Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking the largest airline and hotel rewards platform (2023)

samcurry.net

Post reply on HN
Print view View original

61–70 of 122 posts

Re: Hacking the largest airline and hotel rewards platform (2023)

#61

Post by simondotau »

bogtog wrote: post #59

Is taking the website offline really necessary? If the vulnerability has been there for 1 year or so already, what harm does it being there for 1 year and an hour do? Also, maybe it's not clear to me exactly what is getting taken down, but I'm amazed that the chain from "person reading email" to "person that is permitted to take down the website" moves so quickly (or that the latter right is given so low in the hiera…

Given the real money involved, keeping it online with this flaw in place isn’t an option.

Re: Hacking the largest airline and hotel rewards platform (2023)

#62

Post by ddorian43 »

shakna wrote: post #58
ddorian43 wrote: post #55

Earlier quoted context omitted.

The cookie contents can be changed only if you know the secret config.

Or if you can bruteforce the secret, or if there's a vulnerability in the secret, or if... You're relying on the fact that the cryptography will be impregnable, rather than adopting an actual security posture. Do not trust the data you send to a user, to remain secure.

And you're relying on security through obscurity.

Re: Hacking the largest airline and hotel rewards platform (2023)

#63

Post by ddorian43 »

shakna wrote: post #60
ddorian43 wrote: post #54

Earlier quoted context omitted.

By default flask doesnt have a db. There is flask-sessions extensiom that does this for you.

Or you can just link to a DB directly. A Flask app is just a WSGI app. You can mount and extend it with any kind of Python, no extension necessary.

That's what the extension does for you.

Re: Hacking the largest airline and hotel rewards platform (2023)

#65

Post by dewey »

simondotau wrote: post #61
bogtog wrote: post #59

Is taking the website offline really necessary? If the vulnerability has been there for 1 year or so already, what harm does it being there for 1 year and an hour do? Also, maybe it's not clear to me exactly what is getting taken down, but I'm amazed that the chain from "person reading email" to "person that is permitted to take down the website" moves so quickly (or that the latter right is given so low in the hiera…

Given the real money involved, keeping it online with this flaw in place isn’t an option.

It is a very real option. If it's not being exploited by hundreds of people right now and you make more money keeping the site up vs. what you lose in "fraud" it makes sense to keep it running.

Just like you don't shut down your store if someone stole some merchandise or how credit cards just factor fraud into the fees.

Re: Hacking the largest airline and hotel rewards platform (2023)

#66

Post by shakna »

ddorian43 wrote: post #62
shakna wrote: post #58

Earlier quoted context omitted.

Or if you can bruteforce the secret, or if there's a vulnerability in the secret, or if... You're relying on the fact that the cryptography will be impregnable, rather than adopting an actual security posture. Do not trust the data you send to a user, to remain secure.

And you're relying on security through obscurity.

No. It's relying on both cryptography, and the inaccessiblity of information. Which is a tried, practiced, and often federally mandated, method of security. Controlling who has access to information is sorta security 101. Don't dump your database to the Internet.

Security through obscurity is allowing REST commands to the /totallysecretaddress/neverleaked/ URI.

Re: Hacking the largest airline and hotel rewards platform (2023)

#67

Post by switch007 »

junto wrote: post #6

> On May 2nd, 2023, we identified that the Flask session secret for the points.com global administration website used to manage all airline tenant and customer accounts was the word "secret". After discovering this vulnerability, we were able to resign our session cookies with full super administrator permissions. Seriously?

Makes you wonder if there a colleague who wanted to use Django with the biggest "I told you so" grin right now

Re: Hacking the largest airline and hotel rewards platform (2023)

#68

Post by [deleted] »

samsonradu wrote: post #31
junto wrote: post #6

> On May 2nd, 2023, we identified that the Flask session secret for the points.com global administration website used to manage all airline tenant and customer accounts was the word "secret". After discovering this vulnerability, we were able to resign our session cookies with full super administrator permissions. Seriously?

Also why would anyone store and read data like { 'groups': [...] } on the client-side? Session cookies are supposed to be identifiers only, with the data stored server-side.

[deleted]

Re: Hacking the largest airline and hotel rewards platform (2023)

#69

Post by shakna »

dewey wrote: post #65
simondotau wrote: post #61

Earlier quoted context omitted.

Given the real money involved, keeping it online with this flaw in place isn’t an option.

It is a very real option. If it's not being exploited by hundreds of people right now and you make more money keeping the site up vs. what you lose in "fraud" it makes sense to keep it running. Just like you don't shut down your store if someone stole some merchandise or how credit cards just factor fraud into the fees.

It's often a violation of both government laws and insurance contracts, if you knowingly expose that much financial information to a proven vulnerability.

There are businesses where if you suffer a theft, you shut everything down and run a stocktake. For example, an arms dealer. And there are times credit card providers shut down - because there is a known vulnerability, and they have to immediately mitigate, or lose their insurance.

Post reply on HN