7 ms·
FlightAware Leaks Customer Data (Name, Email Addresses and Passwords)
- 23B1 2y agoPrivacy amendment NOW.
- croemer 2y agoI can confirm the veracity of the email. I got it myself. Note that they say they leaked passwords. They didn't mention whether they were hashed or not, and if so whether with salt or not. I couldn't find a blog post either. The notification email took more than 3 weeks, not impressed.
- flutas 2y agoInteresting, as I have an active account (ADS-B data feed) with them and never got this email.
- croemer 2y agoYou will probably still get it then. I only got it 3 hours ago. And the first tweets are almost 2 days old. They seem to use some email delivery service that can't handle sending an email to all users within an hour.
- flutas 2y agoJeez, that's terrible...
- technion 2y agoIt's terrible for end users, bit to be fair here a domain that sends little mail suddenly sending a lot looks like spam. Ciscos sender base for example graphs long term volume per domain as a key indicator, and their data feeds into several mail services. You're much more likely to at least get the email this way.
- croemer 2y agoIf they really cared about reaching users they might also want to put something on their website. There's absolutely nothing there.
- croemer 2y agoI can't confirm that's the reason, but I don't see why they would drip send it otherwise. Also the reply-to email is bounces+MYEMAILADDRESS@bounces.flightaware.com (@ replaced by =)
- SushiHippie 2y agoSame, but I tried logging in and got the reset your password popup because of a breach.
- bigmoat 2y agoAs someone who used to work there, the passwords were definitely stored salted and hashed in the database. The email mostly makes it sound like what’s in the user account table, though last 4 of credit card I didn’t think was in it. And mentioning passwords, not salted/hashed passwords, makes me think it was more. I’m wondering if this is an Apache or Apache Rivet issue that possibly intercepted everything you sent to the server, which could then be your actual password if you logged in during the timeframe or even credit card if you bought something. Also Rivet was full of footguns. IIRC, variables would exist for the life of the Apache child, so you had to clear them out or the next request had access to them, so if someone deleted or didn’t run the huge “delete all variables we probably set” proc, and someone was able to get an “info var” output, they’d see everything set in the previous request or further back if nothing overrode it. Like user info, which was just stored in a big global “user” array
- croemer 2y agoThanks that the most informative thing about this incident that exists at this point. Nothing on the website at all. It's terrible. The blog mentions recently moving away from TCL. Could it have been related to that? Do you have an idea why the emails arrive as a drip, spread over days?
- bigmoat 2y agoThe website still looks like the TCL monster it has always been, so I doubt it. But I have no intimate knowledge of the inner workings there soon after the Raytheon buyout.
- croemer 2y agoOh it is owned by Raytheon a huge listed company. That makes it more surprising that the communication is so bad. I'd expect a public company with market cap of $150b to have its act together regarding crisis communication.
- stackskipton 2y ago
- croemer 2y agoA few more links: https://www.404media.co/flightaware-exposed-pilots-and-users-info-2/ https://www.404media.co/flightaware-exposed-pilots-and-users... Automatic reply when replying to email: https://x.com/fergindc/status/1824648418544816222?t=vqjrPsqbJPos8k8EppI9tQ&s=19 https://x.com/fergindc/status/1824648418544816222?t=vqjrPsqb... https://x.com/josephfcox/status/1824192314991882545?t=IIZE0VbEdAnKuycVep4TWw&s=19 https://x.com/josephfcox/status/1824192314991882545?t=IIZE0V...
- gosub100 2y agoPossible pirate deviation.
- croemer 2y agoWhat does pirate deviation mean? ChatGPT doesn't get it either.
- leetrout 2y agoIn air traffic control they say "possible pilot deviation" so they were making a play on words.
- repiret 2y agoSpecifically, they say that if (they think) you’re breaking a rule. When you get to a phase of flight that you have the bandwidth to do so, they’ll give you a phone number to call after you’ve landed. From there you might just get chewed out by a grumpy controller, or they might set the gears in motion for some sort of formal discipline.
- meowster 2y agoATC here. It's not always because someone is grumpy or for formal discipline. I only gave a Brasher Warning one time, only because my trainer told me to. I suppose it depends on the culture/facility, but where I learned it, they had more of the attitude that it was to have an informal conversation to find out what happened and what the pilot and/or controller can do differently next time. After my supervisor talked with the pilot and listened to the tapes, we discovered that my control instruction was ambiguous and that I should be more clear next time (and the pilot should follow the minimum altitudes on the approach plate).
- repiret 2y agoA good point indeed! There are certainly grumpy controllers and a time for discipline, but there is a strong culture around continuous improvement and safety throughout aviation. A phone number from a controller is not nearly as adversarial as, say, getting pulled over by highway patrol, even though in a lot of ways the two events are analogous.
- Terretta 2y ago[flagged]
- talldayo 2y ago"Yet another" non-sequitur argument defending a company that has also historically leaked customer data.
- croemer 2y ago8 months ago, Flight aware wrote a blog post about moving their entire tech stack from TCL. The post is called "Managing a Technical Transformation (Part 1)". I couldn't find Part 2. https://flightaware.engineering/managing-a-technical-transformation-part-1/ https://flightaware.engineering/managing-a-technical-transfo...
- xcdzvyn 2y ago[dead]
- gkanai 2y agoUntil there are significant financial damages associated with each of these breaches, companies just won't invest enough to secure the information. These sorts of breaches should be existential to the company- they should never happen. And yet because the penalties are almost nothing, companies just are not incentivized to secure the data appropriately. If a breach meant the firing of the CEO and the CTO and the board, then you'd know that companies would spend a lot more on security and privacy.
- deleted 2y ago[deleted]
- layer8 2y agoI’m completely sympathetic to that view. However, until such data breaches regularly lead to severe outcomes for subjects whose data was leaked, and those outcomes can be causally linked to the breaches in an indisputable manner, I’m afraid that we won’t see any such penalties.
- croemer 2y agoVery good point. In addition, my email address etc has been breached so many times that each extra leak has almost no marginal impact.
- Loughla 2y agoIs almost like publicly accessible information like email, phone, address, and, honestly, ss# at this point shouldn't be used for anything serious that doesn't require some sort of authentication beyond itself. Weird.
- BobbyTables2 2y agoAnd the fact that this is now pretty obvious seems to make such continued use an astounding display of mass negligence.
- 2y ago
- ilrwbwrkhv 2y agoAlways always put in fake names emails etc when creating accounts. I do not know why anybody puts in their real names in the first place.
- deleted 2y ago[deleted]
- zadokshi 2y agoYes, i don’t understand why anyone would ever enter real personal details into any website unless it was absolutely required for correct functionality of the website. Is it older people having a more overall general trust of institutions? or is it all ages that do this?
- bluGill 2y agoThe problem is if you forget the fake details you can't recover the account. I was born around 1900 for my old yahoo groups email, but I forgot when exactly and so I got emails for a group I no longer cared about until (not sure what died, yahoo groups or the list)
- diebeforei485 2y agoStore the fake details in your password manager.
- bluGill 2y agoI didn't hear of a password manager for another decade. Even if I had I'm now depending on it evisting (as opposed to lost in a disc crash or something)
- ensignavenger 2y agoIf I think the fake details will be used for account recovery, and I actually care about the account, I store them in my password manager. (custom fields or notes in Bitearden).
- croemer 2y agoStill nothing about it on the website. Only on the official Discourse: https://discussions.flightaware.com/t/closing-account-due-the-security-breach/94164/9 https://discussions.flightaware.com/t/closing-account-due-th...
- idatum 2y agoI have an ADS-B receiver. It's a hobby. I didn't get any notification yet. Looks like I let my guard down with Flightware. Again, it's a hobby -- supposed to be a joy. I wrote some code to use TTS to play the departure, aircraft, and flight info so I can sit on my deck and enjoy as flights passed by. Flightware has my exact location. Of course, so does Google via my phone. But this isn't supposed to be Google. It's a hobby. And now my hobby is part of the sh*t world of Google and every other data hoarding sociopath enterprise. I'll stop using piaware. EDIT: Logged in to Flightaware.com and got this: Reset Your Password Due to a data security incident that potentially involves your personal information and out of an abundance of caution, we are requiring you to reset your password. Additional information was sent to you via email. Please enter your FlightAware username or e-mail address below to reset your password:
- anyfoo 2y agoTitle is incomplete/almost misleading: much more data than name, email, passwords is leaked: Depending on the information you provided, the information may also have included your full name, billing address, shipping address, IP address, social media accounts, telephone numbers, year of birth, last four digits of your credit card number, information about aircraft owned, industry, title, pilot status (yes/no), and your account activity (such as flights viewed and comments posted). Sounded to me like most/everything associated with the profile is affected. Fortunately I didn’t use my account for anything that I can remember, and it used throwaway email and password.
- jbverschoor 2y agoSounds like a complete database dump
- croemer 2y agoI didn't want to editorialize - but happy for dang to change the title
- ryandrake 2y agoFlightAware’s iOS app also just stopped supporting iOS 15 and, instead of just letting the old app continue to work, they did it with a full-screen modal telling iOS 15 users to fuck off and buy a new phone, preventing us from using the app that worked last week. Every other app on my phone gracefully continues to work on my old device except this one. This is absolutely bonkers and not the way any legitimate app does backwards compatibility. The developers over there are pretty clearly clowns that don’t know what they are doing.
- BarryMilo 2y agoI love the idea that developers had the power to decide what is and isn't supported. That's clearly a manager's decision if not CEO.
- stackskipton 2y agoOr they are shocked. Most companies I’ve been at, iOS version support is N-1. After that, we wouldn’t lock you out unless there was technical reason but no testing or support was done. iOS ecosystem has always been like this since Apple supports phones for a long time.
- deleted 2y ago[deleted]
- ryandrake 2y agoYea, I have no problem with them no longer issuing updates supporting iOS 15. It’s an old OS on an old device, and I get it: devs gotta move on. But don’t deliberately cause existing apps to stop working. No other app on my device behaves this way, and this is almost unheard of in the iOS ecosystem. This is where they went overboard. I looked and I’m surprised I couldn’t find an AppStore guideline prohibiting this.
- stackskipton 2y agoMy guess is technical reason drove decision not “Lolz, no more iOS 15”. Looking at our telemetry data, less then 1% of devices that run our B2B app are iOS 15 or older. If we ran into iOS 15 issue, we would lock them out as well.
- anothername12 2y agoAh shit I just interviewed there
- whs 2y agoAs someone who worked in a company during breaches, I'd say if the company is willing to not getting another breach it's a unique learning experience. You'll see company standards stricten, more pentests and perhaps at least for 6 months more emphasis put on product security than time to market. A good time to also suggest tech debt to be fixed related to security.
- yard2010 2y agoBah bro they sent an email with some euphemisms, they have no need to do any of this it's already handled
- tjpnz 2y agoIt's never fun learning that your HR records are among the data being sold on the dark web. Depending on your business you might also have a target on your back afterwards - we had to implement "no company branded t-shirt" rules when leaving the office after an employee got accosted by an irritate customer. We also lost the relaxed policy we had on visitors. Yes, perhaps you'll learn something. But you won't want to stick around there long afterwards.
- udev4096 2y agoBreaches are never going to stop because security is never a priority during an initial product release. It's always an after thought
- croemer 2y agoThis product is hardly in initial release though. FlightAware has been around since 2004 and has recently been migrating their stack away from Tcl (!)
- perch56 2y agoThe author of the article seems to be confused about the GDPR notification requirements. In the event of a personal data breach, the controller is required to notify the supervisory authority without undue delay, and where feasible, no later than 72 hours after becoming aware of the breach—not the users themselves. However, when it comes to informing end users, the GDPR requires that they be notified without undue delay if the breach is likely to result in a high risk to their rights and freedoms. It’s mind-boggling that FlightAware took three weeks to inform users, which raises concerns about their handling of the situation. It’s also suspicious that they haven’t clarified whether they are aware if the exposed data was actually copied by bad actors—one should assume it was.
- croemer 2y agoThis sentence is also mind bogglingly ambiguous: > Please note that this notification was not delayed as a result of a law enforcement investigation. Was there a law enforcement investigation or wasn't there? The sentence can either mean: a) A law enforcement investigation happened, but it didn't delay the notification b) It may or may not have been delayed, but a law enforcement investigation played no causal role in a delay - whether it had happened or not c) A law enforcement investigation happened, and it delayed the notification, but not in the legal sense of a "late notification"
- nomilk 2y agoNowhere in the article says 'hashed' passwords, so I presume plaintext (!!!) passwords were leaked. That's 100x worse than all the other data combined for two reasons: it can be devastating for users, and it's easily preventable (by not storing them in plaintext in the first place). EDIT: Someone suggests stored passwords were hashed [1]. Hope they're right. [1] https://news.ycombinator.com/item?id=41278855 https://news.ycombinator.com/item?id=41278855
- croemer 2y agoIt's a bit disappointing how there's a total blackout from the company. Nothing on their website/blog/social media. Even the notification emails are arriving stagged over a period of 3 or more days.
- zelphirkalt 2y agoTime for management to take the responsibility, that they so often raise as a point, when it comes to salary negotiations.
- ciabattabread 2y agoI have the FlightAware free account, but on occasion I’ve bought the Ad removal IAP, via Apple. What personal/billing information beyond my email address do they actually have from me?
- deleted 2y ago[deleted]