Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking the largest airline and hotel rewards platform (2023)

samcurry.net

Post reply on HN
Print view View original

11–20 of 122 posts

Re: Hacking the largest airline and hotel rewards platform (2023)

#11

Post by klausa »

sushid wrote: post #7
rootsudo wrote: post #5

Fun read! So close to unlimited point generation and process tickets for those fancy flights~ I would say if you wanted to generate "free" flights, which is entirely possible, learn how GDS works and the workflow for a ticket purchase and how a coupon is attached ;) but that would probably be going to far then just normal poking and secure disclosure but there is enough techdebt that if you know how one airline proce…

Can you provide a link or two so one could read up on what you've mentioned in your post?

A lot of the knowledge is very arcane, and like, split over hundreds and thousands of flyertalk.com pages, and like... institutional knowledge of more clever travel agents.

I think a lot of the "fun" that can potentially be had also requires a direct access to a GDS, which, AFAICT is on the order of ~$10k a year?

And if your "tricks" are discovered, airlines have a direct way to demand payment for any shenanigans you've pulled (ADM, https://www.ana.co.jp/businesspartners/en/admacm-policy/). But perhaps OP had something different in mind, I'm curious myself now :P

If you wanna really go off the deep end, try looking into "fuel dumping" community — there's a small group of people who basically have figured out a series of bugs in how fares are coded (that lets them buy flights much cheaper then intended).

They use (very dumb) coded language to talk about their "findings", and are very very very unfriendly to newcomers; but it's a fascinating world to observe.

Re: Hacking the largest airline and hotel rewards platform (2023)

#13

Post by azeirah »

hansvm wrote: post #10
jollofricepeas wrote: post #8

Earlier quoted context omitted.

You almost have to pull the site to stroke bounty hunter egos when you could just push a change to prod instead. If not, they are quick to bash you publicly. There’s too much hubris in the “professional” web app bug hunter community. Generally, their attitude is very “look at these stupid developers,” “developers suck at security,” or “a conspiracy is happening because company X didn’t take their app down within 10 m…

> when you could just push a change to prod instead. I wonder if there's an attack vector hiding where you induce a malicious bug via an illegitimate bounty and the developers' bias against inaction.

100%, hacking is as much technical prowess as it is social engineering.

Re: Hacking the largest airline and hotel rewards platform (2023)

#14

Post by nucleardog »

rootsudo wrote: post #5

Fun read! So close to unlimited point generation and process tickets for those fancy flights~ I would say if you wanted to generate "free" flights, which is entirely possible, learn how GDS works and the workflow for a ticket purchase and how a coupon is attached ;) but that would probably be going to far then just normal poking and secure disclosure but there is enough techdebt that if you know how one airline proce…

> Then again, I do recall a famous post on here about australian politician and someone jusing using view source to verify a quantas ticket.

https://mango.pdf.zone/finding-former-australian-prime-minis...

No "view source" level hackery, but presumably what you're referring to.

Re: Hacking the largest airline and hotel rewards platform (2023)

#15

Post by TrackerFF »

alwa wrote: post #3

I’m really impressed at the number of times they say their counterparts responded to their report in under an hour, immediately took the affected site offline, then resolved the issue quickly. That seems like an enviable operation.

Makes me wonder if they (points.com) have some key-word alerts on incoming emails. I know for sure that at some companies, this would have taken hours (to days!) to detect, if the tip had come through a regular info@ or contact@ inbox.

Re: Hacking the largest airline and hotel rewards platform (2023)

#16

Post by jsemrau »

ZephyrBlu wrote: post #12

Insane vulnerabilities. The massive mismatches between authentication and authorization scopes are crazy. Encrypting data with "secret" as the key is also a facepalm.

Someone didn't bother reading my carefully prepared memo on commonly-used passwords. Now, then, as I so meticulously pointed out, the four most-used passwords are: love, sex, secret, and...

Re: Hacking the largest airline and hotel rewards platform (2023)

#17

Post by S04dKHzrKT »

jsemrau wrote: post #16
ZephyrBlu wrote: post #12

Insane vulnerabilities. The massive mismatches between authentication and authorization scopes are crazy. Encrypting data with "secret" as the key is also a facepalm.

Someone didn't bother reading my carefully prepared memo on commonly-used passwords. Now, then, as I so meticulously pointed out, the four most-used passwords are: love, sex, secret, and...

hunter2

Re: Hacking the largest airline and hotel rewards platform (2023)

#18

Post by kalev »

jsemrau wrote: post #16
ZephyrBlu wrote: post #12

Insane vulnerabilities. The massive mismatches between authentication and authorization scopes are crazy. Encrypting data with "secret" as the key is also a facepalm.

Someone didn't bother reading my carefully prepared memo on commonly-used passwords. Now, then, as I so meticulously pointed out, the four most-used passwords are: love, sex, secret, and...

password????

Re: Hacking the largest airline and hotel rewards platform (2023)

#19

Post by xnorswap »

junto wrote: post #6

> On May 2nd, 2023, we identified that the Flask session secret for the points.com global administration website used to manage all airline tenant and customer accounts was the word "secret". After discovering this vulnerability, we were able to resign our session cookies with full super administrator permissions. Seriously?

This is way more common than you'd like, here's a scenario where it can happen even without outright incompetence:

Someone (or some AI) copies an example auth implementation from stackoverflow. Being sensible they realise they shouldn't put key material in source code either, so they leave "secret" in place, and pop a ticket in JIRA to update with the key material from the vault before it goes live.

Employee falls ill, everything gets re-assigned. Leaves before it gets actioned and that ticket slips through the cracks, with the person taking over their duties not realising how serious "J10243: Populate secret from key vault" actually is, perhaps assuming it's currently coming from a different configuration location.

There's little chance that the regular testing are discovering the flaw as the key gen based on "secret" goes live.

Re: Hacking the largest airline and hotel rewards platform (2023)

#20

Post by moritonal »

nucleardog wrote: post #14
rootsudo wrote: post #5

Fun read! So close to unlimited point generation and process tickets for those fancy flights~ I would say if you wanted to generate "free" flights, which is entirely possible, learn how GDS works and the workflow for a ticket purchase and how a coupon is attached ;) but that would probably be going to far then just normal poking and secure disclosure but there is enough techdebt that if you know how one airline proce…

> Then again, I do recall a famous post on here about australian politician and someone jusing using view source to verify a quantas ticket. https://mango.pdf.zone/finding-former-australian-prime-minis... No "view source" level hackery, but presumably what you're referring to.

"Right click > Inspect Element, all you need to subvert the Commonwealth of Australia"
Post reply on HN