Love reading this while sitting in the MCO terminal waiting to go home after the fourth non-stop flight in a week.
Bypassing airport security via SQL injection
181–190 of 459 posts
Re: Bypassing airport security via SQL injection
#182Earlier quoted context omitted.
This is a bit of ridiculous comment. Who in the right mind would say a sql injection is a backdoor for a 3LA? Added, why would they use FlyCass when they could just access the data directly?
To move someone from one place to another without an official record of the person? Honeypot? Legit logins are logged differently than non-legit?
I think a TLA would jsut generate the proper flight crew credentials.
Re: Bypassing airport security via SQL injection
#183Earlier quoted context omitted.
They often do. The value of those kinds of blanket security audits is questionable, however. (This is one of the reasons I'm generally pro-OSS for digital infrastructure: security quickly becomes a compliance game at the scale of government, meaning that it's more about diligently completing checklists and demonstrating that diligence than about critically evaluating a component's security. OSS doesn't make software…
> The value of those kinds of blanket security audits is questionable, You're totally right. Why are people afraid to say that they're worthless? Why caveat or equivocate? Adversaries in computer security do not mince words.
Because it's better than nothing when independent organizations are reviewing systems or other organizations. It's like saying that penetration tests are useless because you cannot prove security with testing.
Re: Bypassing airport security via SQL injection
#184Straight to jail, if this would have happened in Germany. The TSA would have been the one suing you and would easily win.
Only malicious foreign actors are encouraged to survey the security of systems of national interest, since they can't easily get prosecuted. Systems working as intended.
Re: Bypassing airport security via SQL injection
#185Earlier quoted context omitted.
Based on the language on their site about requiring an existing CASS subscription, my guess is there was no approval at all. It appears this person has knowledge of the CASS/KCM systems and APIs, and built a web interface for them that uses the airline's credentials to access the central system. My speculation is that ARINC doesn't restrict access by network/IP, so they wouldn't directly know this tool even exists. S…
This right here people need to pay attention to gut the following reason: One person can make a lot of impact The most common thing I hear people say with respect to their jobs is: “I’m just one person, I can’t actually do anything to make things better/worse…” But it’s just wrong and there’s thousands of examples of exactly that over and over and over In this case, if this is true, it’s both amazing that: One person…
Oh, everyone knows that one single person can make things a lot worse. That's all that's happening here. That doesn't say anything about how much one single person can make things better. In the former case, your powers are amplified by the incompetence of everyone else involved; in the latter case, they are diminished.
Re: Bypassing airport security via SQL injection
#186Earlier quoted context omitted.
Would that be https://id.me ? It's what the IRS uses.
That's of course the stupidest possible domain for a government website. (Or at least it's up there) Fundamentally, it has given control over the DNS records to a different country (.me == Montenegro). It's training people that really, any domain could be a government domain, you'll never know.
It's not a government website.
It's the company providing the service that the government could provide on its own, but that service is being provided by a private company through a lucrative contract agreement.
Re: Bypassing airport security via SQL injection
#187Earlier quoted context omitted.
It's also not a government web site. It's a private company who, for some reason, my own government outsources identity verification to. Meanwhile, the authorization system the US government has built (login.gov) is deemed "insecure" by the IRS and Social Security for some inexplicable reason. (But it's fine for Trusted Traveler Programs.)
Social Security has implemented Login.gov integration. IRS returned detailed feedback that GSA is working on.
This is good news. Thanks for sharing.
Re: Bypassing airport security via SQL injection
#188Earlier quoted context omitted.
The problem is deeper and simpler than that. Authentication should not need to be re-implemented by every single organization. We should have official auth servers so that FlyCASS doesn't need to worry about identity management and can instead just hand that off to id.texas.gov (or whatever state they operate from) the same way most single-use tool websites use Google's login.
Authentication and authorization, and especially on the web, is one of those things that has never been implemented well. I hate every single piece of software, every standard, every library, every approach I have come into contact with from this domain. I am so glad I have nothing to do with this field anymore. It makes me angry even thinking about it.
Be the change you want to see in the world.
Re: Bypassing airport security via SQL injection
#189Earlier quoted context omitted.
I'm not saying anyone should be disallowed to run their own authentication. I'm saying we need the digital equivalent of "show me your driver's license".
Ah, but there are third-party services that provide identity verification, such as id.me. And now that there are for-profit entities involved in a government service, you will never be able to convince the government to implement their own solution. It's telling that id.me is headquartered in McLean, Virginia; gotta be in the DC metro area so your lobbyists have easy access to Congress.
I want you to be wrong, but you probably aren't.
Re: Bypassing airport security via SQL injection
#190Earlier quoted context omitted.
Is this a reference to a past event? I don't get it.
It's an incredibly basic form of pen testing. For example, this reply page URL refers to id=41393364, which is presumably your comment. So what happens if I replace it with a different number? Probably something innocent, but maybe not.
[deleted]