Bypassing airport security via SQL injection

Post by garyfirestorm » Thu, Aug 29, 2024, 5:39 PM UTC

woodruffw wrote: post #7

The TSA's response here is childish and embarrassing, although perhaps unsurprising given the TSA's institutional disinterest in actual security. It's interesting to see that DHS seemingly (initially) handled the report promptly and professionally, but then failed to maintain top-level authority over the fix and disclosure process.

Post by tomsmeding » Thu, Aug 29, 2024, 5:39 PM UTC

AntonyGarand wrote: post #28

jerf wrote: post #13

You know it's bad when it's so bad that as I write this no one has even bothered talking about how bad storing MD5'd passwords is. This even proves they aren't even so much as salting it, which is itself insufficient for MD5. But that isn't even relevant when you can go traipsing through the SQL query itself just by asking; wouldn't matter how well the passwords were stored.

The md5 part of the sqli is added by the pentester, likely because they needed a call that would end in a parenthesis within the injection parameter

Post by garyfirestorm » Thu, Aug 29, 2024, 5:41 PM UTC

dylan604 wrote: post #29

beaglesss wrote: post #25

Earlier quoted context omitted.

Depends. If no one currently cares, there is no significant structure or personnel or political change in the future several years, and they don't have any assets worth taking, and the government doesn't get any more desperate for assets to seize -- then they're out of the woods.

I doubt asset seizure is what they'd be after. I was thinking more of the "make an example out of them" mentality as an attempt to prevent others from being curious. Government entities don't tend to do well with knowing the difference of malicious hacking and responsible disclosure. The infamous governor and the View Source is a fun one to trot out as exhibit A.

Post by mpaco » Thu, Aug 29, 2024, 5:43 PM UTC

dylan604 wrote: post #9

Since they actually went past the SQL injection and then created a fake record for an employee, I'm shocked that Homeland did not come after and arrest those involved. Homeland would have been top of the list to misinterpret a disclosure and prefer to refer to the disclosure as malicious hacking instead of responsible disclosure. I'm more impressed by this than the incompetence of the actual issue.

Post by preciousoo » Thu, Aug 29, 2024, 5:46 PM UTC

VyseofArcadia wrote: post #30

_yb2s wrote: post #18

Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes into reading about web programming- and that every decent quality web framework automatically prevents. It is really telling that they try to cover up and deny instead of fix it, but not surprising. That is a natural consequence of authoritarian thinking, which is the entire premise…

> Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes The article mentions that FlyCASS seems to be run by one person. This isn't a matter of technical chops, this is a matter of someone who is good at navigating bureaucracy convincing the powers that be that they should have a special hook into the system. What should really be inves…