3 ms·

Guys, I think you should not have done this. You can really piss a lot of people off doing that kind of stuff.

by h_tbob 2y ago

ProllyInfamous 2y ago
Reminds me of the guy that created a simple one-page website to make fake boarding passes, only to get into controlled areas of airports (not to actually fly). <knock> <knock>'d
- smsm42 2y ago
  I don't remember any case over the last 5 years or so TSA even asked me for a boarding pass. I think they gave up on that entirely. They do ask for an ID (and take a picture now - looks like bots are better at matching faces than TSA agents) but until you get to the boarding nobody now even looks at the boarding pass, so anything before the gate is freely accessible to anyone with an ID.
  - scintill76 2y ago
    I’ve assumed you still have to have a ticket and they’re matching ID to the tickets in database. Anyone know otherwise? I can say, I asked the airline for a pass to accompany a passenger to their gate in ATL. If ID was enough I expect they would have told me so, but they gave me a paper pass and said it’s only good for one entrance into secured area.
    - smsm42 2y ago
      I obviously can't verify it without taking undue risks, but I remember they used to ask to see the boarding pass, now they don't. Then again, if they have this system where they can match me to a flight by ID, why they need any boarding passes at all? Just ask to see my ID again when boarding the plane, no? Why boarding passes still exist if this system is in place?
      - ProllyInfamous 2y ago
        Blissfully, I have not flown since 2012. Thanks for the updated TSA experience.
        smsm42 2y ago
        If you have precheck, TSA is pretty much not an issue now (unless you fly out of one of badly run airports where they are massively under-provisioned) - just ID check and quick metal detector pass usually does it.
keepamovin 2y ago
I agree they shouldn't have written it in such a "now let me embarrass you and show how right I am" way (and they also should have shown a lot more awareness of how embarrassing this was and, also of how: while infosec is super important, there are other priorities that need to be protected in how this is disclosed, too -- especially if they are hoping for constructive engagement with the orgs involved which, like it or not, is what practical security requires, if your point in disclosing is to make a meaningful positive difference, which is really important given the scale/scope of this vulnerability), but I don't think it worked out bad for these two judging from their Twitter feeds. I don't know them, but: Two guys from (or based in) the Midwest: Ian did his first DEFCON talk a couple weeks ago (https://x.com/iangcarroll https://x.com/iangcarroll), and Sam (the other author), was the guy that a couple years back Google accidentally sent 200K USD to, and has 81K X followers, and was recently singing the praises of that much lauded recent PHRACK article on "Hacking means understanding the world" (that was also popular round here): https://x.com/samwcyo/status/1823571295189008601 https://x.com/samwcyo/status/1823571295189008601 They both seem like legit security researchers from their X feeds. I guess that petulance-tinged adolescent attitude is like the secret handshake of the security researcher world, which sounds too disparaging -- but it's not meant to be...only that probably that's what you need to expect from folks who "understand the world", where they're smarter, what's broken, and should be fixed. I get how that attitude rubs people the wrong way and causes more harm than good - but I don't mind it much myself - I guess I just set high expectations for the kind of impact such folks could have, and I think they could have more impact if they adopted a more professional, collegiate attitude in their way of working. But I guess that comes with the territory. Because it's really only the "outsiders" who will sit around poking at things to figure out how they work, and how to fix em, make em better. Those who feel themselves to be "rejects' from the normal world, in sense, are always gonna carry a bit of the tinge of that perspective with them. But, whaddayagonnado? Those are really only gonna be the ones who "understand the world", so you have to rely on them. Odd couples, that pairing. Between industry and these hackers.

Guys, I think you should not have done this. You can really piss a lot of people off doing that kind of stuff.

by h_tbob 2y ago

Guys, I think you should not have done this. You can really piss a lot of people off doing that kind of stuff.

Reminds me of the guy that created a simple one-page website to make fake boarding passes, only to get into controlled areas of airports (not to actually fly). <knock> <knock>'d

smsm42 2y ago
I don't remember any case over the last 5 years or so TSA even asked me for a boarding pass. I think they gave up on that entirely. They do ask for an ID (and take a picture now - looks like bots are better at matching faces than TSA agents) but until you get to the boarding nobody now even looks at the boarding pass, so anything before the gate is freely accessible to anyone with an ID.
- scintill76 2y ago
  I’ve assumed you still have to have a ticket and they’re matching ID to the tickets in database. Anyone know otherwise? I can say, I asked the airline for a pass to accompany a passenger to their gate in ATL. If ID was enough I expect they would have told me so, but they gave me a paper pass and said it’s only good for one entrance into secured area.
  - smsm42 2y ago
    I obviously can't verify it without taking undue risks, but I remember they used to ask to see the boarding pass, now they don't. Then again, if they have this system where they can match me to a flight by ID, why they need any boarding passes at all? Just ask to see my ID again when boarding the plane, no? Why boarding passes still exist if this system is in place?
    - ProllyInfamous 2y ago
      Blissfully, I have not flown since 2012. Thanks for the updated TSA experience.
      - smsm42 2y ago
        If you have precheck, TSA is pretty much not an issue now (unless you fly out of one of badly run airports where they are massively under-provisioned) - just ID check and quick metal detector pass usually does it.

keepamovin 2y ago

I agree they shouldn't have written it in such a "now let me embarrass you and show how right I am" way (and they also should have shown a lot more awareness of how embarrassing this was and, also of how: while infosec is super important, there are other priorities that need to be protected in how this is disclosed, too -- especially if they are hoping for constructive engagement with the orgs involved which, like it or not, is what practical security requires, if your point in disclosing is to make a meaningful positive difference, which is really important given the scale/scope of this vulnerability), but I don't think it worked out bad for these two judging from their Twitter feeds. I don't know them, but: Two guys from (or based in) the Midwest: Ian did his first DEFCON talk a couple weeks ago (https://x.com/iangcarroll https://x.com/iangcarroll), and Sam (the other author), was the guy that a couple years back Google accidentally sent 200K USD to, and has 81K X followers, and was recently singing the praises of that much lauded recent PHRACK article on "Hacking means understanding the world" (that was also popular round here): https://x.com/samwcyo/status/1823571295189008601 https://x.com/samwcyo/status/1823571295189008601 They both seem like legit security researchers from their X feeds. I guess that petulance-tinged adolescent attitude is like the secret handshake of the security researcher world, which sounds too disparaging -- but it's not meant to be...only that probably that's what you need to expect from folks who "understand the world", where they're smarter, what's broken, and should be fixed. I get how that attitude rubs people the wrong way and causes more harm than good - but I don't mind it much myself - I guess I just set high expectations for the kind of impact such folks could have, and I think they could have more impact if they adopted a more professional, collegiate attitude in their way of working. But I guess that comes with the territory. Because it's really only the "outsiders" who will sit around poking at things to figure out how they work, and how to fix em, make em better. Those who feel themselves to be "rejects' from the normal world, in sense, are always gonna carry a bit of the tinge of that perspective with them. But, whaddayagonnado? Those are really only gonna be the ones who "understand the world", so you have to rely on them. Odd couples, that pairing. Between industry and these hackers.