Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing airport security via SQL injection

ian.sh

Post reply on HN
Print view View original

171–180 of 459 posts

Re: Bypassing airport security via SQL injection

#171

Post by digging »

dawnerd wrote: post #92
bambax wrote: post #84

This shows that anyone with the slightest motivation to do harm would have zero difficulty replaying 911. The reason there aren't more terrorist attacks isn't because various security agencies around the world protect us from them. It's because there are extremely few terrorists.

It’s also just one of those hard things to prove: is TSA actually stopping attacks like 9/11? The simple presence of them might be enough of a deterrent or we might just be extremely lucky. Seems these days the real threat is drunk passengers attacking flight attendants.

Well, the TSA has been tested for their ability to detect weapons being brought through security screenings, and they were absolutely horrible at it. Can't grab a link at the moment, but if you search for it, you'll easily find the report published... by the TSA.

So are they stopping anything serious? It's a safe bet they're not.

Re: Bypassing airport security via SQL injection

#172

Post by raddan »

reaperducer wrote: post #111
d1sxeyes wrote: post #88

Earlier quoted context omitted.

This exists in some European countries, in Hungary for example you have an identity service (KAU) which authenticates you and operates as an SSO provider across a number of different government properties.

This exists in some European countries, in Hungary for example you have an identity service (KAU) which authenticates you and operates as an SSO provider across a number of different government properties. The United States has it, too: https://login.gov But with a government as large as America's it's going to take time to get everyone converted to the new system.

FWIW, as a regular user of login.gov, from the outside, it looks like a well-designed system. I am able to add strong forms of 2FA (e.g., security keys or biometric authenticators), it requires strong passwords, etc. It also has decent developer documentation, has a support process, and comes with a vulnerability disclosure form baked into the main website. However, I have not used their API, nor have I seen any of the code (although I wonder if a FOIA request would actually compel them to give it to you).

Re: Bypassing airport security via SQL injection

#173

Post by preciousoo »

niklasrde wrote: post #161
preciousoo wrote: post #50

Earlier quoted context omitted.

Someting I’ve been thinking about, esp since that crowdstrike debacle. Why do major distributors of infrastructure (msft in case of crowdstrike, DHS/TSA here) not require that vendors with privileged software access have passed some sort of software distribution/security audit? If FlyCASS had been required to undergo basic security testing, this (specific) issue would not exist

Part of the reason why Crowdstrike have access, why MS wasn't allowed to shut them out with Vista was a regulatory decision, one where they argued that somebody needs to do the job of keeping Windows secure in a way that biased Microsoft can't. So, I guess you could have some sort of escrow third party that isn't Crowdstrike or MS to do this "audit"? Or see this for a much better write up: https://stratechery.com/202…

Replied in another comment, but I’m aware of the regulation that made msft give access. To my knowledge though, there’s nothing in the regulation that stops them from saying “you have to pass xyz (reasonable) tests before we allow you to distribute kernel level software to millions of people”

Re: Bypassing airport security via SQL injection

#174

Post by preciousoo »

paulddraper wrote: post #121
preciousoo wrote: post #50

Earlier quoted context omitted.

Someting I’ve been thinking about, esp since that crowdstrike debacle. Why do major distributors of infrastructure (msft in case of crowdstrike, DHS/TSA here) not require that vendors with privileged software access have passed some sort of software distribution/security audit? If FlyCASS had been required to undergo basic security testing, this (specific) issue would not exist

Of course they require that. Now, why wasn't the requirement enforced? Or why didn't the audit turn this up? Good questions. But all of those are going to have some kind of requirement, e.g. FedRAMP.

Good to know, didn’t know this program existed, but makes a lot of sense that it does. Why it wasn’t enforced is an incredibly huge question now

Re: Bypassing airport security via SQL injection

#176

Post by AndrewKemendo »

timdorr wrote: post #159
VyseofArcadia wrote: post #30

Earlier quoted context omitted.

> Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes The article mentions that FlyCASS seems to be run by one person. This isn't a matter of technical chops, this is a matter of someone who is good at navigating bureaucracy convincing the powers that be that they should have a special hook into the system. What should really be inves…

Based on the language on their site about requiring an existing CASS subscription, my guess is there was no approval at all. It appears this person has knowledge of the CASS/KCM systems and APIs, and built a web interface for them that uses the airline's credentials to access the central system. My speculation is that ARINC doesn't restrict access by network/IP, so they wouldn't directly know this tool even exists. S…

This right here people need to pay attention to gut the following reason:

One person can make a lot of impact

The most common thing I hear people say with respect to their jobs is: “I’m just one person, I can’t actually do anything to make things better/worse…”

But it’s just wrong and there’s thousands of examples of exactly that over and over and over

In this case, if this is true, it’s both amazing that:

One person, or a small number of people, could build something into the critical path as a sidecar and have it work for a long time and

And second, the consequences of “hero” systems that are not architecturally sound, prove that observability has to cover all possible couplings

Re: Bypassing airport security via SQL injection

#177

Post by richdougherty »

oceanplexian wrote: post #64
_yb2s wrote: post #18

Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes into reading about web programming- and that every decent quality web framework automatically prevents. It is really telling that they try to cover up and deny instead of fix it, but not surprising. That is a natural consequence of authoritarian thinking, which is the entire premise…

> Hilarious that the entire TSA system is vulnerable to the most basic web programming error Because it's a scam and the system is a grift. I'm a pilot and own a private aircraft. Landing at any airport, even my home airport which is restricted by TSA is legal without any special requirement or background check. In fact, I have heard horror stories where TSA wouldn't let a pilot retrieve their aircraft for some bulls…

So it's also vulnerable to a Helicopter Injection Attack?

Re: Bypassing airport security via SQL injection

#178

Post by AmericanChopper »

ethbr1 wrote: post #136
deepsun wrote: post #130

Earlier quoted context omitted.

Well, the value is ok, if considered seriously. Also, any certificate bears a certificator company name. We can always say "company A was hacked despite having its security certified by company B". So that company B at least share some blame.

In practice, most commercial attestations/certifications contain enough weasel language that the certifier isn't responsible for anything missed (i.e. reasonable effort only). But yes, there are many standards for this (e.g. SOC Type 2 reports). In defense of their utility, the good ones tend to focus on (a) whether a control/policy for a sensitive operation exists at all in the product/company & (b) whether those co…

That’s not really how they work. The auditor attests that they were provided with evidence that the systems/business units audited were compliant at the time of auditing. That doesn’t mean that the business didn’t intentionally fake the evidence, or that the business is compliant at any time subsequent to the assessment.

An auditor would certainly have some consequences if they were exposed for auditing negligently.

This is how the PCI SSC manages to claim that no compliant merchant/service provider has ever been breached, because they assume being breached means that the breached party was non-compliant at the time of the breach. Which is probably a technically true statement, but is a bit misleading about what they’re actually claiming that means.

Re: Bypassing airport security via SQL injection

#179

Post by not2b »

niklasrde wrote: post #161
preciousoo wrote: post #50

Earlier quoted context omitted.

Someting I’ve been thinking about, esp since that crowdstrike debacle. Why do major distributors of infrastructure (msft in case of crowdstrike, DHS/TSA here) not require that vendors with privileged software access have passed some sort of software distribution/security audit? If FlyCASS had been required to undergo basic security testing, this (specific) issue would not exist

Part of the reason why Crowdstrike have access, why MS wasn't allowed to shut them out with Vista was a regulatory decision, one where they argued that somebody needs to do the job of keeping Windows secure in a way that biased Microsoft can't. So, I guess you could have some sort of escrow third party that isn't Crowdstrike or MS to do this "audit"? Or see this for a much better write up: https://stratechery.com/202…

MS could have provided security hooks similar to BPF in Linux, and similar mechanisms with Apple, rather than having Crowdstrike run arbitrary buggy code at the highest privilege level.
Post reply on HN