Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing airport security via SQL injection

ian.sh

Post reply on HN
Print view View original

121–130 of 459 posts

Re: Bypassing airport security via SQL injection

#121

Post by paulddraper »

preciousoo wrote: post #50
VyseofArcadia wrote: post #30

Earlier quoted context omitted.

> Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes The article mentions that FlyCASS seems to be run by one person. This isn't a matter of technical chops, this is a matter of someone who is good at navigating bureaucracy convincing the powers that be that they should have a special hook into the system. What should really be inves…

Someting I’ve been thinking about, esp since that crowdstrike debacle. Why do major distributors of infrastructure (msft in case of crowdstrike, DHS/TSA here) not require that vendors with privileged software access have passed some sort of software distribution/security audit? If FlyCASS had been required to undergo basic security testing, this (specific) issue would not exist

Of course they require that.

Now, why wasn't the requirement enforced? Or why didn't the audit turn this up? Good questions.

But all of those are going to have some kind of requirement, e.g. FedRAMP.

Re: Bypassing airport security via SQL injection

#122

Post by hedvig23 »

AceJohnny2 wrote: post #105
shuntress wrote: post #68

Earlier quoted context omitted.

I'm not saying anyone should be disallowed to run their own authentication. I'm saying we need the digital equivalent of "show me your driver's license".

Would that be https://id.me ? It's what the IRS uses.

Apparently Venmo also has a option to look up an image of any person, we could use that too.

Re: Bypassing airport security via SQL injection

#123

Post by brendoelfrendo »

qazxcvbnmlp wrote: post #101

Accessing CASS is a big deal, and should be fixed but you’re gonna need more than this to board an aircraft. Also… you can fix all the SQL issues, but you’re still not going to be able to fix the “men in hoodies with a big wrench talk to an authorized administrator (while their kids are kidnapped in Mexico)”

You'd need more than this to board an aircraft, but who's to say that the goal of an attacker is to board an aircraft?

Re: Bypassing airport security via SQL injection

#126

Post by soneil »

bambax wrote: post #84

This shows that anyone with the slightest motivation to do harm would have zero difficulty replaying 911. The reason there aren't more terrorist attacks isn't because various security agencies around the world protect us from them. It's because there are extremely few terrorists.

I believe the biggest increase in security since 9/11, is that passengers are no longer expected to sit down and behave.

Pre-9/11, the expectation was you don't draw attention to yourself, wait it out, you're going to have a long day and a story to tell. Post-9/11, the expectation is you fight for your life.

Better cockpit doors and access hygiene probably come second.

Re: Bypassing airport security via SQL injection

#127

Post by jen20 »

bambax wrote: post #84

This shows that anyone with the slightest motivation to do harm would have zero difficulty replaying 911. The reason there aren't more terrorist attacks isn't because various security agencies around the world protect us from them. It's because there are extremely few terrorists.

> zero difficulty replaying 911.

The attacks of September 11th 2001 are fundamentally not reproducible irrespective of whether there is _any_ security screening at airports.

The default assumption before that morning was that a hijacked plane would fly around for a bit, then land. The default assumption afterwards is that it will be crashed if a hijacker is allowed to gain control, so the calculus on passenger intervention is quite different.

Re: Bypassing airport security via SQL injection

#128

Post by mmsc »

Simon_ORourke wrote: post #40
_yb2s wrote: post #18

Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes into reading about web programming- and that every decent quality web framework automatically prevents. It is really telling that they try to cover up and deny instead of fix it, but not surprising. That is a natural consequence of authoritarian thinking, which is the entire premise…

For an overtly authoritarian institution it actually surprises me they do the old delete and pretend it never happened approach to basic security.

>pretend it never happened

I'm not suggesting this is what they have done here, but this is exactly what authoritarian governments do. Straight from the pneumatic into the furnace.

Re: Bypassing airport security via SQL injection

#129

Post by jen20 »

cyberax wrote: post #56
anal_reactor wrote: post #36

Earlier quoted context omitted.

The problem boils down to two issues: 1. Ok, security is bad, what are you going to do? Go to different, competing security? 2. Nobody wants to be the politician that relaxes the security right before an accident, even if the accident wouldn't be prevented with tighter security anyway.

> 1. Ok, security is bad, what are you going to do? Go to different, competing security? Amazingly, you can do that. SFO doesn't use the TSA, for example.

You can only do that if there are competing airports that are equally usable for where you want to go. Perhaps SFO vs SJC if you're going to the peninsula, JFK vs EWR or LGA, or the various Los Angeles airports but that's pretty much it that I can think of.

Re: Bypassing airport security via SQL injection

#130

Post by deepsun »

woodruffw wrote: post #77
preciousoo wrote: post #50

Earlier quoted context omitted.

Someting I’ve been thinking about, esp since that crowdstrike debacle. Why do major distributors of infrastructure (msft in case of crowdstrike, DHS/TSA here) not require that vendors with privileged software access have passed some sort of software distribution/security audit? If FlyCASS had been required to undergo basic security testing, this (specific) issue would not exist

They often do. The value of those kinds of blanket security audits is questionable, however. (This is one of the reasons I'm generally pro-OSS for digital infrastructure: security quickly becomes a compliance game at the scale of government, meaning that it's more about diligently completing checklists and demonstrating that diligence than about critically evaluating a component's security. OSS doesn't make software…

Well, the value is ok, if considered seriously.

Also, any certificate bears a certificator company name. We can always say "company A was hacked despite having its security certified by company B". So that company B at least share some blame.

Post reply on HN