7 ms·
> Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes The article mentions
by VyseofArcadia 2y ago
> Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes
The article mentions that FlyCASS seems to be run by one person. This isn't a matter of technical chops, this is a matter of someone who is good at navigating bureaucracy convincing the powers that be that they should have a special hook into the system.
What should really be investigated is who on the government side approved and vetted the initial FlyCASS proposal and subsequent development? And why, as something with a special hook into airline security infrastructure, was it never security audited?
- preciousoo 2y agoSometing I’ve been thinking about, esp since that crowdstrike debacle. Why do major distributors of infrastructure (msft in case of crowdstrike, DHS/TSA here) not require that vendors with privileged software access have passed some sort of software distribution/security audit? If FlyCASS had been required to undergo basic security testing, this (specific) issue would not exist
- bronco21016 2y agoMoney. Eventually the lobbyists would make it so cumbersome to get the certification that only the defense industry darlings would be able to do anything. Look at Boeing Starliner for an example of how they run a “budget”.
- vips7L 2y agoIn the case of msft/crowdstrike isn't this exactly the opposite of what HN rallies against? The users installed crowdstrike on their own machines. Why should microsoft be the arbiter of what a user can do to their own system?
- preciousoo 2y agoMicrosoft determines who they give root access signing keys to
- snarfy 2y agoBecause the EU required them to.
- preciousoo 2y agoI’ve read that story, it inspired my question. Such a requirement wouldn’t be out of bounds with the regulation
- advael 2y agoThey automatically occupy that position because in practice no user of a microsoft system can audit the entire "supply chain" of that system, unlike one built from open-source components. Any "control" someone has over "their own" system is ultimately incomplete when there is a company that owns and controls the operating system itself and has the sole power to both fix and inspect it
- Dalewyn 2y ago>no user of a microsoft system can audit the entire "supply chain" of that system, Yes you can, you can access the source code to audit it. https://en.wikipedia.org/wiki/Shared_Source_Initiative https://en.wikipedia.org/wiki/Shared_Source_Initiative
- woodruffw 2y agoThey often do. The value of those kinds of blanket security audits is questionable, however. (This is one of the reasons I'm generally pro-OSS for digital infrastructure: security quickly becomes a compliance game at the scale of government, meaning that it's more about diligently completing checklists and demonstrating that diligence than about critically evaluating a component's security. OSS doesn't make software secure, but it does make it easier for the interested public to catch things before they become crises.)
- deepsun 2y agoWell, the value is ok, if considered seriously. Also, any certificate bears a certificator company name. We can always say "company A was hacked despite having its security certified by company B". So that company B at least share some blame.
- ethbr1 2y agoIn practice, most commercial attestations/certifications contain enough weasel language that the certifier isn't responsible for anything missed (i.e. reasonable effort only). But yes, there are many standards for this (e.g. SOC Type 2 reports). In defense of their utility, the good ones tend to focus on (a) whether a control/policy for a sensitive operation exists at all in the product/company & (b) whether those controls implemented are effectively adhered to during an audited period.
- r00fus 2y agoWe're talking about getting a judgement in the court of public opinion not a court of law, and no one is exempt from the former.
- ipaddr 2y agoMany live in a special labelled class that cannot be criticized
- AmericanChopper 2y ago
- sandworm101 2y agoThey do. But market forces have pushed the standards down. Once upon a time a "pen test team" was a bunch of security ninjas that showed up at your office and did magic things to point out security flaws you didn't know were even a thing. Now it is a online service done remotely by a machine running a script looking for known issues.
- b112 2y ago"I made my fortune with nmap, you can too."
- ethbr1 2y agoGreat, now my YouTube recommendations are also on HN...
- advael 2y agoUnfortunately we're in kind of the worst of all possible worlds here too. Not only do we want to "automate" these kinds of tests, but governments have bought into the "security through obscurity" arguments of tech giants, so the degree to which these automations can even be meaningfully improved is gated in practice by whoever owns the tech itself approving of some auditor (whether automated or human) even looking at it. The author of this article takes the serious risk of retaliation by even looking into this
- paulddraper 2y agoOf course they require that. Now, why wasn't the requirement enforced? Or why didn't the audit turn this up? Good questions. But all of those are going to have some kind of requirement, e.g. FedRAMP.
- preciousoo 2y agoGood to know, didn’t know this program existed, but makes a lot of sense that it does. Why it wasn’t enforced is an incredibly huge question now
- niklasrde 2y agoPart of the reason why Crowdstrike have access, why MS wasn't allowed to shut them out with Vista was a regulatory decision, one where they argued that somebody needs to do the job of keeping Windows secure in a way that biased Microsoft can't. So, I guess you could have some sort of escrow third party that isn't Crowdstrike or MS to do this "audit"? Or see this for a much better write up: https://stratechery.com/2024/crashes-and-competition/ https://stratechery.com/2024/crashes-and-competition/
- preciousoo 2y agoReplied in another comment, but I’m aware of the regulation that made msft give access. To my knowledge though, there’s nothing in the regulation that stops them from saying “you have to pass xyz (reasonable) tests before we allow you to distribute kernel level software to millions of people”
- immibis 2y agoSo, all companies must gatekeep like Apple? By law?
- not2b 2y agoMS could have provided security hooks similar to BPF in Linux, and similar mechanisms with Apple, rather than having Crowdstrike run arbitrary buggy code at the highest privilege level.
- IcyWindows 2y agoCrowdstrike configured Windows to not start if their driver could not run successfully. That's not the default option for kernel drivers on Windows, so this was an explicit choice on Crowdstrike's part.
- cratermoon 2y agoThey could have, however the timeline the regulators gave Microsoft to comply was incompatible with the amount of work required to build such system. With a legal deadline hanging over their heads Microsoft chose to hand over the keys to their existing tools.
- cratermoon 2y agoOh they usually do require some kind of proof of security certification. However the checkbox audits to get those certs and the kinds of solutions employed to allow them to check off the boxes are the real problem.
- edm0nd 2y agoI do believe that is the point of having things like FedRAMP and StateRAMP. Your company must meet said requirements to become a vendor for certain agencies or even be able to submit an RFP for governmental agencies.
- indymike 2y agoSigh. The company is a different problem than the product. Sally in accounting who has pii on her desk is a totally different problem than that the team that wrote insecure code 15 years ago.
- astura 2y agoI've delivered software to the US government. My software has always been required to undergo security auditing.
- hn72774 2y agoWe know that backdoors can be intentional for use by 3-letter agencies. And there is plausible deniability of the bureaucracy when they can pass blame onto a single individual. Or it's beuracracy being beuracracy. The TSA is a lot of security theater anyways.
- seanthemon 2y agoThis is a bit of ridiculous comment. Who in the right mind would say a sql injection is a backdoor for a 3LA? Added, why would they use FlyCass when they could just access the data directly?
- hn72774 2y agoTo move someone from one place to another without an official record of the person? Honeypot? Legit logins are logged differently than non-legit?
- seanthemon 2y agoyes, they _definitely_ need to access flycass to achieve this. Almost certainly no other way.
- woodruffw 2y agoThe US (and almost every government) has reliable ways to covertly move a person that don't involve putting SQLi in their own codebases. The classic way to covertly move a person is to give them a new passport to travel under, and have them move around like every other schlub on the planet. Competent intelligence services make sure that this isn't easy to detect by making the fake passport's identifier indistinguishable from real ones. Russia has prominently failed to do this several times[1][2]. [1]: https://www.bellingcat.com/news/uk-and-europe/2019/11/07/how-russia-issues-fake-passports-to-its-operatives-in-ukraine/ https://www.bellingcat.com/news/uk-and-europe/2019/11/07/how... [2]: https://www.bellingcat.com/news/2022/08/25/socialite-widow-jeweller-spy-how-a-gru-agent-charmed-her-way-into-nato-circles-in-italy/ https://www.bellingcat.com/news/2022/08/25/socialite-widow-j...
- 2y ago
- shuntress 2y agoThe problem is deeper and simpler than that. Authentication should not need to be re-implemented by every single organization. We should have official auth servers so that FlyCASS doesn't need to worry about identity management and can instead just hand that off to id.texas.gov (or whatever state they operate from) the same way most single-use tool websites use Google's login.
- VyseofArcadia 2y agoThis seems like exactly the sort of work the US Digital Service should take on. Would still need an audit to make sure sites are actually using the shared auth and not rolling their own.
- shuntress 2y agoI'm not saying anyone should be disallowed to run their own authentication. I'm saying we need the digital equivalent of "show me your driver's license".
- elliottcarlson 2y agoI think that is the goal of https://id.me https://id.me
- AceJohnny2 2y agoWould that be https://id.me https://id.me ? It's what the IRS uses.
- groby_b 2y agoThat's of course the stupidest possible domain for a government website. (Or at least it's up there) Fundamentally, it has given control over the DNS records to a different country (.me == Montenegro). It's training people that really, any domain could be a government domain, you'll never know.
- 2y ago
- mrbluecoat 2y ago> FlyCASS seems to be run by one person Is their name Jia Tan, by chance?
- timdorr 2y agoBased on the language on their site about requiring an existing CASS subscription, my guess is there was no approval at all. It appears this person has knowledge of the CASS/KCM systems and APIs, and built a web interface for them that uses the airline's credentials to access the central system. My speculation is that ARINC doesn't restrict access by network/IP, so they wouldn't directly know this tool even exists. Some quick googling shows the FlyCASS author used to work for a small airline, so this may piggyback off of his prior experience working with these systems for that job. He just turned it into a separate product and started selling it. The biggest failure here is with ARINC for not properly securing such a critical system for flight safety.
- AndrewKemendo 2y agoThis right here people need to pay attention to gut the following reason: One person can make a lot of impact The most common thing I hear people say with respect to their jobs is: “I’m just one person, I can’t actually do anything to make things better/worse…” But it’s just wrong and there’s thousands of examples of exactly that over and over and over In this case, if this is true, it’s both amazing that: One person, or a small number of people, could build something into the critical path as a sidecar and have it work for a long time and And second, the consequences of “hero” systems that are not architecturally sound, prove that observability has to cover all possible couplings
- feoren 2y agoOh, everyone knows that one single person can make things a lot worse. That's all that's happening here. That doesn't say anything about how much one single person can make things better. In the former case, your powers are amplified by the incompetence of everyone else involved; in the latter case, they are diminished.
- _puk 2y agoBetter / worse for whom? Given the nature of these systems, this 1 person likely made the day to day lives of a lot of people better, providing an (arguably) snappier web interface to existing systems. Granted, they've probably made someone's day a lot worse with this discovery, but..
- ransom1538 2y agoWell my username, "\\'\truncate table user;;\''" has served me well over the years. But some sites I cannot log into for some reason.
- gouggoug 2y ago> This isn't a matter of technical chops, this is a matter of someone who is good at navigating bureaucracy convincing the powers that be that they should have a special hook into the system. I would love to know how one can get what I'd imagine is at least a 6 figures contract with the government? How does this work? I imagine the author of FlyCASS must be making a good amount of money off their product.
- Natsu 2y ago> The article mentions that FlyCASS seems to be run by one person. I wonder if they just subcontract everything? One popular hack of the preferences they give to veterans and minorities in government procurement is to have essentially one person fronts that get maximum preference and which subcontract everything to a real company at a markup.