Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing airport security via SQL injection

ian.sh

Post reply on HN
Print view View original

111–120 of 459 posts

Re: Bypassing airport security via SQL injection

#111

Post by reaperducer »

d1sxeyes wrote: post #88
shuntress wrote: post #61

Earlier quoted context omitted.

The problem is deeper and simpler than that. Authentication should not need to be re-implemented by every single organization. We should have official auth servers so that FlyCASS doesn't need to worry about identity management and can instead just hand that off to id.texas.gov (or whatever state they operate from) the same way most single-use tool websites use Google's login.

This exists in some European countries, in Hungary for example you have an identity service (KAU) which authenticates you and operates as an SSO provider across a number of different government properties.

This exists in some European countries, in Hungary for example you have an identity service (KAU) which authenticates you and operates as an SSO provider across a number of different government properties.

The United States has it, too: https://login.gov

But with a government as large as America's it's going to take time to get everyone converted to the new system.

Re: Bypassing airport security via SQL injection

#112

Post by macNchz »

dawnerd wrote: post #92
bambax wrote: post #84

This shows that anyone with the slightest motivation to do harm would have zero difficulty replaying 911. The reason there aren't more terrorist attacks isn't because various security agencies around the world protect us from them. It's because there are extremely few terrorists.

It’s also just one of those hard things to prove: is TSA actually stopping attacks like 9/11? The simple presence of them might be enough of a deterrent or we might just be extremely lucky. Seems these days the real threat is drunk passengers attacking flight attendants.

> The simple presence of them might be enough of a deterrent

The planning for 9/11 took several years, $500k in financing, and had a lot of moving parts between recruiting, research, travel/visas, flight training etc. It's hard to believe that people motivated at that level would truly be deterred by what you see happening at the typical American airport these days.

Re: Bypassing airport security via SQL injection

#113

Post by SpaceNoodled »

mariodiana wrote: post #87
smsm42 wrote: post #69

Earlier quoted context omitted.

That's what jury instructions are for. The judge can instruct the jury to ignore pretty much any facts and consider any subset of what really happened that they want. So they'd just instruct "did they access the system? Were they authorized? If the answer to the first question is yes, and to the second is no, the verdict is guilty, ignore all the rest". The jury won't be from the HN crowd, it would be random people w…

As my good fortune would have it, I'm called to jury duty two weeks from now. I doubt I'll be sat though. Should I be, I'll keep the above in mind.

They tend to specifically choose against people with critical thinking skills.

Re: Bypassing airport security via SQL injection

#114

Post by defparam »

magic_man wrote: post #70

The dudes who did this are going to probably be visited by homeland security or FBI. Not sure what they thought they will get out of this. I don't think the government cares about security, but they are vengeful.

And what will homeland security or the FBI get out of it after concluding that that these "dudes" are two well known talented security researchers trying to conduct responsible disclosure to make air travel safer?

Re: Bypassing airport security via SQL injection

#115

Post by lysace »

> KCM is a TSA program that allows pilots and flight attendants to bypass security screening, even when flying on domestic personal trips.

This program seems like the root cause of the security issue.

(Outside of the US) I've often gone through security screenings just before or after crew groups in fast track, but otherwise normal security screening lanes.

Re: Bypassing airport security via SQL injection

#116

Post by cg5280 »

bambax wrote: post #84

This shows that anyone with the slightest motivation to do harm would have zero difficulty replaying 911. The reason there aren't more terrorist attacks isn't because various security agencies around the world protect us from them. It's because there are extremely few terrorists.

Maybe I am a naive idiot, but I would assume that other agencies like the FBI provide some protection even if TSA is not great. I occasionally see notable examples, like the CIA being responsible for discovering planned attacks on the recent Taylor Swift concert in Vienna that was then canceled.

Re: Bypassing airport security via SQL injection

#117

Post by bborud »

shuntress wrote: post #61
VyseofArcadia wrote: post #30

Earlier quoted context omitted.

> Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes The article mentions that FlyCASS seems to be run by one person. This isn't a matter of technical chops, this is a matter of someone who is good at navigating bureaucracy convincing the powers that be that they should have a special hook into the system. What should really be inves…

The problem is deeper and simpler than that. Authentication should not need to be re-implemented by every single organization. We should have official auth servers so that FlyCASS doesn't need to worry about identity management and can instead just hand that off to id.texas.gov (or whatever state they operate from) the same way most single-use tool websites use Google's login.

Authentication and authorization, and especially on the web, is one of those things that has never been implemented well. I hate every single piece of software, every standard, every library, every approach I have come into contact with from this domain. I am so glad I have nothing to do with this field anymore. It makes me angry even thinking about it.

Re: Bypassing airport security via SQL injection

#118

Post by bigstrat2003 »

hypeatei wrote: post #26
dgfitz wrote: post #20

Earlier quoted context omitted.

Oh it gets even more amusing. By the logic of the GP, Bush must have impersonated every member of the house and senate because they're not aware of how the TSA came into existence/how a law is created. The Aviation and Transportation Act garnered broad bipartisan support.

It was referring more to the time period and general power grab that the federal government was involved in (Patriot Act, Protect America Act, etc..) Also, Bush had to sign the ASTA into law (checks and balances) which he did so he's part of the problem.

He certainly was part of the problem, but I think that the way it was phrased originally implied he was the majority of the problem. In truth, these measures had broad support from not only our elected representatives, but from the people themselves. Turns out that people do not actually give a shit about civil liberties, and our representative democracy acted accordingly.

Re: Bypassing airport security via SQL injection

#119

Post by groby_b »

AceJohnny2 wrote: post #105
shuntress wrote: post #68

Earlier quoted context omitted.

I'm not saying anyone should be disallowed to run their own authentication. I'm saying we need the digital equivalent of "show me your driver's license".

Would that be https://id.me ? It's what the IRS uses.

That's of course the stupidest possible domain for a government website. (Or at least it's up there)

Fundamentally, it has given control over the DNS records to a different country (.me == Montenegro).

It's training people that really, any domain could be a government domain, you'll never know.

Post reply on HN