Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Alaska Airlines website exposes passenger data

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 47 posts

Re: Tell HN: Alaska Airlines website exposes passenger data

#21

Post by Dalewyn »

solardev wrote: post #19
Dalewyn wrote: post #17

>I'll refrain from posting it here so it's not as easy to exploit. I commend your ethics, but I'm going to be straight with you: Alaska isn't going to do anything until tangible harm and damage occurs. The cost to address the problem is higher than the cost to just ignore it. Alaska probably won't think this even is a problem yet, for that matter. If you still want to be an unwarranted gentleman, I would report this…

Do you have prior experience reporting to them, or why do you believe this to be the case? (I'm not affiliated with them, just an occasional customer who's wondering if they have a bad reputation in this regard or something.)

>Do you have prior experience reporting to them,

No, though I'm a frequent flyer and have a fairly lukewarm view of them compared to other airlines.

>why do you believe this to be the case?

Generally speaking, people will take the path of least resistance and even moreso if they're professionals who probably aren't paid enough to care enough. Beancounters also won't care beyond the numbers in their spreadsheets.

Re: Tell HN: Alaska Airlines website exposes passenger data

#22

Post by hirsin »

uxhacker wrote: post #18
cratermoon wrote: post #5

Earlier quoted context omitted.

I'm going to go with caching issues + interactions with Sabre backend. Also, did you know that your confirmation code, aka record locator is not globally unique? They are 6-character sequences like KZVGX5, so as you might imagine with the number for passengers flying, it doesn't take long to exhaust the namespace.

Originally the PNR when the reservation systems where built in the 1960’s and 70’s the six / seven / eight digit reference was the hash of the physical location in memory of the booking. It would take very few cpu cycles to recall the booking. Nowadays of course the booking reference is virtual.

Should I read this as a reversible hash? I can't imagine it works this way, have you got any pointers to learn more about early sabre ?

Re: Tell HN: Alaska Airlines website exposes passenger data

#23

Post by mulmen »

underdeserver wrote: post #20
solardev wrote: post #13

Earlier quoted context omitted.

I don't think it's realistic to expect airline support staff to know how to properly classify and route web vulnerabilities. Giving someone points is just a way to get them to go away so the ticket can be closed.

I disagree. Even support staff should be able to say "oh wow, this is really bad, let me get my supervisor", who would then recursively escalate until they get to someone who can open the correct ticket.

“Should” is doing a lot of work there.

For that to actually happen support staff has to be empowered to think for themselves and also be compensated enough to care.

Re: Tell HN: Alaska Airlines website exposes passenger data

#24

Post by madaxe_again »

You need to be very, very careful about posting this, depending on your jurisdiction - in most western countries this disclosure is illegal, and you can be criminally prosecuted for providing information about accessing personal information, and you are also admitting that you knowingly accessed the personal information of other customers - in fact, airline passengers, who there are additional privacy laws for.

What you’ve done here is a criminal act according to the CFAA, and your exploration of their site could also be construed as wire fraud. As you’ve done this across state lines this is also a federal felony. You’re also in violation of the GLBA, as you’re disclosing the availability of airline customer information. You could also fall foul of the FTC and the wiretap act.

I have seen people (Weev, Michael Brown, numerous others) go to prison for similar, and this lot could win you years in a federal penitentiary.

Please, consider the legal consequences this could bring upon you.

I would simply forget about it and promptly delete this - it’s their problem, not yours, and by posting about it here, they could decide to make it your problem.

Re: Tell HN: Alaska Airlines website exposes passenger data

#25

Post by xp84 »

solardev wrote: post #4
Terr_ wrote: post #2

Perhaps some sort of UUID collision in terms of cookies/sessions?

Or perhaps a caching issue?

Yeah, I bet anything this is a caching issue. I assume there's a part of the page which one layer of templates expects to be cacheable, and then someone added this dynamic promotional upgrade feature inside of it, so it keeps being stored into the cache with random people's details in it, whoever was there each time there was a cache miss.

If this is some content that isn't always shown, it could be semi-rare for the upgrade message to show up at all, which is how this kind of thing sneaks past basic QA. Also sometimes QA is operating with low traffic, such that you might still just see your own information simply because you're the only one using the site right now.

Re: Tell HN: Alaska Airlines website exposes passenger data

#26

Post by usr1106 »

JaakkoP wrote: post #6
solardev wrote: post #3

Support won't know what to do. Have you tried their cybersec form? https://www.alaskaair.com/content/about-us/site-info/report-...

Thanks! Just did. I didn't think of it the first time given they escalated me to someone who then asked me to verify the information I had just told them over email. Maybe this will get their attention.

Right. But now you have agreed not to tell anyone about this bug. What you've told before cannot be counted I assume.

And you have agreed not to access any information not yours. So if in n months you will be greeted "Treat yourself MikkoX" you are not allowed to click anymore.

Not necessarily trying to say you did the wrong thing. But I do hate corporate lawyers.

Re: Tell HN: Alaska Airlines website exposes passenger data

#27

Post by StressedDev »

madaxe_again wrote: post #24

You need to be very, very careful about posting this, depending on your jurisdiction - in most western countries this disclosure is illegal, and you can be criminally prosecuted for providing information about accessing personal information, and you are also admitting that you knowingly accessed the personal information of other customers - in fact, airline passengers, who there are additional privacy laws for. What…

I am not a lawyer but this line of thinking does not make sense to me. First, poster did not post any personal information. Second, the poster responsibly disclosed the bug to Alaska Airlines but Alaska did not fix it. The poster is now publicly disclosing that the bug exists. Note that the poster did not include repo steps for the bug.

The bottom line is we need a mechanism to ensure security bugs are fixed. Publicly disclosing security bugs when an organization does not fix the bug is a good way to do this.

Note this practice started in the 1980s or early 1990s because software venders refused to fix security bugs. The full disclosure movement was created because security researchers wanted the bugs fix and publicly disclosing them was the only way to get some organizations to fix their security bugs.

Re: Tell HN: Alaska Airlines website exposes passenger data

#29

Post by StressedDev »

Dalewyn wrote: post #17

>I'll refrain from posting it here so it's not as easy to exploit. I commend your ethics, but I'm going to be straight with you: Alaska isn't going to do anything until tangible harm and damage occurs. The cost to address the problem is higher than the cost to just ignore it. Alaska probably won't think this even is a problem yet, for that matter. If you still want to be an unwarranted gentleman, I would report this…

I don't think this is fair. My guess is the person who found the bug did not report it to a person who knew how to handle a security bug report. My guess is the technical people at Alaska will fix the bug once they know it exists.

Re: Tell HN: Alaska Airlines website exposes passenger data

#30

Post by StressedDev »

rootsudo wrote: post #9

They have an ecomm team and info sec team but they’re pretty unwilling to fix this. They do agile but no one wants to own this, especially in December since they have change freezes and this will affect the yearly and monthly issues. I would advise submitting this is the state of Washington and DOT federal and state. Technically this is a data breach. Atg.wa.gov I would submit a data breach notification this will for…

How do you know they are unwilling to fix this? My guess is it has not been fixed because the people who can fix the bug do not know it exists.
Post reply on HN