No post body was provided.
Hacking on a plane: Leaking data of millions and taking over any account
61–70 of 91 posts
Re: Hacking on a plane: Leaking data of millions and taking over any account
#62Re: Hacking on a plane: Leaking data of millions and taking over any account
#63Not surprising, airplane wifi has always been ridiculously insecure.
Back in the day, when it was first rolling out, you could (theoretically ofc) join the plane's network and scan for MAC addresses, then clone someone else's for free access.
I think the authentication is a bit more sophisticated these days, but it's clear that these providers treat security as an afterthought. At least the one in the article had a bug bounty program and responded quickly, I guess.
Unrelated, I think it's funny that the AI artist put a little picture of a house on the airplane's interior wall in the article's header image. Maybe plane trips would be more bearable if the cabins didn't look like a utopian abbatoir's waiting room.
Re: Hacking on a plane: Leaking data of millions and taking over any account
#64I think the way that airlines handle this is to squash as many seats together as possible so it's not possible to open your laptop to do hacking. Problem solved!
Re: Hacking on a plane: Leaking data of millions and taking over any account
#65Earlier quoted context omitted.
Wouldn't that depend on whether this airplane system lets two machines use the same account at the same time?
You still have an account, even when you are not currently in the air.
You seem confused about what we're arguing about.
OP said "what would not being on VPN let someone do to you?"
not
"what harm could occur if you're not in the air?" or
"does using a VPN protect you from all harm?"
and the question/assertion is, "if you were in the air, and not on VPN, then could a black hat who's compromised your account spy on your traffic?"
Re: Hacking on a plane: Leaking data of millions and taking over any account
#66Earlier quoted context omitted.
> The impact of these two bugs was signifcant. It was access to first name, last name, address, and email of the user as well as last 4 digits, expiration date, billing name, and address of the credit cards. Assuming you're a black hat exploiting this bug, what can you do, if the target is using a VPN? I don't know what "address of the credit cards" means, but let's assume it's the target's home address. You don't ge…
You completely missed what this vulnerability is. It has nothing to do with intercepting another user's traffic. The checkout page in question actually uses SSL anyway, so it's not even possible absent some sort of MITM attack. This has to do with API endpoints that exposed customer information and allowed password changes without checking that the request was coming from the customer. The customer didn't have to be…
Quite right. But as I said, "intercepting another user's traffic" would be an additional vulnerability, but not if you're on VPN.
Maybe you could just admit that and end the argument. This doesn't require you to minimize the seriousness of the bug.
Re: Hacking on a plane: Leaking data of millions and taking over any account
#67Once a user is logged in, is including their username or userID routine API responses considered bad practice? I don't see why it should be, if everything you can do with that username requires an active login token. The fact that you could put in an email address in lieu of a username/userID seems irrelevant; lots of systems allow email addresses as a username. What stands out about this to me is: We see in both req…
You can't trust the client. You need to validate everything on the server in the context of the authenticated session. At that point, it doesn't really make sense for the client to be submitting data that will have to be looked up and verifed anyway.
If the client has a session, the client is passing the session hash on each and every call. You have to accept it and check it. Whether it's in a session cookie or manually as a GET param. The server doesn't "know" what session it's receiving a call from; it uses the session cookie sent by the client to check it.
Meaning, those $_SESSION variables in PHP are stored on the server, but the server only knows which session to access based on a key passed with every call from the client. A hacker copying someone's php session id would "trick" PHP into using the target's server side variables.
If you're coming from a reset password email and the user has no active session, a token has to be sent via GET and checked, which means you have to look it up and verify it.
Re: Hacking on a plane: Leaking data of millions and taking over any account
#68Earlier quoted context omitted.
Absolutely not. This has to do with how accounts for that network are managed. Even if you use a VPN you will still have an account there and your data were at risk to this vulnerability.
> The impact of these two bugs was signifcant. It was access to first name, last name, address, and email of the user as well as last 4 digits, expiration date, billing name, and address of the credit cards. Assuming you're a black hat exploiting this bug, what can you do, if the target is using a VPN? I don't know what "address of the credit cards" means, but let's assume it's the target's home address. You don't ge…
The article is about authenticating to a Wi-Fi captive portal. So not only is a VPN irrelevant, as everyone has already pointed out and you continue to ignore, it wouldn't even work.
Re: Hacking on a plane: Leaking data of millions and taking over any account
#69Not surprising, airplane wifi has always been ridiculously insecure. Back in the day, when it was first rolling out, you could (theoretically ofc) join the plane's network and scan for MAC addresses, then clone someone else's for free access. I think the authentication is a bit more sophisticated these days, but it's clear that these providers treat security as an afterthought. At least the one in the article had a b…
> Back in the day, when it was first rolling out, you could (theoretically ofc) join the plane's network and scan for MAC addresses, then clone someone else's for free access.
Given that the MAC address is the only thing the access point has to tie your packets to a (paid) session in an unencrypted network, I'd expect this to still work today, or am I missing anything?
OWE [1] might help in this scenario (if it‘s possible to reliably bind that to a login session somehow), but that's pretty new, and given how long upgrade cycles on airplane hardware are, I wouldn't count on seeing that within the next couple of years.
[1] https://en.wikipedia.org/wiki/Opportunistic_Wireless_Encrypt...
Re: Hacking on a plane: Leaking data of millions and taking over any account
#70No post body was provided.