Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking the largest airline and hotel rewards platform (2023)

samcurry.net

Post reply on HN
Print view View original

101–110 of 122 posts

Re: Hacking the largest airline and hotel rewards platform (2023)

#101

Post by diggan »

alwa wrote: post #3

I’m really impressed at the number of times they say their counterparts responded to their report in under an hour, immediately took the affected site offline, then resolved the issue quickly. That seems like an enviable operation.

It seems they reacted before the team even sent over a report in one case:

> Before we could even finish sending our report or see if other endpoints were accessible (e.g. adding points to a customer rewards account), the points.com team had detected our testing and had completely shut down United's production points.com website. Bummer!

Re: Hacking the largest airline and hotel rewards platform (2023)

#102

Post by switch007 »

8organicbits wrote: post #99
switch007 wrote: post #67

Earlier quoted context omitted.

Makes you wonder if there a colleague who wanted to use Django with the biggest "I told you so" grin right now

For anyone unfamiliar with Django: > django-admin startproject automatically adds a randomly-generated SECRET_KEY to each new project https://docs.djangoproject.com/en/dev/ref/settings/#secret-k...

And stores session data in the DB by default

Re: Hacking the largest airline and hotel rewards platform (2023)

#104

Post by qingcharles »

junto wrote: post #6

> On May 2nd, 2023, we identified that the Flask session secret for the points.com global administration website used to manage all airline tenant and customer accounts was the word "secret". After discovering this vulnerability, we were able to resign our session cookies with full super administrator permissions. Seriously?

When I was in my greyhat days I gained admin access[0] to a very big IIS web hosting provider. After spending a day trawling through their file system I found the actual admin password for their servers in a file. I tested it via their open RDP port. It worked.

Their password? "internet"

I sent them an email showing them their vulns. I never followed up to see if they did anything about it.

[0] they had a forum that allowed profile pic uploads but it didn't check they were images, so I crafted an ASP page which emulated a file explorer and uploaded that, then browsed to it.

Re: Hacking the largest airline and hotel rewards platform (2023)

#105

Post by seanthemon »

michaelt wrote: post #37
joatmon-snoo wrote: post #9

Earlier quoted context omitted.

Seriously! I actually can’t think of any openly documented security incident with such impressive remediation timelines. There’s a lot that has to go into fixing things on such a tight timeline too: - oncall-level alerting for your security.txt inbox - your oncall needs to either be someone who can actually take corrective action on the system in question (not easy in a large company!) or able to route the issue to t…

> - oncall-level alerting for your security.txt inbox Maybe the terminology is different in your company, but my employer has an 'operations' team which has several shifts of workers, who look after things that need 24/7 monitoring. They then triage and escalate as appropriate. That's who you'd have monitoring the security inbox, if you want round-the-clock monitoring, so nobody's getting woken several times a night…

We call that guy grafana alerts at ours

Re: Hacking the largest airline and hotel rewards platform (2023)

#106

Post by thomas-st »

spi wrote: post #71
matteason wrote: post #41

This is only tangentially related but it always blows my mind how insecure airline booking portals are. For many (most?) airlines all you need is the booking reference (PNR number) and surname to log in and see flight itinerary, contact details and, in some cases, change or cancel the booking. No password or MFA needed. The kicker is that your PNR number and surname are encoded in the barcode on your boarding pass, e…

I know this is HN and here it's not a popular opinion, but maximum security is _not_ always a good idea. Even setting aside the problem of many different actors having to access these details mentioned below, there's value in a simple login process. Specifically for airplane tickets, the most common ones I had to struggle with multiple times are retrieving reservations bought from a different computer, or by a travel…

> (by the way, by the time you have checked in and your boarding pass has been issued, a lot of companies just don't allow you to cancel anymore, so it's really a non-issue?)

Which companies have a cancellation policy that is contingent upon getting a boarding pass? I've cancelled checked-in tickets before. If the flight is operated by a different airline than the ticket issuer, you just have to call the operating airline first to undo the check-in (a few airline can even do this online). After that it should be possible to cancel the ticket by the ticket issuer without any problems.

Re: Hacking the largest airline and hotel rewards platform (2023)

#107

Post by chatmasta »

sangeeth96 wrote: post #39

I've always felt most such rewards program portals and apps were more hack-jobs than serious applications and thus, would be riddled with issues like these. I'm from India and I see many of these sites come and go all the time but not a single one has inspired confidence in me about keeping my data safe. For example, even the topmost cards here (HDFC Diners/Infinia) have a shoddy website, mostly a reskinned version o…

The whole point of these rewards programs is to share your data (bookings, itineraries, employment, email, travel class, etc.) with as many partners as possible. So at the end of the day, a data leak is only marginally worse than the expected behavior.

(Obviously this doesn’t lessen the impact of vulnerabilities that allow malicious actors to charge you, steal your points, amend your bookings, or access your travel data in real time. But for read-only queries, an attacker won’t get much more access than a paying partner of the program could get.)

Re: Hacking the largest airline and hotel rewards platform (2023)

#108

Post by chatmasta »

kredd wrote: post #95
grecy wrote: post #52

Earlier quoted context omitted.

> I've always felt most such rewards program portals and apps were more hack-jobs than serious applications It’s easy to figure out which way any system goes. Does it generate revenue or cost money? The former will be a serious application, the latter a hack job

Just did a mental test of this theory through past projects I’ve consulted for, and it seemed the opposite. I’ve seen hack jobs generating about $1M/day, as a second product of the company. And seen very mature serious applications barely breaking even.

This makes sense because a hack job that generates money is more likely to stay online than a hack job that makes no money.

Re: Hacking the largest airline and hotel rewards platform (2023)

#109

Post by chatmasta »

nucleardog wrote: post #14
rootsudo wrote: post #5

Fun read! So close to unlimited point generation and process tickets for those fancy flights~ I would say if you wanted to generate "free" flights, which is entirely possible, learn how GDS works and the workflow for a ticket purchase and how a coupon is attached ;) but that would probably be going to far then just normal poking and secure disclosure but there is enough techdebt that if you know how one airline proce…

> Then again, I do recall a famous post on here about australian politician and someone jusing using view source to verify a quantas ticket. https://mango.pdf.zone/finding-former-australian-prime-minis... No "view source" level hackery, but presumably what you're referring to.

The researcher also told this story on DarkNet Diaries Ep 84, “Jet-Setters.” It’s worth a listen.

Re: Hacking the largest airline and hotel rewards platform (2023)

#110

Post by billy99k »

It's interesting United Airlines is mentioned here. I am a security researcher and found vulnerabilities through the United Airlines bug bounty program last year. They pay you in miles instead of money.

The problem is that they gift them to you instead of what you might get from a credit card rewards program. You end up having to pay a 2% tax on the total amount in points (at least in the US).

When I made the calculations, I am actually paying more in taxes on the points than if I just paid for the flights myself. They end up being almost completely worthless.

Post reply on HN