Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking on a plane: Leaking data of millions and taking over any account

rez0.blog

Post reply on HN
Print view View original

11–20 of 91 posts

Re: Hacking on a plane: Leaking data of millions and taking over any account

#11

Post by HideousKojima »

dopamean wrote: post #2

I's kind of incredible how common this specific kind of vulnerability is. I have to assume the developers of these systems just hope that no one will notice?

Just because a vulnerability is common and easy to avoid won't stop lazy and/or incompetent devs from making it. I mean SQL injection is still incredibly common despite being easily mitigated by really basic knowledge and despite being handled properly by the most common data access libraries in every single programming language.

Re: Hacking on a plane: Leaking data of millions and taking over any account

#13

Post by amackera »

dopamean wrote: post #2

I's kind of incredible how common this specific kind of vulnerability is. I have to assume the developers of these systems just hope that no one will notice?

These types of fails are generally due to incompetence, in my experience.

Re: Hacking on a plane: Leaking data of millions and taking over any account

#14

Post by Cupertino95014 »

jaywalk wrote: post #6
Cupertino95014 wrote: post #5

When on any sort of public WiFi network, use a VPN. If anyone has a story about how "that's not enough" I'm eager to hear it. Can't be too careful, can we?

This has absolutely nothing to do with the fact that it was public WiFi, so your advice of using a VPN is irrelevant.

This has to do with being on a public network (an airplane), does it not? Maybe your outrage is over-the-top.

Re: Hacking on a plane: Leaking data of millions and taking over any account

#15

Post by petschge »

Cupertino95014 wrote: post #14
jaywalk wrote: post #6

Earlier quoted context omitted.

This has absolutely nothing to do with the fact that it was public WiFi, so your advice of using a VPN is irrelevant.

This has to do with being on a public network (an airplane), does it not? Maybe your outrage is over-the-top.

Absolutely not. This has to do with how accounts for that network are managed. Even if you use a VPN you will still have an account there and your data were at risk to this vulnerability.

Re: Hacking on a plane: Leaking data of millions and taking over any account

#16

Post by photon12 »

amackera wrote: post #12
LiamPa wrote: post #10

How is something like this not picked up in a pen test? Can only assume there never has been..

Probably because a lot of pen testing is security theatre.

Since this is specifically related to accepting payment, one would hope this infrastructure has received adequate security testing as required by PCI standards.

In practice, PCI standards compliance is a mess of people selling "point and click compliance solutions," companies being too big to be properly audited, code churn between audits, companies misleading auditors or hiding key data. Security theater is especially pervasive in PCI compliance.

Re: Hacking on a plane: Leaking data of millions and taking over any account

#18

Post by throwaway019254 »

> Monday (November 21st) the airline was made aware of the issue

> Wednesday (November 23rd) resolution has already been tested and deployed

That's a pretty nice response time - compared to some big companies that are asking security researchers to not disclose vulnerability for six months.

Re: Hacking on a plane: Leaking data of millions and taking over any account

#20

Post by nicholasjarnold »

jesuspiece wrote: post #19
LiamPa wrote: post #10

How is something like this not picked up in a pen test? Can only assume there never has been..

so many "pentests" are: * run scanner * print out report not a lot of deep diving

Yep. It's a shame. I once (long ago :)) alerted our CTO to an ongoing attack in production after seeing some obviously attack-oriented requests coming in and hitting our gateway. It became a pretty high-visibility incident for about 20 minutes until a manager spoke up that his "pen test" was being performed. Looking into the "testing" that was occurring they were attempting to scan for decade-old PHP bugs in a set of services which were written in Java and NodeJS. Very high value stuff... Can only imagine what the invoice was for this valuable service.
Post reply on HN