Guys, I think you should not have done this. You can really piss a lot of people off doing that kind of stuff.
Bypassing airport security via SQL injection
211–220 of 459 posts
Re: Bypassing airport security via SQL injection
#212Earlier quoted context omitted.
It’s also just one of those hard things to prove: is TSA actually stopping attacks like 9/11? The simple presence of them might be enough of a deterrent or we might just be extremely lucky. Seems these days the real threat is drunk passengers attacking flight attendants.
Have they caught and arrested any would-be bad guys? Should be pretty easy to verify.
Well Guantanamo Bay still exists.
From https://en.m.wikipedia.org/wiki/Guantanamo_Bay_detention_cam...:
> As of August 2024, at least 780 persons from 48 countries have been detained at the camp since its creation, of whom 740 had been transferred elsewhere, 9 died in custody, and 30 remain; only 16 detainees have ever been charged by the U.S. with criminal offenses.
Given what we do know about the secretive and illegal activities of the federal government during the War on Terror I don’t think it’s a reasonable assumption that everyone accused of terrorist activity got their day in court.
Re: Bypassing airport security via SQL injection
#213Of course the worst part is TSA and Homeland Security trying to sweep everything under the rug and ignoring the problem.
Re: Bypassing airport security via SQL injection
#214Bobby Tables strikes again!
I’m continually amused, amazed, and exasperated at how classes of software defects older than I am continue to be a problem.
Re: Bypassing airport security via SQL injection
#215Guys, I think you should not have done this. You can really piss a lot of people off doing that kind of stuff.
Reminds me of the guy that created a simple one-page website to make fake boarding passes, only to get into controlled areas of airports (not to actually fly).
'd
Re: Bypassing airport security via SQL injection
#216Earlier quoted context omitted.
> Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes The article mentions that FlyCASS seems to be run by one person. This isn't a matter of technical chops, this is a matter of someone who is good at navigating bureaucracy convincing the powers that be that they should have a special hook into the system. What should really be inves…
Someting I’ve been thinking about, esp since that crowdstrike debacle. Why do major distributors of infrastructure (msft in case of crowdstrike, DHS/TSA here) not require that vendors with privileged software access have passed some sort of software distribution/security audit? If FlyCASS had been required to undergo basic security testing, this (specific) issue would not exist
Oh they usually do require some kind of proof of security certification. However the checkbox audits to get those certs and the kinds of solutions employed to allow them to check off the boxes are the real problem.
Re: Bypassing airport security via SQL injection
#217Earlier quoted context omitted.
Part of the reason why Crowdstrike have access, why MS wasn't allowed to shut them out with Vista was a regulatory decision, one where they argued that somebody needs to do the job of keeping Windows secure in a way that biased Microsoft can't. So, I guess you could have some sort of escrow third party that isn't Crowdstrike or MS to do this "audit"? Or see this for a much better write up: https://stratechery.com/202…
MS could have provided security hooks similar to BPF in Linux, and similar mechanisms with Apple, rather than having Crowdstrike run arbitrary buggy code at the highest privilege level.
They could have, however the timeline the regulators gave Microsoft to comply was incompatible with the amount of work required to build such system. With a legal deadline hanging over their heads Microsoft chose to hand over the keys to their existing tools.
Re: Bypassing airport security via SQL injection
#218> We did not want to contact FlyCASS first as it appeared to be operated only by one person... It seems pretty remarkable that airlines are buying such a security sensitive piece of software from a one person shop. If you make it very far into selling any piece of SaaS software to most companies in corporate America, at the absolute minimum they're going to ask you for your SOC2 audit report. SOC2 is pretty damn easy…
The "airlines" that are using something like FlyCASS are themselves smaller operations and typically running on razor thin margins (if not just unprofitable and wishfully thinking that money will suddenly appear and make their business viable). Literally everything on their backend is held together with more duct tape than the average small business. You could be an "airline" by purchasing a couple of older airliners…
I mean, yes, in this particular situation it seems like there is many layers of screw ups from several different organizations.
Though given that airlines are responsible for the safety of their crew, passengers, and anyone in the vicinity of their aircraft, requiring them to do some basic vetting of their chosen vendors related to safety and security doesn’t seem unreasonable.
Re: Bypassing airport security via SQL injection
#219Earlier quoted context omitted.
This exists in some European countries, in Hungary for example you have an identity service (KAU) which authenticates you and operates as an SSO provider across a number of different government properties.
This exists in some European countries, in Hungary for example you have an identity service (KAU) which authenticates you and operates as an SSO provider across a number of different government properties. The United States has it, too: https://login.gov But with a government as large as America's it's going to take time to get everyone converted to the new system.
Americans as a whole are so allergic to government doing anything that we can't even get a national ID system
nor a centralized database of gun sales or ownership.
The bogeyman of evil Big Government, privacy, and censorship gets invoked.
It's fine if the Free Market does it, so Google, Facebook, Amazon, Twitter, Microsoft, et al get a free pass.
Re: Bypassing airport security via SQL injection
#220Little Bobby Tables strikes again: https://xkcd.com/327/
really feels like SQL should have never been written in such a fundamentally insecure manner, or immediately fixed once it was discovered that it was
How would you "fix" it, while still allowing people to write ad hoc queries?