6 ms·

Headline buries the real lede a bit in my opinion; the author has gotten a snapshot of the no-fly list from 2019. Presumably the system under attack processes

Headline buries the real lede a bit in my opinion; the author has gotten a snapshot of the no-fly list from 2019. Presumably the system under attack processes more up-to-date versions of it regularly. Corresponding news story: https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotected-server-commuteair/ https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotecte...

racnid 4y ago
Basically any air charter service (no matter how small) will have access to the no fly list. It's honestly surprising that it's not up to date online within minutes.
- DocTomoe 4y ago
  If I was the US government, I would add some fake but legitimate-looking IDs in such lists, different ones for every airline I send the list to, so I can identify who leaked the list ex post facto, and come down with God's Wrath on any airline that leaked theirs. But then, I am not a Bond-esque criminal organization bent for world domination.
  - zztop44 4y ago
    This is called “seeding” a list and is standard practice for data brokers. But maybe that’s a sign they’re Bond-esque criminal organizations…
    - philjohn 4y ago
      Yup - they're the people ACTUALLY selling your data (and often for pennies)
karlkatzke 4y ago
Also seems to have gotten a crew list from the CommutAir’s CASS or possibly from other airlines as part of the shared deadheading crew list, which includes crew addresses and employment information. There were also prod AWS credentials in the files exposed in Jenkins.
ryandrake 4y ago
I wonder which no-fly list it is. Is it a government no-fly list that would contain suspected international criminals and terrorists, or an airline's private no-fly list that would contain people who cause a ruckus on flights, drunks, anti-maskers, and so on. Maybe one shared between airlines? I would imagine that second list has grown substantially since 2020 given all the craziness airlines have had to deal with since then.
- Rhinozz 4y ago
  The Daily Dot article specifies that it's the United States' (the Terrorist Screening Center's).
  - trompetenaccoun 4y ago
    https://www.fbi.gov/investigate/terrorism/tsc https://www.fbi.gov/investigate/terrorism/tsc >[...] the vast majority of people who have disputed travel and appeal to the Department of Homeland Security’s Traveler Redress Inquiry Program are not on the terrorist watchlist. Most people on the terrorist watchlist are still able to fly within the U.S. A very small subset of people on this list are on the “No Fly” list. [...] >The No Fly List is a small subset of the U.S. government Terrorist Screening Database (also known as the terrorist watchlist) that contains the identity information of known or suspected terrorists. This database is maintained by the FBI’s Terrorist Screening Center. So, shouldn't this list be public information anyway? It's not even suspicious people they're watching, by the sound of it the no fly list is only for people they have concrete evidence of terrorist activity for. Imo the public has a right to know those identities.
- asn0 4y ago
  > the nofly csv is almost 80mb in size and contains over 1.56 million rows of data. this HAS to be the real deal (we later get confirmation that it is indeed a copy of the nofly list from 2019).
  - netsharc 4y ago
    CSV you say? Let's hope Bobby Droptable's cousin Bobby Double Quote Comma-Semicolon don't get in it...
birdyrooster 4y ago
You can follow their steps to find this data it’s not that hard. Then do whatever you want with it. Shodan isn’t some mythical tool.
- NieDzejkob 4y ago
  They say the access got closed before publication.
  - birdyrooster 4y ago
    Yeah I was just pretending I knew what was going on.
shadowgovt 4y ago
And as always... Never use production data in the test pipeline. At the very least, I don't think the company was operating like every random developer should have full-access to the no-fly list, which is what they de-facto gave them when they dumped an old copy into the test pipeline.

racnid 4y ago

Basically any air charter service (no matter how small) will have access to the no fly list. It's honestly surprising that it's not up to date online within minutes.

DocTomoe 4y ago
If I was the US government, I would add some fake but legitimate-looking IDs in such lists, different ones for every airline I send the list to, so I can identify who leaked the list ex post facto, and come down with God's Wrath on any airline that leaked theirs. But then, I am not a Bond-esque criminal organization bent for world domination.
- zztop44 4y ago
  This is called “seeding” a list and is standard practice for data brokers. But maybe that’s a sign they’re Bond-esque criminal organizations…
  - philjohn 4y ago
    Yup - they're the people ACTUALLY selling your data (and often for pennies)

karlkatzke 4y ago

Also seems to have gotten a crew list from the CommutAir’s CASS or possibly from other airlines as part of the shared deadheading crew list, which includes crew addresses and employment information. There were also prod AWS credentials in the files exposed in Jenkins.

ryandrake 4y ago

I wonder which no-fly list it is. Is it a government no-fly list that would contain suspected international criminals and terrorists, or an airline's private no-fly list that would contain people who cause a ruckus on flights, drunks, anti-maskers, and so on. Maybe one shared between airlines? I would imagine that second list has grown substantially since 2020 given all the craziness airlines have had to deal with since then.

Rhinozz 4y ago
The Daily Dot article specifies that it's the United States' (the Terrorist Screening Center's).
- trompetenaccoun 4y ago
  https://www.fbi.gov/investigate/terrorism/tsc https://www.fbi.gov/investigate/terrorism/tsc >[...] the vast majority of people who have disputed travel and appeal to the Department of Homeland Security’s Traveler Redress Inquiry Program are not on the terrorist watchlist. Most people on the terrorist watchlist are still able to fly within the U.S. A very small subset of people on this list are on the “No Fly” list. [...] >The No Fly List is a small subset of the U.S. government Terrorist Screening Database (also known as the terrorist watchlist) that contains the identity information of known or suspected terrorists. This database is maintained by the FBI’s Terrorist Screening Center. So, shouldn't this list be public information anyway? It's not even suspicious people they're watching, by the sound of it the no fly list is only for people they have concrete evidence of terrorist activity for. Imo the public has a right to know those identities.
asn0 4y ago
> the nofly csv is almost 80mb in size and contains over 1.56 million rows of data. this HAS to be the real deal (we later get confirmation that it is indeed a copy of the nofly list from 2019).
- netsharc 4y ago
  CSV you say? Let's hope Bobby Droptable's cousin Bobby Double Quote Comma-Semicolon don't get in it...

birdyrooster 4y ago

You can follow their steps to find this data it’s not that hard. Then do whatever you want with it. Shodan isn’t some mythical tool.

NieDzejkob 4y ago
They say the access got closed before publication.
- birdyrooster 4y ago
  Yeah I was just pretending I knew what was going on.

shadowgovt 4y ago

And as always... Never use production data in the test pipeline. At the very least, I don't think the company was operating like every random developer should have full-access to the no-fly list, which is what they de-facto gave them when they dumped an old copy into the test pipeline.