Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking on a plane: Leaking data of millions and taking over any account

rez0.blog

Post reply on HN
Print view View original

71–80 of 91 posts

Re: Hacking on a plane: Leaking data of millions and taking over any account

#71

Post by japanman425 »

glyphosate wrote: post #55
noduerme wrote: post #42

Once a user is logged in, is including their username or userID routine API responses considered bad practice? I don't see why it should be, if everything you can do with that username requires an active login token. The fact that you could put in an email address in lieu of a username/userID seems irrelevant; lots of systems allow email addresses as a username. What stands out about this to me is: We see in both req…

Yes, it's as simple as the back end not validating that the user id and email address in the requests are tied to the active session. It's a very common mistake, often happens when devs try to roll their own session management/access control functionality

No post body was provided.

Re: Hacking on a plane: Leaking data of millions and taking over any account

#72

Post by japanman425 »

version_five wrote: post #7
jaywalk wrote: post #4

I can understand when there's a bug that causes something like this. It doesn't excuse it, but we all introduce bugs in code, and sometimes they're disastrous. But this? This is just straight up careless, thoughtless design with zero regard for security whatsoever. It's inexcusable.

Airplane wifi is very much still in the "enterprise software" phase, by which I mean a lowest bidder sells it to someone who will never use it and buys it with only some corporate objective in mind. I've been using it a lot recently, across several airlines, and the experience is universally bad. It doesn't surprise me they also skimped on security

No post body was provided.

Re: Hacking on a plane: Leaking data of millions and taking over any account

#73

Post by 20after4 »

hackbinary wrote: post #33
jaywalk wrote: post #23

Earlier quoted context omitted.

This one is 100% due to incompetence. There was no attempt at anything resembling security.

I'm not sure what your experience is, but mine is over multiple decades over multiple companies over multiple continents, and in general, corporate management, project management, and business analysts are not concerned about security. Instead, they are interested in delivering buttons, fields, and streamlined workflows. Technical debt and library upgrades? Os upgrades? Forget about it. They need to deliver value bac…

This is sadly 100% accurate, in my experience.

Re: Hacking on a plane: Leaking data of millions and taking over any account

#74

Post by Mogzol »

Cupertino95014 wrote: post #65
petschge wrote: post #54

Earlier quoted context omitted.

You still have an account, even when you are not currently in the air.

You seem confused about what we're arguing about. OP said "what would not being on VPN let someone do to you?" not "what harm could occur if you're not in the air?" or "does using a VPN protect you from all harm?" and the question/assertion is, "if you were in the air, and not on VPN, then could a black hat who's compromised your account spy on your traffic?"

I don't understand how a black hat, even with access to your account, could spy on your traffic? They're entirely different concepts. Just having access to the account doesn't mean you can see all data going through the network for people using that account.

And even if they could, any sensitive page should be using HTTPS, so the data will be encrypted. A VPN still wouldn't make a difference.

Re: Hacking on a plane: Leaking data of millions and taking over any account

#75

Post by Cupertino95014 »

mynameisvlad wrote: post #50
Cupertino95014 wrote: post #5

When on any sort of public WiFi network, use a VPN. If anyone has a story about how "that's not enough" I'm eager to hear it. Can't be too careful, can we?

It's ok to admit you're wrong; you know that, right? You don't have to dig further down or move the goalposts when it's clearly shown you didn't actually read the article or understand the vulnerability in question.

It's also ok for you to sit down. You know that, right?

I did read the article and "use a VPN" is solid advice; moreover it's something you have complete control over, whereas the system on board the airplane is beyond your control.

Except you can just not use it, which is probably the best advice of all.

Re: Hacking on a plane: Leaking data of millions and taking over any account

#76

Post by erklik »

goblinux wrote: post #38
YeBanKo wrote: post #30

Not related to the content of the article, but to the presentation: that art work in the header is spot on, except maybe for what appears to be tree branches in the window. I think we are witnessing how generative are killing photo stock business.

Ew yeah the more you look at it the weirder it gets. Like what's between his fingers, or what is that keyboard layout? Is that supposed to be cash sitting on the armrest, or like a plane ticket?

> what's between his fingers

The fingers basically always seem to be off in these AI generated images.

Re: Hacking on a plane: Leaking data of millions and taking over any account

#78

Post by mynameisvlad »

Cupertino95014 wrote: post #75
mynameisvlad wrote: post #50

Earlier quoted context omitted.

It's ok to admit you're wrong; you know that, right? You don't have to dig further down or move the goalposts when it's clearly shown you didn't actually read the article or understand the vulnerability in question.

It's also ok for you to sit down. You know that, right? I did read the article and "use a VPN" is solid advice; moreover it's something you have complete control over, whereas the system on board the airplane is beyond your control. Except you can just not use it, which is probably the best advice of all.

You clearly don't understand it enough to know that "use VPN" has nothing to do with it. It may be good best practice, but it has literally nothing to do with this article or the vulnerability in question.

It's the equivalent of me coming into the thread and saying "the sky is blue". It's a factual statement, it's kind of in the realm of being related, considering airplanes fly in the sky, and yet it is completely and utterly tangential to the article and vulnerability. It's as off topic as a comment can be.

Re: Hacking on a plane: Leaking data of millions and taking over any account

#79

Post by batch12 »

photon12 wrote: post #16
amackera wrote: post #12

Earlier quoted context omitted.

Probably because a lot of pen testing is security theatre.

Since this is specifically related to accepting payment, one would hope this infrastructure has received adequate security testing as required by PCI standards. In practice, PCI standards compliance is a mess of people selling "point and click compliance solutions," companies being too big to be properly audited, code churn between audits, companies misleading auditors or hiding key data. Security theater is especial…

To your point - Although the post discusses possible PCI implications, I don't think exposing last 4 and PII alone are enough to run afoul of the requirements (at least 3.2 as far as I remember). We would need the full PAN or CVV or evidence that this was being stored improperly, etc. If I recall, a company can store first 6 and last 4 in plaintext. With that said, these problems may indicate bigger issues that would violate the DSS, he may have found more that wasn't written about, or I could just be mistaken.
Post reply on HN