Hacking the largest airline and hotel rewards platform (2023)
1–10 of 122 posts
Re: Hacking the largest airline and hotel rewards platform (2023)
#2[flagged]
Re: Hacking the largest airline and hotel rewards platform (2023)
#3I’m really impressed at the number of times they say their counterparts responded to their report in under an hour, immediately took the affected site offline, then resolved the issue quickly.
That seems like an enviable operation.
Re: Hacking the largest airline and hotel rewards platform (2023)
#4Impressively fast responses from Points.com!
Re: Hacking the largest airline and hotel rewards platform (2023)
#5Fun read! So close to unlimited point generation and process tickets for those fancy flights~
I would say if you wanted to generate "free" flights, which is entirely possible, learn how GDS works and the workflow for a ticket purchase and how a coupon is attached ;) but that would probably be going to far then just normal poking and secure disclosure but there is enough techdebt that if you know how one airline processes a ticket, it will work on quite a few other too!
You can also do very tricky things too that would process as normal for a majority of airlines too - event though most airlines may fall onto amadeus/sabre, you'd be surprised (or not really) at the front end that will allow almost anything - and "farecodes" that could rewrite a ticket which have been exposed to customer facing endpoints that are best verified, with only an active PNR.
Then again, I do recall a famous post on here about australian politician and someone jusing using view source to verify a quantas ticket.
Re: Hacking the largest airline and hotel rewards platform (2023)
#6> On May 2nd, 2023, we identified that the Flask session secret for the points.com global administration website used to manage all airline tenant and customer accounts was the word "secret". After discovering this vulnerability, we were able to resign our session cookies with full super administrator permissions.
Seriously?
Re: Hacking the largest airline and hotel rewards platform (2023)
#7Fun read! So close to unlimited point generation and process tickets for those fancy flights~ I would say if you wanted to generate "free" flights, which is entirely possible, learn how GDS works and the workflow for a ticket purchase and how a coupon is attached ;) but that would probably be going to far then just normal poking and secure disclosure but there is enough techdebt that if you know how one airline proce…
Can you provide a link or two so one could read up on what you've mentioned in your post?
Re: Hacking the largest airline and hotel rewards platform (2023)
#8I’m really impressed at the number of times they say their counterparts responded to their report in under an hour, immediately took the affected site offline, then resolved the issue quickly. That seems like an enviable operation.
You almost have to pull the site to stroke bounty hunter egos when you could just push a change to prod instead.
If not, they are quick to bash you publicly.
There’s too much hubris in the “professional” web app bug hunter community.
Generally, their attitude is very “look at these stupid developers,” “developers suck at security,” or “a conspiracy is happening because company X didn’t take their app down within 10 minutes of getting my email.” It’s much more nuanced than that.
I’d like to see:
1) more bounties and better paid bounties
2) less ego and much more professionalism and patience from “researchers”
Both would be better for consumers.
Re: Hacking the largest airline and hotel rewards platform (2023)
#9I’m really impressed at the number of times they say their counterparts responded to their report in under an hour, immediately took the affected site offline, then resolved the issue quickly. That seems like an enviable operation.
Seriously! I actually can’t think of any openly documented security incident with such impressive remediation timelines.
There’s a lot that has to go into fixing things on such a tight timeline too:
- oncall-level alerting for your security.txt inbox - your oncall needs to either be someone who can actually take corrective action on the system in question (not easy in a large company!) or able to route the issue to the right team - the service owners need to be empowered to treat security with the appropriate severity (taking the site down so quickly speaks highly to this)
Hats off to the points.com team. With any luck, this post doesn’t get too much traction and y’all won’t get flooded with bounty beggar spam.
Re: Hacking the largest airline and hotel rewards platform (2023)
#10I’m really impressed at the number of times they say their counterparts responded to their report in under an hour, immediately took the affected site offline, then resolved the issue quickly. That seems like an enviable operation.
You almost have to pull the site to stroke bounty hunter egos when you could just push a change to prod instead. If not, they are quick to bash you publicly. There’s too much hubris in the “professional” web app bug hunter community. Generally, their attitude is very “look at these stupid developers,” “developers suck at security,” or “a conspiracy is happening because company X didn’t take their app down within 10 m…
> when you could just push a change to prod instead.
I wonder if there's an attack vector hiding where you induce a malicious bug via an illegitimate bounty and the developers' bias against inaction.