crazy how this makes it all the way to production, I wonder how long this vulnerability was exposed...
Hacking on a plane: Leaking data of millions and taking over any account
41–50 of 91 posts
Re: Hacking on a plane: Leaking data of millions and taking over any account
#42Once a user is logged in, is including their username or userID routine API responses considered bad practice? I don't see why it should be, if everything you can do with that username requires an active login token.
The fact that you could put in an email address in lieu of a username/userID seems irrelevant; lots of systems allow email addresses as a username. What stands out about this to me is: We see in both requests the same `uxd_id` field. This looks to be a temporary login key or validation key generated by the server, that the client would probably use to validate further requests or validate a password change request from that username. It's different in the email than in the live server response so they are generated in different sessions. So...
1) The email reset has two calls. What does the author mean that the first call validates the user's auth? If this is a "forgot password" link for a user who's not logged in, there should be no existing auth (unless that old uxdID functions as a permanent password, but even then, it should be specific to the user). That link should go to a page that issues a new email with a temporary validation token that's tied to the specific user and then emailed back to that user's email address. Unless you could intercept the named user's email there should be no way to know the new token and reset the password.
2) If, on the other hand, it was a reset pass call with the user already logged in, why is the server not checking that uxd_id matches the active login session which also matches the user whose password is to be changed? What's the point of the uxd_id field in the PUT call if not to check that calling user == authorized user == user whose password should be changed? Who would write something like that? For that reason, this looks more like a backdoor for testing password resets that was unintentionally left open.
Am I misunderstanding something about the way this thing is taking tokens to change passwords...? Or is what's described really as simple as "system doesn't check if uxd_id matches user's email on an active session"?
Re: Hacking on a plane: Leaking data of millions and taking over any account
#43Earlier quoted context omitted.
Yep. It's a shame. I once (long ago :)) alerted our CTO to an ongoing attack in production after seeing some obviously attack-oriented requests coming in and hitting our gateway. It became a pretty high-visibility incident for about 20 minutes until a manager spoke up that his "pen test" was being performed. Looking into the "testing" that was occurring they were attempting to scan for decade-old PHP bugs in a set of…
So, to try and add some value to this conversation vs just reporting a personal anecdote... Do people here have suggestions for actually-good white-hat companies? Can you recommend companies that you've personally worked with who employ knowledgeable security engineers (hackers) to perform real penetration tests and conduct valuable security scans resulting in value-add reports your engineering team can work with? No…
NCC Group is probably the biggest name because they go around Hoovering up companies that are usually above average in the competencies you asked about. And they can attract and retain talent.
Trail of Bits is another big name because they hire and retain talent across a large number of enterprise, emerging tech, and research verticals.
Other established firms include Atredis Partners, IOActive, Security Innovation. There are more one could list.
Sometimes these companies work with partners who ask to publicly disclose some artifact resulting from the test. Here is a collection of those reports aggregated by firm: https://github.com/juliocesarfort/public-pentesting-reports (Edit: note this is not a great way to evaluate any particular company, but it does provide an objective listing of companies that exist in the pentesting space).
Each firm will also have variability in their personnel for your project which can yield different results for two independent tests on the same target from the same firm.
Re: Hacking on a plane: Leaking data of millions and taking over any account
#44> Monday (November 21st) the airline was made aware of the issue > Wednesday (November 23rd) resolution has already been tested and deployed That's a pretty nice response time - compared to some big companies that are asking security researchers to not disclose vulnerability for six months.
Especially since the vuln was in a third-party system so the airline couldn't push a fix themselves.
Depends on if it was a security issue or a config issue. From the end user's perspective they can look the same.
Re: Hacking on a plane: Leaking data of millions and taking over any account
#45Not related to the content of the article, but to the presentation: that art work in the header is spot on, except maybe for what appears to be tree branches in the window. I think we are witnessing how generative are killing photo stock business.
I think they are supposed to be the ‘wing’
Maybe. But aside from that little artifact, it is really nice and it fits a description well. And probably it only took the author few moments to get it generated.
Re: Hacking on a plane: Leaking data of millions and taking over any account
#46Not related to the content of the article, but to the presentation: that art work in the header is spot on, except maybe for what appears to be tree branches in the window. I think we are witnessing how generative are killing photo stock business.
Ew yeah the more you look at it the weirder it gets. Like what's between his fingers, or what is that keyboard layout? Is that supposed to be cash sitting on the armrest, or like a plane ticket?
Is he wearing a hoodie or a down jacket, and why is his neck wrap thingie seems to be integrated into the hoodie. Also, he seems to be wearing some sort of leather harness or backpack. Weird stuff!
Re: Hacking on a plane: Leaking data of millions and taking over any account
#47Earlier quoted context omitted.
> The impact of these two bugs was signifcant. It was access to first name, last name, address, and email of the user as well as last 4 digits, expiration date, billing name, and address of the credit cards. Assuming you're a black hat exploiting this bug, what can you do, if the target is using a VPN? I don't know what "address of the credit cards" means, but let's assume it's the target's home address. You don't ge…
> Assuming you're a black hat exploiting this bug, what can you do, if the target is using a VPN? Going by the same logic, what can a black hat exploiting this bug do if the target ISN'T using a VPN? Using or not using a VPN in the context of this bug is totally irrelevant.
Wouldn't that depend on whether this airplane system lets two machines use the same account at the same time?
Re: Hacking on a plane: Leaking data of millions and taking over any account
#48Earlier quoted context omitted.
Ew yeah the more you look at it the weirder it gets. Like what's between his fingers, or what is that keyboard layout? Is that supposed to be cash sitting on the armrest, or like a plane ticket?
Is he wearing a hoodie or a down jacket, and why is his neck wrap thingie seems to be integrated into the hoodie. Also, he seems to be wearing some sort of leather harness or backpack. Weird stuff!
Also what is that seat back, is it his backpack or has he pulled the emergency flotation device out from under his seat already?
Re: Hacking on a plane: Leaking data of millions and taking over any account
#49How is something like this not picked up in a pen test? Can only assume there never has been..
Don't assume it wasn't. I've done tests several years on a row where I pop a service using the first years report.
Kinda like when a government program says they consulted the bar society or the privacy commissioner before going ahead with it.
But if you read their reports, it’s all “no, no, no, no way!!!!!!”
A lot of “consultations” are really “inform/get informed, and ignore it all and do what you were going to do all along anyway”.
But you can check the box to say you did your consultations.
Re: Hacking on a plane: Leaking data of millions and taking over any account
#50When on any sort of public WiFi network, use a VPN. If anyone has a story about how "that's not enough" I'm eager to hear it. Can't be too careful, can we?
It's ok to admit you're wrong; you know that, right? You don't have to dig further down or move the goalposts when it's clearly shown you didn't actually read the article or understand the vulnerability in question.