Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing airport security via SQL injection

ian.sh

Post reply on HN
Print view View original

341–350 of 459 posts

Re: Bypassing airport security via SQL injection

#341

Post by brohee »

pinkmuffinere wrote: post #154
doctorpangloss wrote: post #145

Earlier quoted context omitted.

> The value of those kinds of blanket security audits is questionable, You're totally right. Why are people afraid to say that they're worthless? Why caveat or equivocate? Adversaries in computer security do not mince words.

“Worthless” is quite a strong claim. There isn’t much work I’ve encountered that’s truly “worthless”, even though bad work can make me quite upset. Anyways, that’s why I would often caveat.

Mandatory audits by accredited auditors in order to participate in a market, inevitably create a market for accredited auditors that don't uncover too much but ensure all checkboxes are ticked. Much of the security industry is actually selling CYA and not actual security. The same dynamic at play means buyiong a home/boat/car you should get your own inspector, not blindly trust the seller's.

Re: Bypassing airport security via SQL injection

#342

Post by creesch »

Laaas wrote: post #332
raxxorraxor wrote: post #321

Earlier quoted context omitted.

Why is it critical for flight safety? It is critical for security theatre we have to endure at airports because some people have heightened neuroticism. Be that as it may, of course the error needs correction. If it really is a one man show for tool like this, it isn't even surprising that there are shortcuts.

Imagine if you could bring your own water, and drown in it! Horrifying!

Tell you haven't read the article without telling me you haven't read the article.

Re: Bypassing airport security via SQL injection

#343

Post by Sammi »

amelius wrote: post #241
AndrewKemendo wrote: post #176

Earlier quoted context omitted.

This right here people need to pay attention to gut the following reason: One person can make a lot of impact The most common thing I hear people say with respect to their jobs is: “I’m just one person, I can’t actually do anything to make things better/worse…” But it’s just wrong and there’s thousands of examples of exactly that over and over and over In this case, if this is true, it’s both amazing that: One person…

Yeah but this is not very actionable. It is like saying that one person can win the lottery. You have to be in the right place at the right time.

The lottery has many players and few winners.

Real life is all of us and all of us have an enormous impact in some way. Especially if we try and apply ourselves. Not all the time, not for everything, but if we try enough things enough times and learn and grow, then people usually come out with impressive results of some sorts after a while.

People overestimate what can be done in the short term, and underestimate what can be done in the long term.

In a lottery the ratio is against you. In real life the ratio is almost guaranteed in your favor in some respect in the long term for anyone who tries.

Chin up.

Re: Bypassing airport security via SQL injection

#344

Post by sydd »

raxxorraxor wrote: post #321
timdorr wrote: post #159

Earlier quoted context omitted.

Based on the language on their site about requiring an existing CASS subscription, my guess is there was no approval at all. It appears this person has knowledge of the CASS/KCM systems and APIs, and built a web interface for them that uses the airline's credentials to access the central system. My speculation is that ARINC doesn't restrict access by network/IP, so they wouldn't directly know this tool even exists. S…

Why is it critical for flight safety? It is critical for security theatre we have to endure at airports because some people have heightened neuroticism. Be that as it may, of course the error needs correction. If it really is a one man show for tool like this, it isn't even surprising that there are shortcuts.

Because your luggage is not checked at all. I'm sure that a state level actor could circumvent TSA but an amateur could not, and they pose a huge threat too, see the recent bombing attempt at the Tailor Swift concert or the Trump assassination attempt

Re: Bypassing airport security via SQL injection

#345

Post by akoboldfrying »

nucleardog wrote: post #295
akoboldfrying wrote: post #220

Earlier quoted context omitted.

How would you "fix" it, while still allowing people to write ad hoc queries?

Don't allow non-parameterized queries at all? Like right at the protocol and parser level? Strip "literal value" as a token right out of the query parser. Then a simple interactive client could do something like: ``` > select * from users where username = :username username? admin +----+----------+----------+ | id | username | password | +----+----------+----------+ | 7 | admin | 12345 | +----+----------+----------+…

Well, I agree that this would be a force acting in the direction of Good, though it's hard to gauge how much

>There's, of course, nothing stopping any given library or application from doing the same thing

would happen. People already use a library to talk to the RDBMS back end; a "convenience wrapper" library that adds literals back into the grammar sounds like something that might easily become popular, and then you're back to square one.

The question of how best to nudge people away from these footguns is certainly interesting, and applicable to other languages (e.g., HTML). Another option would be to allow, say, BASE64-encoded literals only.

Re: Bypassing airport security via SQL injection

#346

Post by CPLX »

raxxorraxor wrote: post #321
timdorr wrote: post #159

Earlier quoted context omitted.

Based on the language on their site about requiring an existing CASS subscription, my guess is there was no approval at all. It appears this person has knowledge of the CASS/KCM systems and APIs, and built a web interface for them that uses the airline's credentials to access the central system. My speculation is that ARINC doesn't restrict access by network/IP, so they wouldn't directly know this tool even exists. S…

Why is it critical for flight safety? It is critical for security theatre we have to endure at airports because some people have heightened neuroticism. Be that as it may, of course the error needs correction. If it really is a one man show for tool like this, it isn't even surprising that there are shortcuts.

Allowing literally anyone to get into any airport and into any locked cockpit without any screening is critical to flight safety. If you can’t immediately see why I’m not sure what to tell you.

Re: Bypassing airport security via SQL injection

#347

Post by t0mas88 »

newscracker wrote: post #296
aftbit wrote: post #14

Earlier quoted context omitted.

You're not wrong, but I would have a hard time as a jury member convicting them of a CFAA violation or whatever for creating a user named "Test TestOnly" with a bright pink image instead of a photo. If they had added themselves as known crewmembers and used that to actually bypass airport screening, then yeah, they'd be in jail.

> You're not wrong, but I would have a hard time as a jury member convicting them of a CFAA violation or whatever for creating a user named "Test TestOnly" with a bright pink image instead of a photo. If they had added themselves as known crewmembers and used that to actually bypass airport screening, then yeah, they'd be in jail. I think it could go any which way. The prosecution could argue that the defendant may h…

If the system has no audit logs, the prosecutor would have no evidence of any of that.

And in a system this broken the defence could even argue that anyone could have done it and modified the logs to implicate the defendant. You can't use any data from this system as evidence.

Re: Bypassing airport security via SQL injection

#348

Post by cqqxo4zV46cp »

_yb2s wrote: post #18

Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes into reading about web programming- and that every decent quality web framework automatically prevents. It is really telling that they try to cover up and deny instead of fix it, but not surprising. That is a natural consequence of authoritarian thinking, which is the entire premise…

[dead]

Re: Bypassing airport security via SQL injection

#349

Post by lvturner »

kva-gad-fly wrote: post #226
woodruffw wrote: post #77

Earlier quoted context omitted.

They often do. The value of those kinds of blanket security audits is questionable, however. (This is one of the reasons I'm generally pro-OSS for digital infrastructure: security quickly becomes a compliance game at the scale of government, meaning that it's more about diligently completing checklists and demonstrating that diligence than about critically evaluating a component's security. OSS doesn't make software…

Even if these govt. security audits are checkboxes, dont they require some nominal pentesting and black box testing, which test for things like SQL injection? That shoudl have caught these types of exposures?

It may not apply to this specific incident, but pen-testing only ensures you meet a minimum standard at a specific point in time.

I almost feel I could write novels (if only I had time and could adequately structure my thoughts!) on this and adjacent topics but the simple fact is that the SDLC in a lot of enterprises/organizations is fundamentally broken, unfortunately a huge portion of what breaks it tends to occur long before a developer even starts bashing out some code.

Re: Bypassing airport security via SQL injection

#350

Post by bubblethink »

77pt77 wrote: post #320
bubblethink wrote: post #253

Earlier quoted context omitted.

>It doesn't seem particularly unique to TSA. Flying elsewhere in the world has essentially identical security screening, with all the same stupidity. That's largely due to the US and 9/11. In fact, the US even pressures other countries into creating a separate mini TSA at their boarding gate for flights that fly into the US.

You are confusing TSA with CBP. Some countries allow you to clear CBP on the boarding side, skipping it at the destination. It's like Ireland/Dublin, Aruba and a few others.

I don't mean TSA or CBP literally. I am aware of the programs you are talking about. I'm talking about unofficial/soft-power policy that adds additional barriers pre-boarding for flights that fly into the US. You won't see this in the west/EU. I suspect it's more widespread in the rest of the world.
Post reply on HN