Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing airport security via SQL injection

ian.sh

Post reply on HN
Print view View original

251–260 of 459 posts

Re: Bypassing airport security via SQL injection

#251

Post by marwatk »

raddan wrote: post #172
reaperducer wrote: post #111

Earlier quoted context omitted.

This exists in some European countries, in Hungary for example you have an identity service (KAU) which authenticates you and operates as an SSO provider across a number of different government properties. The United States has it, too: https://login.gov But with a government as large as America's it's going to take time to get everyone converted to the new system.

FWIW, as a regular user of login.gov, from the outside, it looks like a well-designed system. I am able to add strong forms of 2FA (e.g., security keys or biometric authenticators), it requires strong passwords, etc. It also has decent developer documentation, has a support process, and comes with a vulnerability disclosure form baked into the main website. However, I have not used their API, nor have I seen any of t…

> although I wonder if a FOIA request would actually compel them to give it to you

I believe most of it is open source: https://github.com/18F/identity-idp

Re: Bypassing airport security via SQL injection

#252

Post by bigmattystyles »

Honestly, if I discovered and reported this, I'd be so scared of being charged with a crime under the CFAA or some other statute, there are just too many high profile faces that can be covered with egg here.

(edit) the charging guidelines are somewhat re-assuring but still https://www.justice.gov/opa/pr/department-justice-announces-...

Re: Bypassing airport security via SQL injection

#253

Post by bubblethink »

rootusrootus wrote: post #22
hypeatei wrote: post #11

I hate the TSA with every ounce of my being and these articles reinforce why. Incompetent and useless agency that only serves to waste people's time. Can't believe it still exists; 9/11 and the Bush administration really did a number on this country.

It doesn't seem particularly unique to TSA. Flying elsewhere in the world has essentially identical security screening, with all the same stupidity. I'm a little butthurt right now, in particular, about the security at Heathrow. They confiscated a bottle of whisky that we got in Edinburgh. After 10 minutes of head-scratching and consulting with a supervisor, they concluded that "it does not say 100ml" (it had "10cl"…

>It doesn't seem particularly unique to TSA. Flying elsewhere in the world has essentially identical security screening, with all the same stupidity.

That's largely due to the US and 9/11. In fact, the US even pressures other countries into creating a separate mini TSA at their boarding gate for flights that fly into the US.

Re: Bypassing airport security via SQL injection

#254

Post by panic »

_yb2s wrote: post #18

Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes into reading about web programming- and that every decent quality web framework automatically prevents. It is really telling that they try to cover up and deny instead of fix it, but not surprising. That is a natural consequence of authoritarian thinking, which is the entire premise…

In practice, these systems get stronger rather than imploding. Any failure becomes a justification for more power that they can use to "prevent this from ever happening again". A system that ran smoothly and never had issues wouldn't be able to grow like this (and might even shrink as people start to take it for granted).

Re: Bypassing airport security via SQL injection

#255

Post by gouggoug »

VyseofArcadia wrote: post #30
_yb2s wrote: post #18

Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes into reading about web programming- and that every decent quality web framework automatically prevents. It is really telling that they try to cover up and deny instead of fix it, but not surprising. That is a natural consequence of authoritarian thinking, which is the entire premise…

> Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes The article mentions that FlyCASS seems to be run by one person. This isn't a matter of technical chops, this is a matter of someone who is good at navigating bureaucracy convincing the powers that be that they should have a special hook into the system. What should really be inves…

> This isn't a matter of technical chops, this is a matter of someone who is good at navigating bureaucracy convincing the powers that be that they should have a special hook into the system.

I would love to know how one can get what I'd imagine is at least a 6 figures contract with the government? How does this work?

I imagine the author of FlyCASS must be making a good amount of money off their product.

Re: Bypassing airport security via SQL injection

#256

Post by didgetmaster »

_yb2s wrote: post #18

Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes into reading about web programming- and that every decent quality web framework automatically prevents. It is really telling that they try to cover up and deny instead of fix it, but not surprising. That is a natural consequence of authoritarian thinking, which is the entire premise…

I find it amusing (actually more tragic than amusing) that the same politicians who tell us all day that corporations can't be trusted because they are run by people with character flaws (greed, lying, laziness, etc.); will turn around and tell us that handing more power and influence over to a government agency is a good idea.

They make it sound like the job pool between the public and private sector is completely separate when many people move back and forth between the two.

Take away the accountability that often governs the private sector and that seems to be the recipe for situations like this.

Re: Bypassing airport security via SQL injection

#257

Post by filoeleven »

gmueckl wrote: post #158
jrochkind1 wrote: post #45

> We had difficulty identifying the right disclosure contact for this issue. We did not want to contact FlyCASS first as it appeared to be operated only by one person and we did not want to alarm them. Wait, what? Is this a euphemism for they didn't believe they would take it seriously? Reporting it over their heads to DHS was probably not less "alarming" to anyone...

This is confusing to me as well. You could always escalate later, right?

I’m wondering if their thinking was: if they contacted the sole developer, and he perceived it as a threat (whether security or personal livelihood) then the deck is stacked against them when they then have to escalate. The dev has already said “some hackers say they hacked my service” to TSA and kicked the beehive.

I wouldn’t have a clue who to report it to myself; the record of DHS is pretty awful too. Lots of folks are saying (and one even betting on!) them being charged for their find within the next couple of years, and given US federal agencies’ records when it comes to these vulns I’d be quite worried about it too if I had found it.

Re: Bypassing airport security via SQL injection

#258

Post by tedunangst »

not2b wrote: post #179
niklasrde wrote: post #161

Earlier quoted context omitted.

Part of the reason why Crowdstrike have access, why MS wasn't allowed to shut them out with Vista was a regulatory decision, one where they argued that somebody needs to do the job of keeping Windows secure in a way that biased Microsoft can't. So, I guess you could have some sort of escrow third party that isn't Crowdstrike or MS to do this "audit"? Or see this for a much better write up: https://stratechery.com/202…

MS could have provided security hooks similar to BPF in Linux, and similar mechanisms with Apple, rather than having Crowdstrike run arbitrary buggy code at the highest privilege level.

Crowdstrike could have included a BPF interpreter in their driver and used it for all the dangerous logic.

Re: Bypassing airport security via SQL injection

#259

Post by nullindividual »

okwhateverdude wrote: post #151
mariodiana wrote: post #87

Earlier quoted context omitted.

As my good fortune would have it, I'm called to jury duty two weeks from now. I doubt I'll be sat though. Should I be, I'll keep the above in mind.

If you don't want to be sat, just mention Jury Nullification. Courts really hate that sanity check on the process. https://en.wikipedia.org/wiki/Jury_nullification

I told a prosecutor during voir dire that I wouldn’t follow a judge’s instruction if it was a case involving drugs (I think it was a shoplifting case, so not relevant to the particular case). That was enough to be excused by the prosecutor.

Nullification in not so many words.

Post reply on HN