The safety of airports and air travel compromised by a simple SQL injection ?
What is it, the year 2000 ?
It should be a criminal offence for whoever developed that system.
Bypassing airport security via SQL injection
21–30 of 459 posts
Re: Bypassing airport security via SQL injection
#22I hate the TSA with every ounce of my being and these articles reinforce why. Incompetent and useless agency that only serves to waste people's time. Can't believe it still exists; 9/11 and the Bush administration really did a number on this country.
It doesn't seem particularly unique to TSA. Flying elsewhere in the world has essentially identical security screening, with all the same stupidity.
I'm a little butthurt right now, in particular, about the security at Heathrow. They confiscated a bottle of whisky that we got in Edinburgh. After 10 minutes of head-scratching and consulting with a supervisor, they concluded that "it does not say 100ml" (it had "10cl" cast into the glass) and "even then, that is just the size of the bottle, not the liquid inside it." What an incredible demonstration of intelligence there.
They gave us a receipt and said we could have it shipped. We checked when we got home. 130 GBP with shipping. Ended up just buying a 700ml bottle from an importer, cost about half as much.
Re: Bypassing airport security via SQL injection
#23Not surprised that they deny the severity of the issue, but I am quite surprised they didn't inform the FBI and/or try to have you arrested. Baby steps?
Those kind of wheels turn very slowly. I will bet any takers $50 that Ian will be prosecuted.
Re: Bypassing airport security via SQL injection
#24The TSA's response here is childish and embarrassing, although perhaps unsurprising given the TSA's institutional disinterest in actual security. It's interesting to see that DHS seemingly (initially) handled the report promptly and professionally, but then failed to maintain top-level authority over the fix and disclosure process.
What was surprising to me was that they didn't immediately do pre-dawn raids on the pentesters' homes and hold them without a lawyer under some provision of an anti-terror law.
Re: Bypassing airport security via SQL injection
#25Earlier quoted context omitted.
The statute of limitations is long and HSI often delays their indictment until the investigation is mostly wrapped up.
So you're suggesting they're not out of the woods?
Depends. If no one currently cares, there is no significant structure or personnel or political change in the future several years, and they don't have any assets worth taking, and the government doesn't get any more desperate for assets to seize -- then they're out of the woods.
Re: Bypassing airport security via SQL injection
#26Earlier quoted context omitted.
We as a civilization are terrible at getting over things, it seems.
Oh it gets even more amusing. By the logic of the GP, Bush must have impersonated every member of the house and senate because they're not aware of how the TSA came into existence/how a law is created. The Aviation and Transportation Act garnered broad bipartisan support.
It was referring more to the time period and general power grab that the federal government was involved in (Patriot Act, Protect America Act, etc..)
Also, Bush had to sign the ASTA into law (checks and balances) which he did so he's part of the problem.
Re: Bypassing airport security via SQL injection
#27Since they actually went past the SQL injection and then created a fake record for an employee, I'm shocked that Homeland did not come after and arrest those involved. Homeland would have been top of the list to misinterpret a disclosure and prefer to refer to the disclosure as malicious hacking instead of responsible disclosure. I'm more impressed by this than the incompetence of the actual issue.
You're not wrong, but I would have a hard time as a jury member convicting them of a CFAA violation or whatever for creating a user named "Test TestOnly" with a bright pink image instead of a photo. If they had added themselves as known crewmembers and used that to actually bypass airport screening, then yeah, they'd be in jail.
What if they incremented a number in a url on a publicly available website?
Re: Bypassing airport security via SQL injection
#28You know it's bad when it's so bad that as I write this no one has even bothered talking about how bad storing MD5'd passwords is. This even proves they aren't even so much as salting it, which is itself insufficient for MD5. But that isn't even relevant when you can go traipsing through the SQL query itself just by asking; wouldn't matter how well the passwords were stored.
The md5 part of the sqli is added by the pentester, likely because they needed a call that would end in a parenthesis within the injection parameter
Re: Bypassing airport security via SQL injection
#29Earlier quoted context omitted.
So you're suggesting they're not out of the woods?
Depends. If no one currently cares, there is no significant structure or personnel or political change in the future several years, and they don't have any assets worth taking, and the government doesn't get any more desperate for assets to seize -- then they're out of the woods.
I doubt asset seizure is what they'd be after. I was thinking more of the "make an example out of them" mentality as an attempt to prevent others from being curious. Government entities don't tend to do well with knowing the difference of malicious hacking and responsible disclosure. The infamous governor and the View Source is a fun one to trot out as exhibit A.
Re: Bypassing airport security via SQL injection
#30Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes into reading about web programming- and that every decent quality web framework automatically prevents. It is really telling that they try to cover up and deny instead of fix it, but not surprising. That is a natural consequence of authoritarian thinking, which is the entire premise…
> Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes
The article mentions that FlyCASS seems to be run by one person. This isn't a matter of technical chops, this is a matter of someone who is good at navigating bureaucracy convincing the powers that be that they should have a special hook into the system.
What should really be investigated is who on the government side approved and vetted the initial FlyCASS proposal and subsequent development? And why, as something with a special hook into airline security infrastructure, was it never security audited?