29 ms·
Bypassing airport security via SQL injection
- voiceblue 2y agoNot surprised that they deny the severity of the issue, but I am quite surprised they didn't inform the FBI and/or try to have you arrested. Baby steps?
- preciousoo 2y agoThis should be news lol, I’m surprised a bored year 17 year old with a fake id hasn’t made a TikTok sneaking on board a plane. Sql injection ffs
- woodruffw 2y agoThe author made the right move by doing this through FAA and CISA (via DHS), rather than directly via TSA. It's not inconceivable that a direct report to TSA would have resulted in legal threats and bluster.
- dmd 2y agoThose kind of wheels turn very slowly. I will bet any takers $50 that Ian will be prosecuted.
- reaperman 2y agoI'll take that bet. How long of a time window? 1 year, 2 years?
- dmd 2y agoLets say 2 years. Email in profile.
- anitil 2y agoAfter listening to patio11's podcast [0] with the owner of Manifold [1] I'd suggest that could be a good platform for this bet [0] https://www.complexsystemspodcast.com/episodes/prediction-markets-stephen-grugett/ https://www.complexsystemspodcast.com/episodes/prediction-ma... [1] https://manifold.markets/ https://manifold.markets/
- dmd 2y agoedit: OK, that's enough takers.
- rez0__ 2y ago> Now that we are an administrator of Air Transport International... LOL > Unfortunately, our test user was now approved to use both KCM and CASS smh...
- preciousoo 2y agoThis was a wild read, that something like this could be so easy, but the later part describing the TSA response is incredibly alarming
- justmarc 2y agoA good old SQL injection negates the entire security theatre worth probably billions a year, hilarious, but probably not all too surprising.
- aftbit 2y agoDoes anyone remember Bruce Schneier and his faked boarding passes? The TSA scribble used to be the weak point of the entire system.
- VMG 2y agoI don't https://www.schneier.com/crypto-gram/archives/2003/0815.html#6 https://www.schneier.com/crypto-gram/archives/2003/0815.html... https://www.schneier.com/essays/archives/2006/11/the_boarding_pass_br.html https://www.schneier.com/essays/archives/2006/11/the_boardin...
- aftbit 2y agoThanks for posting the links. I looked for 5 minutes but couldn't get Google to give me what I wanted, so I gave up and hoped for a kind internet stranger to help. Today you were that hero!
- dylan604 2y agoSince they actually went past the SQL injection and then created a fake record for an employee, I'm shocked that Homeland did not come after and arrest those involved. Homeland would have been top of the list to misinterpret a disclosure and prefer to refer to the disclosure as malicious hacking instead of responsible disclosure. I'm more impressed by this than the incompetence of the actual issue.
- beaglesss 2y agoThe statute of limitations is long and HSI often delays their indictment until the investigation is mostly wrapped up.
- dylan604 2y agoSo you're suggesting they're not out of the woods?
- beaglesss 2y agoDepends. If no one currently cares, there is no significant structure or personnel or political change in the future several years, and they don't have any assets worth taking, and the government doesn't get any more desperate for assets to seize -- then they're out of the woods.
- dylan604 2y agoI doubt asset seizure is what they'd be after. I was thinking more of the "make an example out of them" mentality as an attempt to prevent others from being curious. Government entities don't tend to do well with knowing the difference of malicious hacking and responsible disclosure. The infamous governor and the View Source is a fun one to trot out as exhibit A.
- beaglesss 2y agoBoth are definitely valid. I think saving face and cash grabs are the two fastest way to get in deep shit with the government.
- woodruffw 2y agoThe TSA's response here is childish and embarrassing, although perhaps unsurprising given the TSA's institutional disinterest in actual security. It's interesting to see that DHS seemingly (initially) handled the report promptly and professionally, but then failed to maintain top-level authority over the fix and disclosure process.
- sweeter 2y agoTSA is security theater, it is there to give the illusion of security. In reality it seems more like the goal is the entrenchment of surveillance and the appearance of strength.
- macNchz 2y agoWhat was surprising to me was that they didn't immediately do pre-dawn raids on the pentesters' homes and hold them without a lawyer under some provision of an anti-terror law.
- deleted 2y ago[deleted]
- garyfirestorm 2y agothat is apparently not a popular move anymore since people keep logs and have credentials, strong social media presence and readily available cloud enabled cameras. one email to any news org and whoever authorizes the raid will probably face some music. but knowing TSA, we can expect this any minute now...
- tracker1 2y agoThey just add you to a secret watch list to annoy you when you travel when you're critical of them... or the current administration, so it would seem.
- smsm42 2y agoWhy bother if they could just put everyone involved on the "dangerous terrorist" list which has zero controls and zero accountability because "national security"? That's what happened to Tulsi Gabbard: https://www.racket.news/p/the-worm-turns-house-senate-investigate https://www.racket.news/p/the-worm-turns-house-senate-invest...
- hypeatei 2y agoI hate the TSA with every ounce of my being and these articles reinforce why. Incompetent and useless agency that only serves to waste people's time. Can't believe it still exists; 9/11 and the Bush administration really did a number on this country.
- grishka 2y agoWe as a civilization are terrible at getting over things, it seems.
- dgfitz 2y agoOh it gets even more amusing. By the logic of the GP, Bush must have impersonated every member of the house and senate because they're not aware of how the TSA came into existence/how a law is created. The Aviation and Transportation Act garnered broad bipartisan support.
- hypeatei 2y agoIt was referring more to the time period and general power grab that the federal government was involved in (Patriot Act, Protect America Act, etc..) Also, Bush had to sign the ASTA into law (checks and balances) which he did so he's part of the problem.
- bigstrat2003 2y agoHe certainly was part of the problem, but I think that the way it was phrased originally implied he was the majority of the problem. In truth, these measures had broad support from not only our elected representatives, but from the people themselves. Turns out that people do not actually give a shit about civil liberties, and our representative democracy acted accordingly.
- rootusrootus 2y agoIt doesn't seem particularly unique to TSA. Flying elsewhere in the world has essentially identical security screening, with all the same stupidity. I'm a little butthurt right now, in particular, about the security at Heathrow. They confiscated a bottle of whisky that we got in Edinburgh. After 10 minutes of head-scratching and consulting with a supervisor, they concluded that "it does not say 100ml" (it had "10cl" cast into the glass) and "even then, that is just the size of the bottle, not the liquid inside it." What an incredible demonstration of intelligence there. They gave us a receipt and said we could have it shipped. We checked when we got home. 130 GBP with shipping. Ended up just buying a 700ml bottle from an importer, cost about half as much.
- jerf 2y agoYou know it's bad when it's so bad that as I write this no one has even bothered talking about how bad storing MD5'd passwords is. This even proves they aren't even so much as salting it, which is itself insufficient for MD5. But that isn't even relevant when you can go traipsing through the SQL query itself just by asking; wouldn't matter how well the passwords were stored.
- AntonyGarand 2y agoThe md5 part of the sqli is added by the pentester, likely because they needed a call that would end in a parenthesis within the injection parameter
- 0x0 2y agoThe screenshot in the article shows MD5() is returned as part of the error message from the web server, so it is probably also a part of the original server-side query.
- tomsmeding 2y agoThere is already a call to MD5 in the original query; see the first image in the article, which they apparently obtained by submitting ' as the username: https://images.spr.so/cdn-cgi/imagedelivery/j42No7y-dcokJuNgXeA0ig/68274892-b9e5-485b-a7d5-b05ddfb57518/Untitled/w=3840,quality=90,fit=scale-down https://images.spr.so/cdn-cgi/imagedelivery/j42No7y-dcokJuNg...
- jerf 2y agoYup, and there we can see the password is just splatted in with no salt. 99%+ the password is an injection attack too, but one only needs one set of the keys to the kingdom to make the point, so the article never discusses getting in via password instead and the author may well never have checked, because it couldn't make things any worse.
- rachofsunshine 2y agoThis used to be a question on the Triplebyte interview almost verbatim, and a huge percentage of (even quite good) engineers got it wrong. I'd say probably <20% both salted and used a cryptographically-secure hash; MD5 specifically came up all the time. And keep in mind that we filtered substantially before this interview, so the baseline is even worse than that!
- wkirby 2y agoHonestly, this is the most shocking part: > We did not want to contact FlyCASS first as it appeared to be operated only by one person and we did not want to alarm them It’s incredible (and entirely too credible) that this kind of “high security” integration could be built in such an amateur way: and a good reminder why government projects often seem to be run with more complexity than your startup devs might think is necessary.
- _yb2s 2y agoHilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes into reading about web programming- and that every decent quality web framework automatically prevents. It is really telling that they try to cover up and deny instead of fix it, but not surprising. That is a natural consequence of authoritarian thinking, which is the entire premise and culture of the TSA. Any institution that covers up and ignores existential risks instead of confronting them head on will eventually implode by consequences of its own negligence- which hopefully will happen to the TSA.
- VyseofArcadia 2y ago> Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes The article mentions that FlyCASS seems to be run by one person. This isn't a matter of technical chops, this is a matter of someone who is good at navigating bureaucracy convincing the powers that be that they should have a special hook into the system. What should really be investigated is who on the government side approved and vetted the initial FlyCASS proposal and subsequent development? And why, as something with a special hook into airline security infrastructure, was it never security audited?
- preciousoo 2y agoSometing I’ve been thinking about, esp since that crowdstrike debacle. Why do major distributors of infrastructure (msft in case of crowdstrike, DHS/TSA here) not require that vendors with privileged software access have passed some sort of software distribution/security audit? If FlyCASS had been required to undergo basic security testing, this (specific) issue would not exist
- bronco21016 2y agoMoney. Eventually the lobbyists would make it so cumbersome to get the certification that only the defense industry darlings would be able to do anything. Look at Boeing Starliner for an example of how they run a “budget”.
- 4gotunameagain 2y agoThe safety of airports and air travel compromised by a simple SQL injection ? What is it, the year 2000 ? It should be a criminal offence for whoever developed that system.
- 77pt77 2y agoIf there are any criminal charges here it will be for the reporters. Not the developers. To think otherwise is beyond naive.
- 4gotunameagain 2y agoI said there should be, not that there will be :)
- mdorazio 2y agoDoes anyone know how the KCM barcodes differ from employee IDs? Seems like TSA is indexing pretty heavily on those.
- jrochkind1 2y ago> We had difficulty identifying the right disclosure contact for this issue. We did not want to contact FlyCASS first as it appeared to be operated only by one person and we did not want to alarm them. Wait, what? Is this a euphemism for they didn't believe they would take it seriously? Reporting it over their heads to DHS was probably not less "alarming" to anyone...
- gmueckl 2y agoThis is confusing to me as well. You could always escalate later, right?
- filoeleven 2y agoI’m wondering if their thinking was: if they contacted the sole developer, and he perceived it as a threat (whether security or personal livelihood) then the deck is stacked against them when they then have to escalate. The dev has already said “some hackers say they hacked my service” to TSA and kicked the beehive. I wouldn’t have a clue who to report it to myself; the record of DHS is pretty awful too. Lots of folks are saying (and one even betting on!) them being charged for their find within the next couple of years, and given US federal agencies’ records when it comes to these vulns I’d be quite worried about it too if I had found it.
- rjh29 2y agoReal reason: the dev would fix it and they'd be stuffed. That doesn't encourage the DHS to actually look into the issue and see what else is broken.
- magic_man 2y agoThe dudes who did this are going to probably be visited by homeland security or FBI. Not sure what they thought they will get out of this. I don't think the government cares about security, but they are vengeful.
- defparam 2y agoAnd what will homeland security or the FBI get out of it after concluding that that these "dudes" are two well known talented security researchers trying to conduct responsible disclosure to make air travel safer?
- lyu07282 2y agoThese aren't two dudes acting ethically, these are "two hackers arrested by the FBI for breaking into TSA security", good job FBI!
- zelphirkalt 2y agoMade the world a safer place again, by capturing two evil terrorists! Also: Good that our security is impenetrable, as we can see here!
- deleted 2y ago[deleted]
- SG- 2y agoi wonder if TSA will audit the entire list, also it opens up more questions too like how long accounts remain active? are they simply assuming each airline will update pilot status? they clearly haven't been treating this sytem as important it seems.
- dtx1 2y ago> 05/17/2024: Follow-up to DHS CISO about TSA statements (no reply) > 06/04/2024: Follow-up to DHS CISO about TSA statements (no reply) There should be a public Shitlist of Organisations that don't get the Benefit of Responsible Disclosure anymore, just a Pastebin drop linked to 4chan.
- bambax 2y agoThis shows that anyone with the slightest motivation to do harm would have zero difficulty replaying 911. The reason there aren't more terrorist attacks isn't because various security agencies around the world protect us from them. It's because there are extremely few terrorists.
- dawnerd 2y agoIt’s also just one of those hard things to prove: is TSA actually stopping attacks like 9/11? The simple presence of them might be enough of a deterrent or we might just be extremely lucky. Seems these days the real threat is drunk passengers attacking flight attendants.
- macNchz 2y ago> The simple presence of them might be enough of a deterrent The planning for 9/11 took several years, $500k in financing, and had a lot of moving parts between recruiting, research, travel/visas, flight training etc. It's hard to believe that people motivated at that level would truly be deterred by what you see happening at the typical American airport these days.
- digging 2y agoWell, the TSA has been tested for their ability to detect weapons being brought through security screenings, and they were absolutely horrible at it. Can't grab a link at the moment, but if you search for it, you'll easily find the report published... by the TSA. So are they stopping anything serious? It's a safe bet they're not.
- booleandilemma 2y agoHave they caught and arrested any would-be bad guys? Should be pretty easy to verify.
- mulmen 2y agoWell Guantanamo Bay still exists. From https://en.m.wikipedia.org/wiki/Guantanamo_Bay_detention_camp https://en.m.wikipedia.org/wiki/Guantanamo_Bay_detention_cam...: > As of August 2024, at least 780 persons from 48 countries have been detained at the camp since its creation, of whom 740 had been transferred elsewhere, 9 died in custody, and 30 remain; only 16 detainees have ever been charged by the U.S. with criminal offenses. Given what we do know about the secretive and illegal activities of the federal government during the War on Terror I don’t think it’s a reasonable assumption that everyone accused of terrorist activity got their day in court.
- OneLeggedCat 2y ago... and that was the last time Ian was allowed to fly without a printed boarding pass with SSSS on it.
- sergiotapia 2y agoyeah i would not mess around with this and get put into a for-life no fly list dude. you even wrote data to the prod system, christ!
- juunpp 2y agoI found the pink picture underwhelming. So many possibilities, yet a missed opportunity.
- mariodiana 2y agoSo, the trick here would be to purchase a ticket with a major airline, pack a no-no in your carry-on, and then bypass TSA security by adding yourself to the Known Crew Member list of a small airline using the third-party FlyCASS system, via the SQL-injection. You'd then board the major airline with the no-no. Is that the vulnerability?
- asynchronous 2y agoPretty much, although most TsA check lines no longer require even a boarding pass- so in theory you could pack a bomb with you then bypass all the security theater with this.
- returningfory2 2y agoMy presumption was that when you give TSA your ID and they scan it, their systems check that there’s a boarding pass in your name (and DOB)?
- antimemetics 2y agoBoarding pass checks etc are independent of the security checks. At least security never checked my boarding pass or ID, it was usually a step before and after security checks.
- asynchronous 2y agoI don’t think so- I believe it just checks the outstanding warrant/no fly list and that’s all, but I could be wrong.
- returningfory2 2y agoNo, it checks that you have a boarding pass: https://www.tsa.gov/travel/security-screening/credential-authentication-technology https://www.tsa.gov/travel/security-screening/credential-aut... > CAT is linked electronically to the Secure Flight database, which confirms travelers’ flight details, ensuring they are ticketed for travel that day.
- qazxcvbnmlp 2y agoAccessing CASS is a big deal, and should be fixed but you’re gonna need more than this to board an aircraft. Also… you can fix all the SQL issues, but you’re still not going to be able to fix the “men in hoodies with a big wrench talk to an authorized administrator (while their kids are kidnapped in Mexico)”
- brendoelfrendo 2y agoYou'd need more than this to board an aircraft, but who's to say that the goal of an attacker is to board an aircraft?
- rjh29 2y agoAt the very least it sounds like you can get the password of many users (MD5 isn't exactly secure) and if they're sharing passwords then that's bad for them. You can also gain admin access and mess around with the site practically undetected for an indefinite amount of time.
- mikeocool 2y ago> We did not want to contact FlyCASS first as it appeared to be operated only by one person... It seems pretty remarkable that airlines are buying such a security sensitive piece of software from a one person shop. If you make it very far into selling any piece of SaaS software to most companies in corporate America, at the absolute minimum they're going to ask you for your SOC2 audit report. SOC2 is pretty damn easy to get through with minimal findings as far as audits go, but there are definitely several criteria that would should generate some red flags in your report if the company is operated by a single person. And I would have assumed that if your writing software that integrates with TSA access systems, the requirements would be a whole lot more rigorous than SOC2.
- structural 2y agoThe "airlines" that are using something like FlyCASS are themselves smaller operations and typically running on razor thin margins (if not just unprofitable and wishfully thinking that money will suddenly appear and make their business viable). Literally everything on their backend is held together with more duct tape than the average small business. You could be an "airline" by purchasing a couple of older airliners and converting them to cargo use. Is it valuable for new airlines to get started? Should we force them out of business because they don't already have the systems in place that take years to decades to build out? Should they pay $$$ for boutique systems designed for a large passenger airline when they have 2 aircraft flying 1 route between nowhere and nowhere? Requirements and audits really aren't the answer here. The fundamental design problem is that the TSA has used authentication "airline XXX says you're an employee" with a very large blanket authorization "you're allowed to bypass all security checks at any airport nationwide" without even the basic step of "does your airline even operate here?"
- morpheuskafka 2y agoI'm curious why a small cargo airline would even need to use the KCM system. If they don't fly passengers, then wouldn't their crew access the aircraft from the cargo ramp (with a SIDA badge) and never need to enter the passenger terminal/sterile area?
- lysace 2y ago> KCM is a TSA program that allows pilots and flight attendants to bypass security screening, even when flying on domestic personal trips. This program seems like the root cause of the security issue. (Outside of the US) I've often gone through security screenings just before or after crew groups in fast track, but otherwise normal security screening lanes.
- stuff4ben 2y agoSecurity Theatre 3000... keeping us entertained
- qwertox 2y agoStraight to jail, if this would have happened in Germany. The TSA would have been the one suing you and would easily win.
- dyingkneepad 2y agoOnly malicious foreign actors are encouraged to survey the security of systems of national interest, since they can't easily get prosecuted. Systems working as intended.
- Tepix 2y agoI disagree. Give me an example of a white hat hacker in Germany going to jail.
- bahmboo 2y agoOther issues aside my biggest takeaway is that no one at TSA employed even the most basic auditing of external systems accessing their secure process.
- system2 2y agoI feel like TSA is downplaying it to avoid public backlash. This is not childish or amateur. They are just doing what any government agency would do. If you speak up louder you will get arrested or screwed by some random agency knocking on your door, FYI.
- harha_ 2y agoHow can this even be possible? What the hell...
- adamsb6 2y agoWhat’s so special about bar codes that the testers couldn’t create one themselves? Are they cryptographically signed by a system that was inaccessible? Or is it just a matter of figuring out the bar code format and writing out some KCM id?
- samch 2y agoLittle Bobby Tables strikes again: https://xkcd.com/327/ https://xkcd.com/327/
- permo-w 2y agoreally feels like SQL should have never been written in such a fundamentally insecure manner, or immediately fixed once it was discovered that it was
- tacker2000 2y agoSQL was devised far before web apps or the internet were even a thing…
- kchr 2y agoSQL in itself is not the weak point in this case (or any of the other cases of a successful SQLi attack). The problem is the treatment of user-controllable input data and using that data as part of a SQL query without properly sanitising/escaping special characters first.
- akoboldfrying 2y agoHow would you "fix" it, while still allowing people to write ad hoc queries?
- nucleardog 2y agoDon't allow non-parameterized queries at all? Like right at the protocol and parser level? Strip "literal value" as a token right out of the query parser. Then a simple interactive client could do something like: ``` > select * from users where username = :username username? admin +----+----------+----------+ | id | username | password | +----+----------+----------+ | 7 | admin | 12345 | +----+----------+----------+ ``` While a fancier client could, in fact, transparently translate queries exactly as you write them today--pull out the values, replace them placeholders, then send the query and values over the wire. ``` > select * from users where username = 'admin' sent as: query: select * from users where username = :placeholder1 placeholder1: admin ``` There's, of course, nothing stopping any given library or application from doing the same thing, but the vast majority of the time I'd wager this is happening because someone tried the obvious and simple thing (string concatenation) and it worked and they stopped there. Anyone who knows enough to write their own SQL parser or even think to go find a library to do this is probably going to know why they absolutely should not be doing this.
- killjoywashere 2y agoLove reading this while sitting in the MCO terminal waiting to go home after the fourth non-stop flight in a week.
- 77pt77 2y agoWhy do people even attempto to disclose this? These guy are going to end up with some serious federal charges.
- deleted 2y ago[deleted]
- pbhjpbhj 2y agoThey should just leave the system wide open?
- dimensi0nal 2y agopost it on 4chan from behind seven proxies and let full disclosure do its thing
- 77pt77 2y agoYes! Time and time again these cancerous institutions have shown that their only interest is in surviving and they attempt that by concealing the flaws and brutally harassing the people that report them. At this point only useful idiots give them the benefit of the doubt.
- eduction 2y agoI’m glad they uncovered and reported this but I’d be super reluctant to actually log in using purloined credentials if I were them. As macNchz says elsewhere in this discussion, CISA/TSA/DHS does not appear to make any assurances that they won’t prosecute what appears to be a facial CFAA violation just because someone is doing valid security research. To be clear, I really hope they don’t, but they are also clearly trying to spin this in a way at odds with the researchers, and I’d hate to be in a position where they want to have leverage over me if I’d done this. Brave that they did so though and I do think the severity of the vuln warrants this.
- systemvoltage 2y agoIf NYTimes or WSJ had any backbone or journalistic integrity, they would write a front page piece on this to fix our agencies from being defensive to bug reports, shed light to the horrid incompetency in these agencies and how there was no oversight to any of this. They would also protect the two individuals as white hat hackers and teach non-technical people that these are good guys. You know, the job of the press.
- h_tbob 2y agoGuys, I think you should not have done this. You can really piss a lot of people off doing that kind of stuff.
- ProllyInfamous 2y agoReminds me of the guy that created a simple one-page website to make fake boarding passes, only to get into controlled areas of airports (not to actually fly). <knock> <knock>'d
- smsm42 2y agoI don't remember any case over the last 5 years or so TSA even asked me for a boarding pass. I think they gave up on that entirely. They do ask for an ID (and take a picture now - looks like bots are better at matching faces than TSA agents) but until you get to the boarding nobody now even looks at the boarding pass, so anything before the gate is freely accessible to anyone with an ID.
- scintill76 2y agoI’ve assumed you still have to have a ticket and they’re matching ID to the tickets in database. Anyone know otherwise? I can say, I asked the airline for a pass to accompany a passenger to their gate in ATL. If ID was enough I expect they would have told me so, but they gave me a paper pass and said it’s only good for one entrance into secured area.
- smsm42 2y agoI obviously can't verify it without taking undue risks, but I remember they used to ask to see the boarding pass, now they don't. Then again, if they have this system where they can match me to a flight by ID, why they need any boarding passes at all? Just ask to see my ID again when boarding the plane, no? Why boarding passes still exist if this system is in place?
- 2y ago
- cratermoon 2y agoOf course the worst part is TSA and Homeland Security trying to sweep everything under the rug and ignoring the problem.
- d4mi3n 2y agoBobby Tables strikes again! https://xkcd.com/327/ https://xkcd.com/327/ I’m continually amused, amazed, and exasperated at how classes of software defects older than I am continue to be a problem.
- yoaviram 2y ago> FlyCASS seems to be run by one person Bobby is growing up
- urbandw311er 2y ago> We did not want to contact FlyCASS first > as it appeared to be operated only by one person > and we did not want to alarm them I’m not buying this. Feels more like they knew the site developer would just fix it immediately and they wanted to make a bigger splash with their findings.
- conroydave 2y agoAgreed that they wanted to fully understand the extent of the hack before disclosing
- almog 2y agoWhatever their motive was, the engineering process that allowed such a common bug to sneak in is broken. If the sole developer immediately fixed it, it would have been hard to escalate the issue so that maybe someone up the chain can fix this systematically. I'm not sure such overhaul would really happen but it's more likely that it won't if not escalated.
- biftek 2y agoThis is exactly the kinda bug where you want to make a big splash though. You don't just want the guy to silently fix it, everyone in the database needs to be vetted again.
- Tepix 2y agoI came here to say this. Totally uncalled for not to contact the site first that had these holes and instead go to homeland security.
- norcal 2y agoya because the person who developed this is totally trustworthy to fully fix it and assess any other possible vulnerabilities. he definitely isn't gonna just add a front end validation to throw a message on the front end when you submit a single quote...
- compootr 2y agoYes, and what about the possibility that an attacker already accessed this database and added themself as an employee? Would you rather to be prepared and do a full (well, for a govt agency, full enough) check on all people allowed to access flying death machines, or have a dev silently fix the issue with possible issues later?
- robswc 2y agoWhat mind-melting levels of incompetency. I would love to suggest pay raises so the Government can hire better individuals... but I worry the problem is so systemic it wouldn't do any good. Everyone dropped the ball... and kept dropping it. The part where its handed to them on a silver platter and its essentially smacked away. Maddening.
- tonymet 2y agothis isn't a "weakest link breaks the chain" this is a chain with 10000 weak links and we found one.
- ppeetteerr 2y agoHow is this a thing in 2024?
- bigmattystyles 2y agoHonestly, if I discovered and reported this, I'd be so scared of being charged with a crime under the CFAA or some other statute, there are just too many high profile faces that can be covered with egg here. (edit) the charging guidelines are somewhat re-assuring but still https://www.justice.gov/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act https://www.justice.gov/opa/pr/department-justice-announces-...
- thomasfl 2y agoLittle Bobby Tables' story is still a valuable lesson.
- lapphi 2y agoI wonder how many entities knew about this before today
- dhx 2y agoWhy does KCM still need to exist? It doesn't help airlines nor air crew: Pilot: "Years ago we’d get a random enhanced check (which just means go to TSA precheck) now and then. These days it’s 60% of the time, so it’s not possible to get a whole crew through KCM anymore, and we wait on each other because the jet can’t be boarded until the flight attendants are ALL through security, and with the 2022/2023 KCM random checks being so high, that just doesn’t happen. Honestly, I rarely use KCM anymore. I just walk through TSA precheck. The odds are we’re going there anyway so just cut to the chase and hit precheck."[1] VIP treatments (including the likes of KCM) should be removed no matter if someone is a prime minister[2], media personality[3] or airline CEO. In this way, VIPs can experience the inadequate security processes and staffing levels that everyone else has to deal with, and hopefully with their louder voices will be able to force airports and government agencies to improve the situation for all. [1] https://www.quora.com/As-a-pilot-how-does-it-feel-like-to-have-a-KCM-membership-to-skip-security-checks/answer/John-Tringali https://www.quora.com/As-a-pilot-how-does-it-feel-like-to-ha... [2] https://www.theage.com.au/national/red-faces-as-nz-leader-gets-frisked-20031124-gdwssn.html https://www.theage.com.au/national/red-faces-as-nz-leader-ge... [3] https://www.smh.com.au/traveller/travel-news/louise-milligan-sydney-airport-incident-security-rules-may-change-after-abc-journalists-humiliating-experience-20220624-h24nhb.html https://www.smh.com.au/traveller/travel-news/louise-milligan...
- radium3d 2y agoLol, that's the oldest trick [fail?] in the book
- xyst 2y agoTSA is a $10.4B [1] security theater and mistake born out of fear. Out of that multibillion dollar budget, TSA allocates $10.4M for “cybersecurity staffing, as well as the development and implementation of enhanced cybersecurity-related measures to improve cyber resiliency across the U.S. Transportation Systems Sector.” Glad to see our tax dollars working so effectively! \s What a joke of a country this is [1] https://www.tsa.gov/news/press/testimony/2023/03/29/fiscal-year-2024-presidents-budget-request-transportation-security https://www.tsa.gov/news/press/testimony/2023/03/29/fiscal-y...
- invalidlogin 2y agoWho else emailed this to Frank Abagnale?
- mhh__ 2y agoSQL injection, a real blast from the past, like a child with mumps
- 0xbadcafebee 2y agoVery brave of them to report this. They're likely on no-fly lists for life now, and will probably be investigated by the FBI. The government does not like to be embarrassed.
- mvkel 2y agoWhile this report is embarrassing for all involved, in a practical sense, I'd argue the security of this app was "fine." What I mean: security through obscurity is imo the best situation to be in. You can't attack something if you don't know it exists in the first place. That alone gives this system a leg up over more exposed (but hardened) platforms. Second, convenience always beats secure. Requiring password rotations is worse than requiring none at all, because people tend to find the path of least resistance (writing a password on a notepad instead of memorizing). If it was faster/easier to ship a useful (but vulnerable) app, that's net better than the app not shipping at all because of security hurdles. I have to imagine sanitizing inputs doesn't take much more time to include, but I don't know the systems involved. Ultimately, what damage was experienced here? We can throw out hypotheticals about what -could- have happened, but you can't sue every driver on the road because they -could- have hit you. An insecure system served a useful purpose for years, got more secure, and continues ticking.
- pajeets 2y agoI'm not sure I'd write this off because having a weak spot like this and information gained could lead to more discovery of the obscure. It's never a good security design to rely on someone never finding my secret API routes that I named after my co-workers that I despised
- menthe 2y agoI am sorry, are you non-sarcastically arguing that being able to pass through airport security, potentially accessing cockpits and planting bombs onboard airplanes, with a high-school level SQL injection on a federal website used by dozens of airlines & airlines employees, is actually, "fine"? Besides, I am not sure what sort of "security through obscurity" you are talking about? Ian and Sam found it, and frankly - with a public page, page title + first h1 tag clearly stating that this relates to a Cockpit Access system, this has got to show up in a shit ton of security research search engines instantly.
- rjh29 2y agoEvery person working in security, or even familiar with security, would know how to exploit this. It was a ticking time bomb. And it gives you admin access to the entire system. People could have already have exploited it and we wouldn't even know.
- rekoros 2y agoGreat work and writing - thank you!
- yard2010 2y agoI wouldn't get myself into this honestly. Wrong turn and you're a terrorist. Especially with how crooked and backward the people responsible for it seem.
- Dove 2y agoI can't find the essay now, but I remember reading something from years and years ago: Bruce Schneier arguing that it made sense for airline pilots to go through security with everyone else, in spite of the silly appearance, because the inherent complication in implementing a two tier system would both eat up efficiency gains and unavoidably introduce security flaws. He convinced me at the time, but I wasn't expecting such an on-the-nose demonstration.
- gsanderson 2y agoLike something you'd see in a movie and think "well, that could never really happen". Yikes.
- tbarbugli 2y agoMakes you wonder why there were no plane hijacks since 9/11. TSA does not seem a credible prevention mechanism given how easy it is to go around it.
- marcosdumay 2y agoBecause you can't get near the pilots anymore, and because everybody assumes a hijack is suicidal and reacts accordingly.
- solardev 2y agoMaybe a SQL injection gets you onto the plane, but crashing that plane gets your country destroyed and the neighboring ones bombed for good measure. What the US lacks in cybersec, it tends to make up for with IRL pew pews...
- lubujackson 2y agoMeanwhile, my wife just had a beautiful ameythyst she bought as a birthday gift for my son stolen by security in Mexico because it "could be used as a weapon". I say stolen because they wouldn't throw it away and just smirked the whole time at her. It is sadly an all-too-common occurence when you give uneducated dimwits police-level power with no oversight and no recourse for anyone affected. I assume flexing government power is the real objective here since everybody knows that security is not.
- chihwei 2y agoWell, government is being government. I never think bureaucracy could solve an issue when they could just hide it.
- fennecbutt 2y agoIt's a stupid system anyway. Corrupt airline staff can easily bypass all security checks, bring a pistol in a handbag and leave that in the cabin luggage bin for prearranged pickup by an unscrupulous passenger or any sort of shenanigans. How do they protect against corrupt staff. It's like they're not even thinking. Why don't they just fast track staff checks.
- hbrmjen 2y agoXnxnxnkzjzmxnnzcskdyxk buenos días amor cómo amaneciste mi cielo bello como te fue en el estudio shdtdhdc te e dicho algo y me avisas cuando llegues a tu casa para ti gracias a Dios por tu salud te amo mucho en el trabajo de dgd Je je pero no sé dónde es eso de las cosas y te sientes por usted es que no me avisas cuando te e udbgzdh si te amo más extremo de
- radium3d 2y agoPart of the issue here may be the policy of "need to know" for these high profile secret systems. If the only person who "needs to know" doesn't know what they're doing then the proper audits of the code will never be done.