Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking on a plane: Leaking data of millions and taking over any account

rez0.blog

Post reply on HN
Print view View original

51–60 of 91 posts

Re: Hacking on a plane: Leaking data of millions and taking over any account

#51

Post by marapuru »

brazzy wrote: post #24
dopamean wrote: post #2

I's kind of incredible how common this specific kind of vulnerability is. I have to assume the developers of these systems just hope that no one will notice?

No, the developers simply don't realize that there is a vulnerability, even though they have the required knowledge because they look at the code with the "how do I implement this feature" mindset (which is their job ), not a "how could this be abused" mindset.

In addition to the comment above, this mindset is strengthened by time squeezes in development. Which lead to sales, project managers and product owners who prevent developers from actually looking into this.

Re: Hacking on a plane: Leaking data of millions and taking over any account

#52

Post by rwmj »

dopamean wrote: post #2

I's kind of incredible how common this specific kind of vulnerability is. I have to assume the developers of these systems just hope that no one will notice?

I've seen development environments that try to abstract away the underlying web mechanisms[1], which can make it very hard to tell what's really going on at the request level. Combine that with incurious developers, deadlines and a need to ship anything that works and this is what you get.

[1] I'm thinking in particular of Ars Digita's second system effect Java replacement for their original Tcl environment. It tried to turn everything into late 1990s Java buzzwords and was completely opaque, as well as being comically inefficient.

Re: Hacking on a plane: Leaking data of millions and taking over any account

#53

Post by yakshaving_jgt »

goblinux wrote: post #48
ok_dad wrote: post #46

Earlier quoted context omitted.

Is he wearing a hoodie or a down jacket, and why is his neck wrap thingie seems to be integrated into the hoodie. Also, he seems to be wearing some sort of leather harness or backpack. Weird stuff!

Also what is that seat back, is it his backpack or has he pulled the emergency flotation device out from under his seat already?

How is his left ring finger attached to the rest of his hand!?

Re: Hacking on a plane: Leaking data of millions and taking over any account

#54

Post by petschge »

Cupertino95014 wrote: post #47
Mogzol wrote: post #37

Earlier quoted context omitted.

> Assuming you're a black hat exploiting this bug, what can you do, if the target is using a VPN? Going by the same logic, what can a black hat exploiting this bug do if the target ISN'T using a VPN? Using or not using a VPN in the context of this bug is totally irrelevant.

Wouldn't that depend on whether this airplane system lets two machines use the same account at the same time?

You still have an account, even when you are not currently in the air.

Re: Hacking on a plane: Leaking data of millions and taking over any account

#55

Post by glyphosate »

noduerme wrote: post #42

Once a user is logged in, is including their username or userID routine API responses considered bad practice? I don't see why it should be, if everything you can do with that username requires an active login token. The fact that you could put in an email address in lieu of a username/userID seems irrelevant; lots of systems allow email addresses as a username. What stands out about this to me is: We see in both req…

Yes, it's as simple as the back end not validating that the user id and email address in the requests are tied to the active session. It's a very common mistake, often happens when devs try to roll their own session management/access control functionality

Re: Hacking on a plane: Leaking data of millions and taking over any account

#56

Post by alistairSH »

yakshaving_jgt wrote: post #53
goblinux wrote: post #48

Earlier quoted context omitted.

Also what is that seat back, is it his backpack or has he pulled the emergency flotation device out from under his seat already?

How is his left ring finger attached to the rest of his hand!?

The more I look at it, the worse it gets.

Re: Hacking on a plane: Leaking data of millions and taking over any account

#57

Post by rez0123 »

birdman3131 wrote: post #44
sbuccini wrote: post #35

Earlier quoted context omitted.

Especially since the vuln was in a third-party system so the airline couldn't push a fix themselves.

Depends on if it was a security issue or a config issue. From the end user's perspective they can look the same.

This was a bug in the WiFi portal’s api. No need for the airline to fix anything. It simply affected their customers.

Re: Hacking on a plane: Leaking data of millions and taking over any account

#58

Post by rez0123 »

YeBanKo wrote: post #30

Not related to the content of the article, but to the presentation: that art work in the header is spot on, except maybe for what appears to be tree branches in the window. I think we are witnessing how generative are killing photo stock business.

Thank you! I generate a ton of cool hacker art with midjourney. My Twitter has a bunch more if you click the media tab and scroll down https://Twitter.com/rez0__

Re: Hacking on a plane: Leaking data of millions and taking over any account

#59

Post by SoftTalker »

noduerme wrote: post #42

Once a user is logged in, is including their username or userID routine API responses considered bad practice? I don't see why it should be, if everything you can do with that username requires an active login token. The fact that you could put in an email address in lieu of a username/userID seems irrelevant; lots of systems allow email addresses as a username. What stands out about this to me is: We see in both req…

You can't trust the client. You need to validate everything on the server in the context of the authenticated session. At that point, it doesn't really make sense for the client to be submitting data that will have to be looked up and verifed anyway.

Re: Hacking on a plane: Leaking data of millions and taking over any account

#60

Post by rez0123 »

rez0123 wrote: post #58
YeBanKo wrote: post #30

Not related to the content of the article, but to the presentation: that art work in the header is spot on, except maybe for what appears to be tree branches in the window. I think we are witnessing how generative are killing photo stock business.

Thank you! I generate a ton of cool hacker art with midjourney. My Twitter has a bunch more if you click the media tab and scroll down https://Twitter.com/rez0__

Here’s a post with a good # of them: https://twitter.com/rez0__/status/1585981770209820672
Post reply on HN