Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking the largest airline and hotel rewards platform (2023)

samcurry.net

Post reply on HN
Print view View original

31–40 of 122 posts

Re: Hacking the largest airline and hotel rewards platform (2023)

#31

Post by samsonradu »

junto wrote: post #6

> On May 2nd, 2023, we identified that the Flask session secret for the points.com global administration website used to manage all airline tenant and customer accounts was the word "secret". After discovering this vulnerability, we were able to resign our session cookies with full super administrator permissions. Seriously?

Also why would anyone store and read data like { 'groups': [...] } on the client-side? Session cookies are supposed to be identifiers only, with the data stored server-side.

Re: Hacking the largest airline and hotel rewards platform (2023)

#32

Post by [deleted] »

TrackerFF wrote: post #15
alwa wrote: post #3

I’m really impressed at the number of times they say their counterparts responded to their report in under an hour, immediately took the affected site offline, then resolved the issue quickly. That seems like an enviable operation.

Makes me wonder if they (points.com) have some key-word alerts on incoming emails. I know for sure that at some companies, this would have taken hours (to days!) to detect, if the tip had come through a regular info@ or contact@ inbox.

[deleted]

Re: Hacking the largest airline and hotel rewards platform (2023)

#33

Post by yard2010 »

jsemrau wrote: post #16
ZephyrBlu wrote: post #12

Insane vulnerabilities. The massive mismatches between authentication and authorization scopes are crazy. Encrypting data with "secret" as the key is also a facepalm.

Someone didn't bother reading my carefully prepared memo on commonly-used passwords. Now, then, as I so meticulously pointed out, the four most-used passwords are: love, sex, secret, and...

Password.

The username is Cyril Figgis.

Re: Hacking the largest airline and hotel rewards platform (2023)

#34

Post by bakje »

TrackerFF wrote: post #15
alwa wrote: post #3

I’m really impressed at the number of times they say their counterparts responded to their report in under an hour, immediately took the affected site offline, then resolved the issue quickly. That seems like an enviable operation.

Makes me wonder if they (points.com) have some key-word alerts on incoming emails. I know for sure that at some companies, this would have taken hours (to days!) to detect, if the tip had come through a regular info@ or contact@ inbox.

The article mentions a security.txt[1] which doesn't seem to contain an email address but it does contain a link[2] to a disclosure program, I'm guessing that's how they submitted all their findings?

[1] https://www.points.com/.well-known/security.txt

[2] https://bugcrowd.com/plusgrade-vdp-pro

Re: Hacking the largest airline and hotel rewards platform (2023)

#35

Post by ddorian43 »

samsonradu wrote: post #31
junto wrote: post #6

> On May 2nd, 2023, we identified that the Flask session secret for the points.com global administration website used to manage all airline tenant and customer accounts was the word "secret". After discovering this vulnerability, we were able to resign our session cookies with full super administrator permissions. Seriously?

Also why would anyone store and read data like { 'groups': [...] } on the client-side? Session cookies are supposed to be identifiers only, with the data stored server-side.

By default sessions in Flask are stored in plaintext:

> This is implemented on top of cookies for you and signs the cookies cryptographically. What this means is that the user could look at the contents of your cookie but not modify it, unless they know the secret key used for signing.

Re: Hacking the largest airline and hotel rewards platform (2023)

#37

Post by michaelt »

joatmon-snoo wrote: post #9
alwa wrote: post #3

I’m really impressed at the number of times they say their counterparts responded to their report in under an hour, immediately took the affected site offline, then resolved the issue quickly. That seems like an enviable operation.

Seriously! I actually can’t think of any openly documented security incident with such impressive remediation timelines. There’s a lot that has to go into fixing things on such a tight timeline too: - oncall-level alerting for your security.txt inbox - your oncall needs to either be someone who can actually take corrective action on the system in question (not easy in a large company!) or able to route the issue to t…

> - oncall-level alerting for your security.txt inbox

Maybe the terminology is different in your company, but my employer has an 'operations' team which has several shifts of workers, who look after things that need 24/7 monitoring. They then triage and escalate as appropriate.

That's who you'd have monitoring the security inbox, if you want round-the-clock monitoring, so nobody's getting woken several times a night by spam.

Re: Hacking the largest airline and hotel rewards platform (2023)

#38

Post by remus »

alwa wrote: post #3

I’m really impressed at the number of times they say their counterparts responded to their report in under an hour, immediately took the affected site offline, then resolved the issue quickly. That seems like an enviable operation.

It's a strange disconnect between the quality of the incident response and the extremely basic nature of many of the bugs reported. I mean SECRET_KEY='secret'?! Seriously straightforward stuff.

Re: Hacking the largest airline and hotel rewards platform (2023)

#39

Post by sangeeth96 »

I've always felt most such rewards program portals and apps were more hack-jobs than serious applications and thus, would be riddled with issues like these. I'm from India and I see many of these sites come and go all the time but not a single one has inspired confidence in me about keeping my data safe. For example, even the topmost cards here (HDFC Diners/Infinia) have a shoddy website, mostly a reskinned version of their generic rewards platform/partner.

And I'm not just hand-waving here cause there are many forums that discuss taking advantage of their bad implementations to maximize returns. Even when one eventually gets patched, another springs up.

Re: Hacking the largest airline and hotel rewards platform (2023)

#40

Post by throwawaysleep »

rootsudo wrote: post #5

Fun read! So close to unlimited point generation and process tickets for those fancy flights~ I would say if you wanted to generate "free" flights, which is entirely possible, learn how GDS works and the workflow for a ticket purchase and how a coupon is attached ;) but that would probably be going to far then just normal poking and secure disclosure but there is enough techdebt that if you know how one airline proce…

Any recommended resources for learning GDS?
Post reply on HN