SQL injection, a real blast from the past, like a child with mumps
Bypassing airport security via SQL injection
281–290 of 459 posts
Re: Bypassing airport security via SQL injection
#282Earlier quoted context omitted.
This exists in some European countries, in Hungary for example you have an identity service (KAU) which authenticates you and operates as an SSO provider across a number of different government properties.
This exists in some European countries, in Hungary for example you have an identity service (KAU) which authenticates you and operates as an SSO provider across a number of different government properties. The United States has it, too: https://login.gov But with a government as large as America's it's going to take time to get everyone converted to the new system.
The first bullet point on the /partners page of login.gov (regarding who should use it) says:
> You are part of a federal agency or a state, local, or territory government
I'm talking about a more generic service that any random industry system or individual can use. The way many websites use Google's OAuth without using really using Google's APIs. Things that just want someone else (Google) to handle asking for and authenticating a name/password.
Re: Bypassing airport security via SQL injection
#283Earlier quoted context omitted.
The problem is deeper and simpler than that. Authentication should not need to be re-implemented by every single organization. We should have official auth servers so that FlyCASS doesn't need to worry about identity management and can instead just hand that off to id.texas.gov (or whatever state they operate from) the same way most single-use tool websites use Google's login.
> single-use tool websites use Google's login Topic drift, but no tools should use google login. Doing that means handing over to google the authority to decide who can and can't use your tool. And we all know google support is nonexistent and unreachable, so once it fails it's forever. If you market a tool, you'd really want to own the decision on who you can sell it to. For a government organization though, I'd agr…
Trusting Google's OAuth not to vanish overnight is less stressful than managing your own username/password database.
And that's pretty much my point. 2FA? Password Resets? Account Activation? Updating Email Address? No thanks. I would rather not have to deal with any of that. I literally just need a unique identifier to associate with your data and preferences.
Re: Bypassing airport security via SQL injection
#284Earlier quoted context omitted.
It doesn't seem particularly unique to TSA. Flying elsewhere in the world has essentially identical security screening, with all the same stupidity. I'm a little butthurt right now, in particular, about the security at Heathrow. They confiscated a bottle of whisky that we got in Edinburgh. After 10 minutes of head-scratching and consulting with a supervisor, they concluded that "it does not say 100ml" (it had "10cl"…
>It doesn't seem particularly unique to TSA. Flying elsewhere in the world has essentially identical security screening, with all the same stupidity. That's largely due to the US and 9/11. In fact, the US even pressures other countries into creating a separate mini TSA at their boarding gate for flights that fly into the US.
What other countries do a mini-TSA? Is it only countries who don't have a normal security screening that is comparable to TSA?
Re: Bypassing airport security via SQL injection
#285Earlier quoted context omitted.
It's an excellent choice IMO from his perspective. They grant citizenship after 1 year with not a lot of questions and have a cash economy. And they don't extradite to the US.
They'll also not above confiscating your cash and killing you if its suits them. Or (before the war) they wouldn't think twice to send you to Russia to be used as a bargaining chip.
Weev is effectively banned from the banking system. The list of places with enough infrastructure to survive as a hacker, without foreign citizenship and in a cash/crypto economy with no extradition treaty is thin. I'm sure Transnistria might do that but apparently it wasn't worth their time to kill him. Seems better than North Korea, Iran, or the bush of Africa.
Re: Bypassing airport security via SQL injection
#286Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes into reading about web programming- and that every decent quality web framework automatically prevents. It is really telling that they try to cover up and deny instead of fix it, but not surprising. That is a natural consequence of authoritarian thinking, which is the entire premise…
Authoritarians don't like being challenged like this and it tends to enrage them. Its not unheard of for them to arrest/imprison well meaning security researchers who rightfully point out their own failings.
That's a problem with authoritarian organisations/regimes in general. They value loyalty over competence and you end up with people being in positions they shouldn't be in.
Re: Bypassing airport security via SQL injection
#287Earlier quoted context omitted.
I'll say they are worthless because most of time they are dragging time away from things that could improve security. For example, $LastJob we spent a ton of time on SOC2 compliance and despite having applications with known vulnerabilities, we got hacked and ended up all over the news. Maybe of instead of spending all the time getting SOC2 compliance finished, we could have worked at upgrading those apps. Actually,…
SOC2 covers a set of vectors (mostly social/separation of controls from what I’ve seen), and you were attacked on another vector. Maybe the org prioritized poorly and sucks overall, but that doesn’t mean SOC2 or compliance generally is worthless.
>SOC2 covers a set of vectors (mostly social/separation of controls from what I’ve seen)
THAT WAS THE PROBLEM. My bad, I thought most hacks were due poor software management but I'm glad SOC2 truly addressed the real problem.
Re: Bypassing airport security via SQL injection
#288Very brave of them to report this. They're likely on no-fly lists for life now, and will probably be investigated by the FBI. The government does not like to be embarrassed.
Re: Bypassing airport security via SQL injection
#289Earlier quoted context omitted.
>It doesn't seem particularly unique to TSA. Flying elsewhere in the world has essentially identical security screening, with all the same stupidity. That's largely due to the US and 9/11. In fact, the US even pressures other countries into creating a separate mini TSA at their boarding gate for flights that fly into the US.
What other countries do a mini-TSA? Is it only countries who don't have a normal security screening that is comparable to TSA?
No, it's just more theatre. They'll have more stooges at the gate where they'll run your bag through a scanner and do this (https://x.com/VCBrags/status/1595473294878048257). They do it in India, only for US bound flights.
Re: Bypassing airport security via SQL injection
#290This shows that anyone with the slightest motivation to do harm would have zero difficulty replaying 911. The reason there aren't more terrorist attacks isn't because various security agencies around the world protect us from them. It's because there are extremely few terrorists.
> The reason there aren't more terrorist attacks isn't because various security agencies around the world protect us from them. It's because there are extremely few terrorists. There's plenty of terrorists, but destabilisation of Middle East diverted them away from continental US. Wasn't that the whole point of Afghanistan and Iraq wars?
[deleted]