a snapshot of the no-fly list from 2019. Presumably the system under attack processes more up-to-date versions of it regularly. Corresponding news story: https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotected-server-commuteair/ https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotecte...
- racnid 4y ago
  Basically any air charter service (no matter how small) will have access to the no fly list. It's honestly surprising that it's not up to date online within minutes.
  - DocTomoe 4y ago
    If I was the US government, I would add some fake but legitimate-looking IDs in such lists, different ones for every airline I send the list to, so I can identify who leaked the list ex post facto, and come down with God's Wrath on any airline that leaked theirs. But then, I am not a Bond-esque criminal organization bent for world domination.
    - zztop44 4y ago
      This is called “seeding” a list and is standard practice for data brokers. But maybe that’s a sign they’re Bond-esque criminal organizations…
      - philjohn 4y ago
        Yup - they're the people ACTUALLY selling your data (and often for pennies)
- karlkatzke 4y ago
  Also seems to have gotten a crew list from the CommutAir’s CASS or possibly from other airlines as part of the shared deadheading crew list, which includes crew addresses and employment information. There were also prod AWS credentials in the files exposed in Jenkins.
- ryandrake 4y ago
  I wonder which no-fly list it is. Is it a government no-fly list that would contain suspected international criminals and terrorists, or an airline's private no-fly list that would contain people who cause a ruckus on flights, drunks, anti-maskers, and so on. Maybe one shared between airlines? I would imagine that second list has grown substantially since 2020 given all the craziness airlines have had to deal with since then.
  - Rhinozz 4y ago
    The Daily Dot article specifies that it's the United States' (the Terrorist Screening Center's).
    - trompetenaccoun 4y ago
      https://www.fbi.gov/investigate/terrorism/tsc https://www.fbi.gov/investigate/terrorism/tsc >[...] the vast majority of people who have disputed travel and appeal to the Department of Homeland Security’s Traveler Redress Inquiry Program are not on the terrorist watchlist. Most people on the terrorist watchlist are still able to fly within the U.S. A very small subset of people on this list are on the “No Fly” list. [...] >The No Fly List is a small subset of the U.S. government Terrorist Screening Database (also known as the terrorist watchlist) that contains the identity information of known or suspected terrorists. This database is maintained by the FBI’s Terrorist Screening Center. So, shouldn't this list be public information anyway? It's not even suspicious people they're watching, by the sound of it the no fly list is only for people they have concrete evidence of terrorist activity for. Imo the public has a right to know those identities.
  - asn0 4y ago
    > the nofly csv is almost 80mb in size and contains over 1.56 million rows of data. this HAS to be the real deal (we later get confirmation that it is indeed a copy of the nofly list from 2019).
    - netsharc 4y ago
      CSV you say? Let's hope Bobby Droptable's cousin Bobby Double Quote Comma-Semicolon don't get in it...
- birdyrooster 4y ago
  You can follow their steps to find this data it’s not that hard. Then do whatever you want with it. Shodan isn’t some mythical tool.
  - NieDzejkob 4y ago
    They say the access got closed before publication.
    - birdyrooster 4y ago
      Yeah I was just pretending I knew what was going on.
- shadowgovt 4y ago
  And as always... Never use production data in the test pipeline. At the very least, I don't think the company was operating like every random developer should have full-access to the no-fly list, which is what they de-facto gave them when they dumped an old copy into the test pipeline.
personjerry 4y ago
> with pretty much no skill required Seriously? I know like none of the tools or terms they used, like wtf is shodan? In general the author doesn't seem to follow the white hat guidelines, and I'd be worried what they've done is quite illegal (possibly on a federal level if the nofly list is so secret)
- jkingsman 4y ago
  maia[0] (it/she pronouns) is almost certainly aware of that this is illegal, and has been indicted by a grand jury for other government hacks. shodan[1] is a search engine that deals in hosts and ip addresses rather than web pages, and is a goldmine for finding everything from exposed ip webcams to jenkins instances. [0]: https://en.wikipedia.org/wiki/Maia_arson_crimew https://en.wikipedia.org/wiki/Maia_arson_crimew [1]: https://www.shodan.io/ https://www.shodan.io/
  - mrsuprawsm 4y ago
    US law is neither a universal law nor an international one. Accessing computer systems owned by a US company based in the US might constitute a violation of US law, but the hacker is based in Switzerland - where US law does not apply. As you can see in the linked Wikipedia article, accessing these systems is probably not illegal in Switzerland, thus, for all intents and purposes, no crime was committed.
    - karaterobot 4y ago
      Here's an indictment from 2019 for similar activities. It's a crime in the U.S., thus prosecutable in the U.S. The question is whether Swiss authorities cooperate, not the jurisdiction. https://www.justice.gov/usao-wdwa/pr/swiss-hacker-indicted-conspiracy-wire-fraud-and-aggravated-identity-theft https://www.justice.gov/usao-wdwa/pr/swiss-hacker-indicted-c...
      - f1refly 4y ago
        The jurisdiction is quite questionable. If someone in north Korea would decide I'm guilty of breaking some bizarre law, I couldn't care less. Why would a Swiss citizen care about what the united states think is a crime?
jkingsman 4y ago
For those unaware, maia is a pretty prolific hacktivist, and it has been indicted by a grand jury for a variety of USA govt penetrations but has USA proceedings on hold until it's extradited, which it's confident won't happen. https://en.wikipedia.org/wiki/Maia_arson_crimew https://en.wikipedia.org/wiki/Maia_arson_crimew
- yellow_lead 4y ago
  so are there any repercussions for hacking US entities from switzerland ? Not that I think there ought to be.
  - nibbleshifter 4y ago
    The Swiss tend to make your life vaguely difficult by confiscating your computers every now and then at the request of the US. You won't be extradited though. The Swiss could maybe prosecute domestically, but its not (currently) in the public interest to do so.
    - sschueller 4y ago
      Even then the sentences are reasonable while in the US you go to jail for just as long as if you killed someone in some cases. The ATT "hacker" got 41 month for guessing URLs. US sentences are insane.
      - notch656c 4y ago
        Isn't weev hiding in Transnistria after he got released on a technicality that allows them to go back after him in another district court or something? I was thinking the courts ruled he got tried in the wrong jurisdiction so prison had to release him. He basically GTFO'd before they had a chance to refile and is hiding in an unrecognized territory inside Moldova.
ericpauley 4y ago
This is clearly on the darker side of gray-hat. Hate to be preachy but anyone seeking to emulate this sort of attack-finding should consider their ethical obligations as a computer scientist and follow best practices for responsible disclosure. It appears this was completely ignored here, including sharing stolen sensitive data of normal people with whoever can plead a case.
- calvinmorrison 4y ago
  Yeah cause we should totally have a top secret no fly list
  - ericpauley 4y ago
    Maybe we should or shouldn't, but the potential victims of this aren't just some greedy corporation. Leaking the no fly list could cause irreparable harm to individuals whose names are on it or even similar, causing discrimination by employers and other organizations.
    - calvinmorrison 4y ago
      Top secret stazi lists should absolutely be shared. It's why we have 'we have right to know' laws, so the government can't just lock people up in a jail and disappear them.
      - ben_w 4y ago
        While this is true, it is also true that many people think "where there's smoke, there's fire". Or, to put it another way, governments can make people disappear by publishing such lists and having the police be busy somewhere else when a mob happens.
      - subroutine 4y ago
        If someone was on a no fly list and they wanted the general public to know, they could just put it out there themselves. No? This seems more likely to be used as a form of public shaming than a way to expose injustice.
googlryas 4y ago
[flagged]
- Waterluvian 4y ago
  I’m curious to learn: if “they” is being added to style guides as a way to refer to a singular human without implying any gender, is “it” the same or is there a somewhat different meaning behind the usage?
  - codetrotter 4y ago
    > if “they” is being added to style guides as a way to refer to a singular human without implying any gender Hasn’t it always been the case that you could use “they” as a way to refer to a singular human without implying any gender? I seem to recall that “they” has been in use in that manner long before non-binary arguments were something I’d heard about.
    - Waterluvian 4y ago
      I feel like I learned that the Chicago style guide, for example, embraced that only a handful of years ago.
      - lamontcg 4y ago
        Which is really just unfucking a mistake that language pedants invented for themselves in the 19th century.
    - mrsuprawsm 4y ago
      >Hasn’t it always been the case that you could use “they” as a way to refer to a singular human without implying any gender? Yes, since Shakespearean times. For example: "I saw someone walking down the street the other day, they were carrying a guitar" -> a normal use of they as the 3rd person singular pronoun.
      - 4y ago
justinpombrio 4y ago
Cached version from the internet archive: http://web.archive.org/web/20230119220130/https://maia.crimew.gay/posts/how-to-hack-an-airline/ http://web.archive.org/web/20230119220130/https://maia.crime...
deleted 4y ago
[deleted]
mananaysiempre 4y ago
From the accompanying (and linked) Daily Dot article[1]: > On the list were several notable figures, including the recently freed Russian arms dealer Viktor Bout, alongside over 16 potential aliases for him. > [...] > Numerous names included aliases that were common misspellings or slightly altered versions of their names. For non-natively-Latin names, the US government is thorough to the point of hilarity in including every possible romanization and misspelling of one, and they list full names not their individual parts so combinatorics ahoy, as well. For example, if you know a bit of any Slavic language written in Cyrillic, browse the Russian sanction lists, it’s going to give you a chuckle. In all seriousness, this actually makes perfect sense given the prospective consumers of the lists may not have any clue about the languages the targeted people speak. It’s just that the article makes 16 aliases sound vaguely sinister, whereas if you’re a Russian—or, for that matter, a Ukrainian or a Belarusian—that’s just a reasonably low estimate for how many romanizations of your name people may think up. (Not that Bout isn’t sinister as hell.) [1] https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotected-server-commuteair/ https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotecte...
- deleted 4y ago
  [deleted]
- Scoundreller 4y ago
  It’s bad in Canada too, where they don’t even use dates of birth, so small children end up caught on a no-fly-list: https://www.cbc.ca/news/canada/london/no-fly-child-redress-1.5791568 https://www.cbc.ca/news/canada/london/no-fly-child-redress-1...
  - interestica 4y ago
    "On Wednesday, Public Safety Minister Bill Blair said in the coming days, certain travellers, like Sebastian Khan, will be able to apply for a Canadian Travel Number, a unique number they will be able to use when they book a flight to distinguish them from people on the list." Soon they'll give everyone a number so they can travel. And print it out in physical form too. And call it a passport. That "solution" seems a bit backwards.
twunde 4y ago
Relatively off-topic, but I absolutely love the 90s/early 2000s vibes I get from this. I can't remember the last time I saw a webring, much less one with animated logos.
- half-kh-hacker 4y ago
  that's my webring :3
  - KyleBerezin 4y ago
    I spent like 30 mins clicking links lol. brings back old memories of a web long gone. oatmealine's site also convinced me to install cowsay
- wedn3sday 4y ago
  This whole thing has made me incredibly happy to see that somewhere, someone out there on the internet is pwning people for stupid vulnerabilities and posting about it on a site that looks like this one. I admit the flashing ACAB really did it for me.
- novok 4y ago
  It's even more entertaining when the people who make it weren't even alive or old enough to understand or have memory of it. It's a bit of a trip for me. Made me realize that 'vintage' basically means to many people 'things that are before my living memory' and it can literally only be 0 to 5 years back before they were born.
  - teaearlgraycold 4y ago
    Anything post WW2 and pre 1995 feels pretty much the same to me.
- agotterer 4y ago
  Also loved the vibe. One of the web ring sites goes to http://cyber.dabamos.de/88x31/ http://cyber.dabamos.de/88x31/ which was an absolute blast from the past!
richwater 4y ago
I love the implication that this random person should be the authority on whether or not I can see the no-fly list.
- belval 4y ago
  I mean she pretty much explains the whole process of getting it. If you're willing to get prosecuted just go get it yourself.
  - Rhinozz 4y ago
    In the Daily Dot article above: > CommuteAir added that the server, which was taken offline prior to publication after being flagged by the Daily Dot, did not expose any customer information based on an initial investigation.
- vunicipna 4y ago
  I wouldn't be surprised if he gets added to the list as well after pulling this stunt.
  - ceejayoz 4y ago
    She's already been indicted on federal charges for hacking. Not being allowed to fly wouldn't be the main issue if she found her way into an American airport or airliner. https://en.wikipedia.org/wiki/Maia_arson_crimew https://en.wikipedia.org/wiki/Maia_arson_crimew
    - vunicipna 4y ago
      Reading that wiki page, it sounds like he's on his way to a long stint in prison, or worse. Wouldn't be surprised if he gets black-bagged now that he's attacking critical national infrastructure and encouraging others to do so.
      - zxexz 4y ago
raydiatian 4y ago
Wow, actual hacker news. For once. Meanwhile, another front page article is some genius asking why there aren’t any cars in 1984.
- deleted 4y ago
  [deleted]
Animats 4y ago
They should just send the list to the New York Times and Fox News.
birdyrooster 4y ago
Maia should try proton mail, it’s fine
- vortegne 4y ago
  maia is Swiss, i don't think protonmail is fine https://techcrunch.com/2021/09/06/protonmail-logged-ip-address-of-french-activist-after-order-by-swiss-authorities/ https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre...
  - birdyrooster 4y ago
    Oh damn lol
culi 4y ago
> Suspected members of the IRA, the Irish paramilitary organization, were also on the list. Oof the international politics always come out in things like this. Twitter also publicizes all of its suspensions and bans. There's a Wikipedia article with a list of all the notable suspensions since 2010. It's interesting to see that, contrary to popular narratives, many of the international groups banned were actually far-left aligned. The list gets really boring the more you scroll down however. The last notable ban was Paul Graham for simply sharing their Mastodon handle. A boring dystopia indeed https://en.wikipedia.org/wiki/Twitter_suspensions https://en.wikipedia.org/wiki/Twitter_suspensions
- zeveb 4y ago
  > The last notable ban was Paul Graham for simply sharing their Mastodon handle. Paul Graham is a man, not a plural entity.
  - 0x44 4y ago
    Singular they predates singular you in the English language by about three hundred years.
    - sanedigital 4y ago
      That doesn’t mean the “they” here isn’t unclear. I wasn’t sure whose Mastodon handle Paul Graham shared. I certainly didn’t think OP meant he shared his own handle.
      - edmundsauto 4y ago
        To be perfectly pedantic, this should only be confusing if referring to the Mastadon employees. Otherwise, if referring to the non-person entity, singular or plural appropriate syntax would be “it”.
    - blast 4y ago
      How do you know that? I know singular they goes a long way back, but this is an extreme claim that I've never heard before.
colanderman 4y ago
Interesting to see ASCII SOH/STX/ETX in the wild! (^A, ^B, ^C in the .RCV files.)
- papercrane 4y ago
  Those are pretty standard ACARS messages. It's the only time I've seen SOH/STX/ETX used, probably because originally in the 70s they were designed to be typed used with Telex machines.
arcastroe 4y ago
This guy is a (hobbyist?) security researcher who responsibly alerts companies of vulnerabilities. However are his actions of downloading the no fly list and offering to share with journalists legal? Or does that cross into overreach and criminal activity?
- munk-a 4y ago
  The fact that they can do it so casually means there's a problem journalists need to know about.
- easrng 4y ago
  it isn't a guy and it uses it/its pronouns.
  - deleted 4y ago
    [deleted]
  - deleted 4y ago
    [deleted]
  - ripdog 4y ago
    What? "It" identifies as an inanimate object? This neopronoun thing really is getting absurd.
    - tbossanova 4y ago
      Absurd? Maybe, but I’d hate a life without any absurdity.
    - tsimionescu 4y ago
      I agree with you on this, but I feel a need to note that "it" refers to non-persons, not just inanimate objects. It's perfectly normal to refer to animals as "it", and it is also quite common to use it for babies (and even more common for fetuses). Not that this makes it any less weird to ask to be referred as "it", mind you.
vunicipna 4y ago
Interesting hack, but this seems quite the brazen confession to a fair number of computer crimes. If I were the author, I'd be worried about getting arrested and potentially extradited for this. Especially as he deliberately downloaded a load of confidential information after gaining access, and then shared it around. He'd be looking at years in prison for this, in the US.
- deleted 4y ago
  [deleted]
- lom 4y ago
  The author is already searched by US authorities for other hacks. See their wiki page here: https://en.wikipedia.org/wiki/Maia_arson_crimew#Indictment https://en.wikipedia.org/wiki/Maia_arson_crimew#Indictment
- helsinki 4y ago
  She’s already potentially facing US extradition from Switzerland for unrelated computers crimes. No idea why she would publicize this exploit.
  - derelicta 4y ago
    Switzerland's federal constitution prohibits extradition of swiss citizens to foreign powers. Now technically, this one amendment can be overriden by a mere act of Parliement, so unless there is a special act I'm not aware of, they are safe.
- IceWreck 4y ago
  She's Swiss and the US already tried to extradite her for posting stuff on git.rip
  - easrng 4y ago
    it ran git.rip
derelicta 4y ago
You never fail to amaze us, Maia
as_bntd 4y ago
I expected to read an article about actually owning an airline in 3 easy steps. :(
- mihaaly 4y ago
  I was disappointed too. I wouldn't know what to do with an airline, I never had one, I wouldn't even know which one I'd like, perhaps Virgin Airlines?, but the thought of having one was exciting still.
- twelve40 4y ago
  I too was at first annoyed by a bit of an overhyping in the title and the overall style as well, until I remembered how it felt when you discovered something yourself, or even just read a good clever report from someone else. You get this rush that this is the coolest craftiest thing in the world.
  - as_bntd 4y ago
    You are right! That's how this reads.
- zootboy 4y ago
  Indeed, the de-editorializing of the title made the interpretation more ambiguous. I'd actually prefer the real title ("how to completely own an airline...") or a more clear adjustment ("how to hack an airline...").
- jonp888 4y ago
  I guess we do need the verb 'pwn' after all :D
  - interestica 4y ago
    you're....actually right. I totally misread this headline. There were no context clues to help with the reading.
- kab0b 4y ago
tastysandwich 4y ago
As a software engineer even I sometimes can't help romanticising hacking in my imagination. But so many times it turns out to be just like some company left the front gate wide open and the "hacker" walked in and took a look around. Eg when an airline had a public API where you could get someone's passport number and details just from their boarding pass https://mango.pdf.zone/finding-former-australian-prime-minister-tony-abbotts-passport-number-on-instagram https://mango.pdf.zone/finding-former-australian-prime-minis...
- c7DJTLrn 4y ago
  Check this out if you haven't heard of it: https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet
- chaboud 4y ago
  Private keys checked into code? Password salts that were identical for the entire set? "Random" initialization vectors always created from the same prng seed? Without coders like these, hackers would really have to work for it. (And, yes, I've encountered all of these in my career.)
  - deleted 4y ago
    [deleted]
- gggggg5 4y ago
  Since when are passport numbers supposed to be sensitive information? This isn't something you could use for identity fraud in any normal circumstances.
  - sverhagen 4y ago
    Don't all sorts of person-related details come in handy to stage a social engineering hack? Maybe a caller could demonstrate legitimacy by coughing up a passport number. At this point, it may impress me more than someone having found my SSN (_love you for that, Equifax_). Yet, SSN is still by many institutions considered something that should be stored in the vault.
ohbleek 4y ago
I had always assumed that the “no fly” list was a phrase and that it didn’t refer to an actual list, but rather a database with more detailed information than a “can they fly?” Column with a Y/N entry. In pharmacy we have a database we have to access when we suspect there is abuse, fraud, or diversion of controlled substances. The database is regularly updated with current information about prescriptions that were dispensed including location, prescribing physician, etc. I had always assumed the “no fly” list would be something similar. Now that I think about it though, that wouldn’t be efficient or useful at all. It would make sense for it to be much more simple.
- twelve40 4y ago
  yeah, surprised as well. In finance, there is ofac for people forbidden from moving money, but it's also typically used as a service/db instead of passing around csv files to everyone. Very bizarre.
  - mproud 4y ago
    Could this have been an export given to someone upon request? Or maybe served as backup?
  - mrcode007 4y ago
    Not sure what service you’re referring to but the file is here: https://www.treasury.gov/ofac/downloads/sdnlist.txt https://www.treasury.gov/ofac/downloads/sdnlist.txt
    - from 4y ago
      There are various aggregators who combine this list and a bunch of other sanctions/related lists like the BIS Entity List which is probably what he was referring to.
    - twelve40 4y ago
      Have you ever witnessed this file being used by companies moving money stored in S3 as "shitlist2019.txt" for screening incoming transactions in production? Because that's what the article is alluding to.
BMorearty 4y ago
`cat` aliased to `bat`, nice. :) I really like bat.
patientplatypus 4y ago
[dead]
patientplatypus 4y ago
[dead]
c1ccccc1 4y ago
After seeing the title but before clicking on the article, I thought this would be about a legal hack rather than a security hole. More specifically, creating the minimum possible corporation that qualifies as an airline (so that you literally own an airline), and then saying to the government, "hey, we need the nofly list, we're an airline, see?". The actual hack sounds way easier, to be sure, but I still like my version the best.
- Scalene2 4y ago
  I came here to make the same comment. Also, I now know that .gay is a tld and I'm trying to figure out how to take advantage, registration isn't terribly cheap, but the only restrictions are ones that don't apply to any of my ideas.
  - yamtaddle 4y ago
    Oh man. 1890s.gay would be a good one. [EDIT] https://en.wikipedia.org/wiki/Gay_Nineties https://en.wikipedia.org/wiki/Gay_Nineties
    - Eleison23 4y ago
      [dead]
- deleted 4y ago
  [deleted]
stonepresto 4y ago
For reference, it/she [1] previously was named Tillie Kottman [2] and was indicted by the US in 2021 [3]. [1] https://maia.crimew.gay/ https://maia.crimew.gay/ [2] https://en.wikipedia.org/wiki/Maia_arson_crimew https://en.wikipedia.org/wiki/Maia_arson_crimew [3] https://www.justice.gov/usao-wdwa/pr/swiss-hacker-indicted-conspiracy-wire-fraud-and-aggravated-identity-theft https://www.justice.gov/usao-wdwa/pr/swiss-hacker-indicted-c...
- deleted 4y ago
  [deleted]
- deleted 4y ago
  [deleted]
shadowgovt 4y ago
Apropos of nothing, I also just really appreciate crimew.gay's aesthetic. This website is what me from 1993 thought a hacker's website would look like. A nod of respect to them for kickin' it old-school.
- deleted 4y ago
  [deleted]
- neilk 4y ago
  And they were born in 1999. We are dealing with a unique mind here.
  - KyeRussell 4y ago
    In reality it’s like a kid listening to the beatles, but with computers. I’m a younger millennial that grew up entrenched in ‘hacker culture’ and even then there was a clear fetishisation of the good ol’ days.
    - japanman425 4y ago
      Like people using eMacs or vim these days
      - veltas 4y ago
        Not to start a flame war, but no, people use vim and Emacs because they're productive with them. I've certainly tried alternatives like vscode seriously and find I prefer vim.
        vanderZwan 4y ago
        Arguably you need a bit of fetishization to get started with them though.
        samastur 4y ago
ec109685 4y ago
While VPN's shouldn't be the only device, it seems like that should be part of any competent security posture. E.g. Jenkins should only be accessible from known VPN endpoint IP addresses. Administrative IAM's should be IP restricted as well: https://aws.amazon.com/premiumsupport/knowledge-center/iam-restrict-calls-ip-addresses/ https://aws.amazon.com/premiumsupport/knowledge-center/iam-r...
- gcbirzan 4y ago
  And the s3 buckets/dynamodb/whatever other data you store should be vpc restricted. Ours are like this by default, for exceptions (like aws services that run in some internal vpc that's not exposed) you can make an exception per role.
JoeyBananas 4y ago
[flagged]
- KyleBerezin 4y ago
  look at the name of this site, then look at her, then look at the name of the site again
  - JoeyBananas 4y ago
    It doesn't say "Cracker news". Or "Brazen idiot news."
- taylorportman 4y ago
  or honeypot
089513646753 4y ago
A
monkeya1 4y ago
Hey all im new. Didnt expect so many of yall to actively check & comment on this one app
- mistersys 4y ago
  https://news.ycombinator.com/item?id=34446673 https://news.ycombinator.com/item?id=34446673
mkl95 4y ago
TIL https://en.wikipedia.org/wiki/Maia_arson_crimew https://en.wikipedia.org/wiki/Maia_arson_crimew > In March 2021, crimew was indicted by a grand jury in the United States on criminal charges related to her alleged hacking activity between 2019 and 2021. The charges were unrelated to the hack of Verkada. Her home and her parents' home were raided by the Swiss police at the request of United States authorities, and her electronic devices were seized. People used the hashtag "#freetillie" to express support for her in the aftermath of the raid, and the Swiss magazine Republik compared her to Jeremy Hammond and Aaron Swartz.
- jcq3 4y ago
  How such supposedly talented hacker end up to be doxxed? It's not that hard to become 99.99% anonymous online...
  - implements 4y ago
    Technically easy, operationally virtually impossible - everyone will slip up eventually. Also, the need for recognition often drives any human endeavour - and that leads hackers, criminals, etc to boast of their exploits to at least someone … who might be under observation, or under pressure to give up information to escape severe punishment for their own activities.
    - jcq3 4y ago
      Prolly the need for recognition because if you hack from public wifi with tails tor mullvad, brand new laptop with specific hardware and so on I don't see how you can get caught up
      - deleted 4y ago
        [deleted]
      - cduzz 4y ago
        Don't forget the time machine to go back to warn past self about the one time they slip up just prior to when they decide to really go all in on the haxoring. Some parts of the internet never forget, and the anonymous graph is only anonymous if all of it is anonymous. 99.999% isn't good enough.
INTPenis 4y ago
Hah shodan, the title made me think this was about starting a dummy airline and getting the nofly list from the government.
- KyeRussell 4y ago
  Same. Sorely disappointed.
jhoelzel 4y ago
And this kids, is why you always need 2FA and you need to whitelist your build servers with ipranges. Yes Like the 90s.
dandongus 4y ago
Surprised to see this guy wasn't already in prison due to his previous antics, and it's too bad he didn't responsibly report this issue through the proper channels. Everyone's luck is bound to run out at some point.
- kaapipo 4y ago
  *her
pifm_guy 4y ago
Oh it must be nice to be able to do things like this, while only keeping an eye out for the laws of your own country, safe in the knowledge that your government won't extradite you for breaking the laws of another country.
exabrial 4y ago
The TSA no fly list is a blatant violation of the Constitution: for the government to be able to remove a right, you must be convicted at trial. The fact it still exists at all is incredible, but a disturbing precedent.
Symbiote 4y ago
Was there any penalty for CommuteAir or their employees for negligently distributing the list?
flawn 4y ago
That's the Lawnchair app founder LOL
IYasha 4y ago
"That would be the gayest site I've ever seen" :D Seriously, though, is the list on the github yet?
curiousllama 4y ago
Hack aside, there's something poetic about leaking the no fly list from an email address called "nofly@crimew.gay"
dboreham 4y ago
The headline made me think this was about a scheme where you register as an airline, just to get access to the list. I mean, how many planes do you need to own to be an airline?
aj7 4y ago
https://www.egattorneys.com/federal-computer-hacking https://www.egattorneys.com/federal-computer-hacking See in particular the broad definition of “protected computer.”
computerfriend 4y ago
This would be a good candidate for a k-anonymous API where you can query if a specified full name, DoB, etc., is in the list without divulging the list or the request.
LoganDark 4y ago
This is gonna be random but I love people just shamelessly being themselves on the Internet. This person is literally a kitty cat playing around and I find that adorable~ Oh, also secure your Jenkins servers.
Pomelolo 4y ago
[flagged]
hattmall 4y ago
Why is the no fly list sensitive information?
Slava_Propanei 4y ago
[dead]
ctb9 4y ago
assuming i was willing to ever interact with a SOAP api in my life which i sure as hell am not ^^^ this killed me. i'm sure everyone who has ever interacted with a SOAP api feels the same. god bless this tiny kitten/person/hacktivist, the world needs more of this energy.

1028 points by half-kh-hacker 4y ago

I'm not confident that is it safe to link to the site operated by such hacktivist. I prefer to see link for news article on HN headline, rather than criminal hacker's website itself, but I don't know rules.

thrtythreeforty 4y ago

Headline buries the real lede a bit in my opinion; the author has gotten a snapshot of the no-fly list from 2019. Presumably the system under attack processes more up-to-date versions of it regularly. Corresponding news story: https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotected-server-commuteair/ https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotecte...

racnid 4y ago
Basically any air charter service (no matter how small) will have access to the no fly list. It's honestly surprising that it's not up to date online within minutes.
- DocTomoe 4y ago
  If I was the US government, I would add some fake but legitimate-looking IDs in such lists, different ones for every airline I send the list to, so I can identify who leaked the list ex post facto, and come down with God's Wrath on any airline that leaked theirs. But then, I am not a Bond-esque criminal organization bent for world domination.
  - zztop44 4y ago
    This is called “seeding” a list and is standard practice for data brokers. But maybe that’s a sign they’re Bond-esque criminal organizations…
    - philjohn 4y ago
      Yup - they're the people ACTUALLY selling your data (and often for pennies)
karlkatzke 4y ago
Also seems to have gotten a crew list from the CommutAir’s CASS or possibly from other airlines as part of the shared deadheading crew list, which includes crew addresses and employment information. There were also prod AWS credentials in the files exposed in Jenkins.
ryandrake 4y ago
I wonder which no-fly list it is. Is it a government no-fly list that would contain suspected international criminals and terrorists, or an airline's private no-fly list that would contain people who cause a ruckus on flights, drunks, anti-maskers, and so on. Maybe one shared between airlines? I would imagine that second list has grown substantially since 2020 given all the craziness airlines have had to deal with since then.
- Rhinozz 4y ago
  The Daily Dot article specifies that it's the United States' (the Terrorist Screening Center's).
  - trompetenaccoun 4y ago
    https://www.fbi.gov/investigate/terrorism/tsc https://www.fbi.gov/investigate/terrorism/tsc >[...] the vast majority of people who have disputed travel and appeal to the Department of Homeland Security’s Traveler Redress Inquiry Program are not on the terrorist watchlist. Most people on the terrorist watchlist are still able to fly within the U.S. A very small subset of people on this list are on the “No Fly” list. [...] >The No Fly List is a small subset of the U.S. government Terrorist Screening Database (also known as the terrorist watchlist) that contains the identity information of known or suspected terrorists. This database is maintained by the FBI’s Terrorist Screening Center. So, shouldn't this list be public information anyway? It's not even suspicious people they're watching, by the sound of it the no fly list is only for people they have concrete evidence of terrorist activity for. Imo the public has a right to know those identities.
- asn0 4y ago
  > the nofly csv is almost 80mb in size and contains over 1.56 million rows of data. this HAS to be the real deal (we later get confirmation that it is indeed a copy of the nofly list from 2019).
  - netsharc 4y ago
    CSV you say? Let's hope Bobby Droptable's cousin Bobby Double Quote Comma-Semicolon don't get in it...
birdyrooster 4y ago
You can follow their steps to find this data it’s not that hard. Then do whatever you want with it. Shodan isn’t some mythical tool.
- NieDzejkob 4y ago
  They say the access got closed before publication.
  - birdyrooster 4y ago
    Yeah I was just pretending I knew what was going on.
shadowgovt 4y ago
And as always... Never use production data in the test pipeline. At the very least, I don't think the company was operating like every random developer should have full-access to the no-fly list, which is what they de-facto gave them when they dumped an old copy into the test pipeline.

personjerry 4y ago

> with pretty much no skill required Seriously? I know like none of the tools or terms they used, like wtf is shodan? In general the author doesn't seem to follow the white hat guidelines, and I'd be worried what they've done is quite illegal (possibly on a federal level if the nofly list is so secret)

jkingsman 4y ago
maia[0] (it/she pronouns) is almost certainly aware of that this is illegal, and has been indicted by a grand jury for other government hacks. shodan[1] is a search engine that deals in hosts and ip addresses rather than web pages, and is a goldmine for finding everything from exposed ip webcams to jenkins instances. [0]: https://en.wikipedia.org/wiki/Maia_arson_crimew https://en.wikipedia.org/wiki/Maia_arson_crimew [1]: https://www.shodan.io/ https://www.shodan.io/
- mrsuprawsm 4y ago
  US law is neither a universal law nor an international one. Accessing computer systems owned by a US company based in the US might constitute a violation of US law, but the hacker is based in Switzerland - where US law does not apply. As you can see in the linked Wikipedia article, accessing these systems is probably not illegal in Switzerland, thus, for all intents and purposes, no crime was committed.
  - karaterobot 4y ago
    Here's an indictment from 2019 for similar activities. It's a crime in the U.S., thus prosecutable in the U.S. The question is whether Swiss authorities cooperate, not the jurisdiction. https://www.justice.gov/usao-wdwa/pr/swiss-hacker-indicted-conspiracy-wire-fraud-and-aggravated-identity-theft https://www.justice.gov/usao-wdwa/pr/swiss-hacker-indicted-c...
    - f1refly 4y ago
      The jurisdiction is quite questionable. If someone in north Korea would decide I'm guilty of breaking some bizarre law, I couldn't care less. Why would a Swiss citizen care about what the united states think is a crime?

jkingsman 4y ago

For those unaware, maia is a pretty prolific hacktivist, and it has been indicted by a grand jury for a variety of USA govt penetrations but has USA proceedings on hold until it's extradited, which it's confident won't happen. https://en.wikipedia.org/wiki/Maia_arson_crimew https://en.wikipedia.org/wiki/Maia_arson_crimew

yellow_lead 4y ago
so are there any repercussions for hacking US entities from switzerland ? Not that I think there ought to be.
- nibbleshifter 4y ago
  The Swiss tend to make your life vaguely difficult by confiscating your computers every now and then at the request of the US. You won't be extradited though. The Swiss could maybe prosecute domestically, but its not (currently) in the public interest to do so.
  - sschueller 4y ago
    Even then the sentences are reasonable while in the US you go to jail for just as long as if you killed someone in some cases. The ATT "hacker" got 41 month for guessing URLs. US sentences are insane.
    - notch656c 4y ago
      Isn't weev hiding in Transnistria after he got released on a technicality that allows them to go back after him in another district court or something? I was thinking the courts ruled he got tried in the wrong jurisdiction so prison had to release him. He basically GTFO'd before they had a chance to refile and is hiding in an unrecognized territory inside Moldova.

ericpauley 4y ago

This is clearly on the darker side of gray-hat. Hate to be preachy but anyone seeking to emulate this sort of attack-finding should consider their ethical obligations as a computer scientist and follow best practices for responsible disclosure. It appears this was completely ignored here, including sharing stolen sensitive data of normal people with whoever can plead a case.

calvinmorrison 4y ago
Yeah cause we should totally have a top secret no fly list
- ericpauley 4y ago
  Maybe we should or shouldn't, but the potential victims of this aren't just some greedy corporation. Leaking the no fly list could cause irreparable harm to individuals whose names are on it or even similar, causing discrimination by employers and other organizations.
  - calvinmorrison 4y ago
    Top secret stazi lists should absolutely be shared. It's why we have 'we have right to know' laws, so the government can't just lock people up in a jail and disappear them.
    - ben_w 4y ago
      While this is true, it is also true that many people think "where there's smoke, there's fire". Or, to put it another way, governments can make people disappear by publishing such lists and having the police be busy somewhere else when a mob happens.
    - subroutine 4y ago
      If someone was on a no fly list and they wanted the general public to know, they could just put it out there themselves. No? This seems more likely to be used as a form of public shaming than a way to expose injustice.

googlryas 4y ago

[flagged]

Waterluvian 4y ago
I’m curious to learn: if “they” is being added to style guides as a way to refer to a singular human without implying any gender, is “it” the same or is there a somewhat different meaning behind the usage?
- codetrotter 4y ago
  > if “they” is being added to style guides as a way to refer to a singular human without implying any gender Hasn’t it always been the case that you could use “they” as a way to refer to a singular human without implying any gender? I seem to recall that “they” has been in use in that manner long before non-binary arguments were something I’d heard about.
  - Waterluvian 4y ago
    I feel like I learned that the Chicago style guide, for example, embraced that only a handful of years ago.
    - lamontcg 4y ago
      Which is really just unfucking a mistake that language pedants invented for themselves in the 19th century.
  - mrsuprawsm 4y ago
    >Hasn’t it always been the case that you could use “they” as a way to refer to a singular human without implying any gender? Yes, since Shakespearean times. For example: "I saw someone walking down the street the other day, they were carrying a guitar" -> a normal use of they as the 3rd person singular pronoun.
    - 4y ago

justinpombrio 4y ago

Cached version from the internet archive: http://web.archive.org/web/20230119220130/https://maia.crimew.gay/posts/how-to-hack-an-airline/ http://web.archive.org/web/20230119220130/https://maia.crime...

deleted 4y ago

[deleted]

mananaysiempre 4y ago

From the accompanying (and linked) Daily Dot article[1]: > On the list were several notable figures, including the recently freed Russian arms dealer Viktor Bout, alongside over 16 potential aliases for him. > [...] > Numerous names included aliases that were common misspellings or slightly altered versions of their names. For non-natively-Latin names, the US government is thorough to the point of hilarity in including every possible romanization and misspelling of one, and they list full names not their individual parts so combinatorics ahoy, as well. For example, if you know a bit of any Slavic language written in Cyrillic, browse the Russian sanction lists, it’s going to give you a chuckle. In all seriousness, this actually makes perfect sense given the prospective consumers of the lists may not have any clue about the languages the targeted people speak. It’s just that the article makes 16 aliases sound vaguely sinister, whereas if you’re a Russian—or, for that matter, a Ukrainian or a Belarusian—that’s just a reasonably low estimate for how many romanizations of your name people may think up. (Not that Bout isn’t sinister as hell.) [1] https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotected-server-commuteair/ https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotecte...

deleted 4y ago
[deleted]
Scoundreller 4y ago
It’s bad in Canada too, where they don’t even use dates of birth, so small children end up caught on a no-fly-list: https://www.cbc.ca/news/canada/london/no-fly-child-redress-1.5791568 https://www.cbc.ca/news/canada/london/no-fly-child-redress-1...
- interestica 4y ago
  "On Wednesday, Public Safety Minister Bill Blair said in the coming days, certain travellers, like Sebastian Khan, will be able to apply for a Canadian Travel Number, a unique number they will be able to use when they book a flight to distinguish them from people on the list." Soon they'll give everyone a number so they can travel. And print it out in physical form too. And call it a passport. That "solution" seems a bit backwards.

twunde 4y ago

Relatively off-topic, but I absolutely love the 90s/early 2000s vibes I get from this. I can't remember the last time I saw a webring, much less one with animated logos.

half-kh-hacker 4y ago
that's my webring :3
- KyleBerezin 4y ago
  I spent like 30 mins clicking links lol. brings back old memories of a web long gone. oatmealine's site also convinced me to install cowsay
wedn3sday 4y ago
This whole thing has made me incredibly happy to see that somewhere, someone out there on the internet is pwning people for stupid vulnerabilities and posting about it on a site that looks like this one. I admit the flashing ACAB really did it for me.
novok 4y ago
It's even more entertaining when the people who make it weren't even alive or old enough to understand or have memory of it. It's a bit of a trip for me. Made me realize that 'vintage' basically means to many people 'things that are before my living memory' and it can literally only be 0 to 5 years back before they were born.
- teaearlgraycold 4y ago
  Anything post WW2 and pre 1995 feels pretty much the same to me.
agotterer 4y ago
Also loved the vibe. One of the web ring sites goes to http://cyber.dabamos.de/88x31/ http://cyber.dabamos.de/88x31/ which was an absolute blast from the past!

richwater 4y ago

I love the implication that this random person should be the authority on whether or not I can see the no-fly list.

belval 4y ago
I mean she pretty much explains the whole process of getting it. If you're willing to get prosecuted just go get it yourself.
- Rhinozz 4y ago
  In the Daily Dot article above: > CommuteAir added that the server, which was taken offline prior to publication after being flagged by the Daily Dot, did not expose any customer information based on an initial investigation.
vunicipna 4y ago
I wouldn't be surprised if he gets added to the list as well after pulling this stunt.
- ceejayoz 4y ago
  She's already been indicted on federal charges for hacking. Not being allowed to fly wouldn't be the main issue if she found her way into an American airport or airliner. https://en.wikipedia.org/wiki/Maia_arson_crimew https://en.wikipedia.org/wiki/Maia_arson_crimew
  - vunicipna 4y ago
    Reading that wiki page, it sounds like he's on his way to a long stint in prison, or worse. Wouldn't be surprised if he gets black-bagged now that he's attacking critical national infrastructure and encouraging others to do so.
    - zxexz 4y ago

raydiatian 4y ago

Wow, actual hacker news. For once. Meanwhile, another front page article is some genius asking why there aren’t any cars in 1984.

deleted 4y ago
[deleted]

Animats 4y ago

They should just send the list to the New York Times and Fox News.

birdyrooster 4y ago

Maia should try proton mail, it’s fine

vortegne 4y ago
maia is Swiss, i don't think protonmail is fine https://techcrunch.com/2021/09/06/protonmail-logged-ip-address-of-french-activist-after-order-by-swiss-authorities/ https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre...
- birdyrooster 4y ago
  Oh damn lol

culi 4y ago

> Suspected members of the IRA, the Irish paramilitary organization, were also on the list. Oof the international politics always come out in things like this. Twitter also publicizes all of its suspensions and bans. There's a Wikipedia article with a list of all the notable suspensions since 2010. It's interesting to see that, contrary to popular narratives, many of the international groups banned were actually far-left aligned. The list gets really boring the more you scroll down however. The last notable ban was Paul Graham for simply sharing their Mastodon handle. A boring dystopia indeed https://en.wikipedia.org/wiki/Twitter_suspensions https://en.wikipedia.org/wiki/Twitter_suspensions

zeveb 4y ago
> The last notable ban was Paul Graham for simply sharing their Mastodon handle. Paul Graham is a man, not a plural entity.
- 0x44 4y ago
  Singular they predates singular you in the English language by about three hundred years.
  - sanedigital 4y ago
    That doesn’t mean the “they” here isn’t unclear. I wasn’t sure whose Mastodon handle Paul Graham shared. I certainly didn’t think OP meant he shared his own handle.
    - edmundsauto 4y ago
      To be perfectly pedantic, this should only be confusing if referring to the Mastadon employees. Otherwise, if referring to the non-person entity, singular or plural appropriate syntax would be “it”.
  - blast 4y ago
    How do you know that? I know singular they goes a long way back, but this is an extreme claim that I've never heard before.

colanderman 4y ago

Interesting to see ASCII SOH/STX/ETX in the wild! (^A, ^B, ^C in the .RCV files.)

papercrane 4y ago
Those are pretty standard ACARS messages. It's the only time I've seen SOH/STX/ETX used, probably because originally in the 70s they were designed to be typed used with Telex machines.

arcastroe 4y ago

This guy is a (hobbyist?) security researcher who responsibly alerts companies of vulnerabilities. However are his actions of downloading the no fly list and offering to share with journalists legal? Or does that cross into overreach and criminal activity?

munk-a 4y ago
The fact that they can do it so casually means there's a problem journalists need to know about.
easrng 4y ago
it isn't a guy and it uses it/its pronouns.
- deleted 4y ago
  [deleted]
- deleted 4y ago
  [deleted]
- ripdog 4y ago
  What? "It" identifies as an inanimate object? This neopronoun thing really is getting absurd.
  - tbossanova 4y ago
    Absurd? Maybe, but I’d hate a life without any absurdity.
  - tsimionescu 4y ago
    I agree with you on this, but I feel a need to note that "it" refers to non-persons, not just inanimate objects. It's perfectly normal to refer to animals as "it", and it is also quite common to use it for babies (and even more common for fetuses). Not that this makes it any less weird to ask to be referred as "it", mind you.

vunicipna 4y ago

Interesting hack, but this seems quite the brazen confession to a fair number of computer crimes. If I were the author, I'd be worried about getting arrested and potentially extradited for this. Especially as he deliberately downloaded a load of confidential information after gaining access, and then shared it around. He'd be looking at years in prison for this, in the US.

deleted 4y ago
[deleted]
lom 4y ago
The author is already searched by US authorities for other hacks. See their wiki page here: https://en.wikipedia.org/wiki/Maia_arson_crimew#Indictment https://en.wikipedia.org/wiki/Maia_arson_crimew#Indictment
helsinki 4y ago
She’s already potentially facing US extradition from Switzerland for unrelated computers crimes. No idea why she would publicize this exploit.
- derelicta 4y ago
  Switzerland's federal constitution prohibits extradition of swiss citizens to foreign powers. Now technically, this one amendment can be overriden by a mere act of Parliement, so unless there is a special act I'm not aware of, they are safe.
IceWreck 4y ago
She's Swiss and the US already tried to extradite her for posting stuff on git.rip
- easrng 4y ago
  it ran git.rip

derelicta 4y ago

You never fail to amaze us, Maia

as_bntd 4y ago

I expected to read an article about actually owning an airline in 3 easy steps. :(

mihaaly 4y ago
I was disappointed too. I wouldn't know what to do with an airline, I never had one, I wouldn't even know which one I'd like, perhaps Virgin Airlines?, but the thought of having one was exciting still.
twelve40 4y ago
I too was at first annoyed by a bit of an overhyping in the title and the overall style as well, until I remembered how it felt when you discovered something yourself, or even just read a good clever report from someone else. You get this rush that this is the coolest craftiest thing in the world.
- as_bntd 4y ago
  You are right! That's how this reads.
zootboy 4y ago
Indeed, the de-editorializing of the title made the interpretation more ambiguous. I'd actually prefer the real title ("how to completely own an airline...") or a more clear adjustment ("how to hack an airline...").
jonp888 4y ago
I guess we do need the verb 'pwn' after all :D
- interestica 4y ago
  you're....actually right. I totally misread this headline. There were no context clues to help with the reading.
kab0b 4y ago

tastysandwich 4y ago

As a software engineer even I sometimes can't help romanticising hacking in my imagination. But so many times it turns out to be just like some company left the front gate wide open and the "hacker" walked in and took a look around. Eg when an airline had a public API where you could get someone's passport number and details just from their boarding pass https://mango.pdf.zone/finding-former-australian-prime-minister-tony-abbotts-passport-number-on-instagram https://mango.pdf.zone/finding-former-australian-prime-minis...

c7DJTLrn 4y ago
Check this out if you haven't heard of it: https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet
chaboud 4y ago
Private keys checked into code? Password salts that were identical for the entire set? "Random" initialization vectors always created from the same prng seed? Without coders like these, hackers would really have to work for it. (And, yes, I've encountered all of these in my career.)
- deleted 4y ago
  [deleted]
gggggg5 4y ago
Since when are passport numbers supposed to be sensitive information? This isn't something you could use for identity fraud in any normal circumstances.
- sverhagen 4y ago
  Don't all sorts of person-related details come in handy to stage a social engineering hack? Maybe a caller could demonstrate legitimacy by coughing up a passport number. At this point, it may impress me more than someone having found my SSN (_love you for that, Equifax_). Yet, SSN is still by many institutions considered something that should be stored in the vault.

ohbleek 4y ago

I had always assumed that the “no fly” list was a phrase and that it didn’t refer to an actual list, but rather a database with more detailed information than a “can they fly?” Column with a Y/N entry. In pharmacy we have a database we have to access when we suspect there is abuse, fraud, or diversion of controlled substances. The database is regularly updated with current information about prescriptions that were dispensed including location, prescribing physician, etc. I had always assumed the “no fly” list would be something similar. Now that I think about it though, that wouldn’t be efficient or useful at all. It would make sense for it to be much more simple.

twelve40 4y ago
yeah, surprised as well. In finance, there is ofac for people forbidden from moving money, but it's also typically used as a service/db instead of passing around csv files to everyone. Very bizarre.
- mproud 4y ago
  Could this have been an export given to someone upon request? Or maybe served as backup?
- mrcode007 4y ago
  Not sure what service you’re referring to but the file is here: https://www.treasury.gov/ofac/downloads/sdnlist.txt https://www.treasury.gov/ofac/downloads/sdnlist.txt
  - from 4y ago
    There are various aggregators who combine this list and a bunch of other sanctions/related lists like the BIS Entity List which is probably what he was referring to.
  - twelve40 4y ago
    Have you ever witnessed this file being used by companies moving money stored in S3 as "shitlist2019.txt" for screening incoming transactions in production? Because that's what the article is alluding to.

BMorearty 4y ago

`cat` aliased to `bat`, nice. :) I really like bat.

patientplatypus 4y ago

[dead]

patientplatypus 4y ago

[dead]

c1ccccc1 4y ago

After seeing the title but before clicking on the article, I thought this would be about a legal hack rather than a security hole. More specifically, creating the minimum possible corporation that qualifies as an airline (so that you literally own an airline), and then saying to the government, "hey, we need the nofly list, we're an airline, see?". The actual hack sounds way easier, to be sure, but I still like my version the best.

Scalene2 4y ago
I came here to make the same comment. Also, I now know that .gay is a tld and I'm trying to figure out how to take advantage, registration isn't terribly cheap, but the only restrictions are ones that don't apply to any of my ideas.
- yamtaddle 4y ago
  Oh man. 1890s.gay would be a good one. [EDIT] https://en.wikipedia.org/wiki/Gay_Nineties https://en.wikipedia.org/wiki/Gay_Nineties
  - Eleison23 4y ago
    [dead]
deleted 4y ago
[deleted]

stonepresto 4y ago

For reference, it/she [1] previously was named Tillie Kottman [2] and was indicted by the US in 2021 [3]. [1] https://maia.crimew.gay/ https://maia.crimew.gay/ [2] https://en.wikipedia.org/wiki/Maia_arson_crimew https://en.wikipedia.org/wiki/Maia_arson_crimew [3] https://www.justice.gov/usao-wdwa/pr/swiss-hacker-indicted-conspiracy-wire-fraud-and-aggravated-identity-theft https://www.justice.gov/usao-wdwa/pr/swiss-hacker-indicted-c...

deleted 4y ago
[deleted]
deleted 4y ago
[deleted]

shadowgovt 4y ago

Apropos of nothing, I also just really appreciate crimew.gay's aesthetic. This website is what me from 1993 thought a hacker's website would look like. A nod of respect to them for kickin' it old-school.

deleted 4y ago
[deleted]
neilk 4y ago
And they were born in 1999. We are dealing with a unique mind here.
- KyeRussell 4y ago
  In reality it’s like a kid listening to the beatles, but with computers. I’m a younger millennial that grew up entrenched in ‘hacker culture’ and even then there was a clear fetishisation of the good ol’ days.
  - japanman425 4y ago
    Like people using eMacs or vim these days
    - veltas 4y ago
      Not to start a flame war, but no, people use vim and Emacs because they're productive with them. I've certainly tried alternatives like vscode seriously and find I prefer vim.
      - vanderZwan 4y ago
        Arguably you need a bit of fetishization to get started with them though.
        samastur 4y ago

ec109685 4y ago

While VPN's shouldn't be the only device, it seems like that should be part of any competent security posture. E.g. Jenkins should only be accessible from known VPN endpoint IP addresses. Administrative IAM's should be IP restricted as well: https://aws.amazon.com/premiumsupport/knowledge-center/iam-restrict-calls-ip-addresses/ https://aws.amazon.com/premiumsupport/knowledge-center/iam-r...

gcbirzan 4y ago
And the s3 buckets/dynamodb/whatever other data you store should be vpc restricted. Ours are like this by default, for exceptions (like aws services that run in some internal vpc that's not exposed) you can make an exception per role.

JoeyBananas 4y ago

[flagged]

KyleBerezin 4y ago
look at the name of this site, then look at her, then look at the name of the site again
- JoeyBananas 4y ago
  It doesn't say "Cracker news". Or "Brazen idiot news."
taylorportman 4y ago
or honeypot

089513646753 4y ago

monkeya1 4y ago

Hey all im new. Didnt expect so many of yall to actively check & comment on this one app

mistersys 4y ago
https://news.ycombinator.com/item?id=34446673 https://news.ycombinator.com/item?id=34446673

mkl95 4y ago

TIL https://en.wikipedia.org/wiki/Maia_arson_crimew https://en.wikipedia.org/wiki/Maia_arson_crimew > In March 2021, crimew was indicted by a grand jury in the United States on criminal charges related to her alleged hacking activity between 2019 and 2021. The charges were unrelated to the hack of Verkada. Her home and her parents' home were raided by the Swiss police at the request of United States authorities, and her electronic devices were seized. People used the hashtag "#freetillie" to express support for her in the aftermath of the raid, and the Swiss magazine Republik compared her to Jeremy Hammond and Aaron Swartz.

jcq3 4y ago
How such supposedly talented hacker end up to be doxxed? It's not that hard to become 99.99% anonymous online...
- implements 4y ago
  Technically easy, operationally virtually impossible - everyone will slip up eventually. Also, the need for recognition often drives any human endeavour - and that leads hackers, criminals, etc to boast of their exploits to at least someone … who might be under observation, or under pressure to give up information to escape severe punishment for their own activities.
  - jcq3 4y ago
    Prolly the need for recognition because if you hack from public wifi with tails tor mullvad, brand new laptop with specific hardware and so on I don't see how you can get caught up
    - deleted 4y ago
      [deleted]
    - cduzz 4y ago
      Don't forget the time machine to go back to warn past self about the one time they slip up just prior to when they decide to really go all in on the haxoring. Some parts of the internet never forget, and the anonymous graph is only anonymous if all of it is anonymous. 99.999% isn't good enough.

INTPenis 4y ago

Hah shodan, the title made me think this was about starting a dummy airline and getting the nofly list from the government.

KyeRussell 4y ago
Same. Sorely disappointed.

jhoelzel 4y ago

And this kids, is why you always need 2FA and you need to whitelist your build servers with ipranges. Yes Like the 90s.

dandongus 4y ago

Surprised to see this guy wasn't already in prison due to his previous antics, and it's too bad he didn't responsibly report this issue through the proper channels. Everyone's luck is bound to run out at some point.

kaapipo 4y ago
*her

pifm_guy 4y ago

Oh it must be nice to be able to do things like this, while only keeping an eye out for the laws of your own country, safe in the knowledge that your government won't extradite you for breaking the laws of another country.

exabrial 4y ago

The TSA no fly list is a blatant violation of the Constitution: for the government to be able to remove a right, you must be convicted at trial. The fact it still exists at all is incredible, but a disturbing precedent.

Symbiote 4y ago

Was there any penalty for CommuteAir or their employees for negligently distributing the list?

flawn 4y ago

That's the Lawnchair app founder LOL

IYasha 4y ago

"That would be the gayest site I've ever seen" :D Seriously, though, is the list on the github yet?

curiousllama 4y ago

Hack aside, there's something poetic about leaking the no fly list from an email address called "nofly@crimew.gay"

dboreham 4y ago

The headline made me think this was about a scheme where you register as an airline, just to get access to the list. I mean, how many planes do you need to own to be an airline?

aj7 4y ago

https://www.egattorneys.com/federal-computer-hacking https://www.egattorneys.com/federal-computer-hacking See in particular the broad definition of “protected computer.”

computerfriend 4y ago

This would be a good candidate for a k-anonymous API where you can query if a specified full name, DoB, etc., is in the list without divulging the list or the request.

LoganDark 4y ago

This is gonna be random but I love people just shamelessly being themselves on the Internet. This person is literally a kitty cat playing around and I find that adorable~ Oh, also secure your Jenkins servers.

Pomelolo 4y ago

[flagged]

hattmall 4y ago

Why is the no fly list sensitive information?

Slava_Propanei 4y ago

[dead]

ctb9 4y ago

assuming i was willing to ever interact with a SOAP api in my life which i sure as hell am not ^^^ this killed me. i'm sure everyone who has ever interacted with a SOAP api feels the same. god bless this tiny kitten/person/hacktivist, the world needs more of this energy.