Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking the largest airline and hotel rewards platform (2023)

samcurry.net

Post reply on HN
Print view View original

81–90 of 122 posts

Re: Hacking the largest airline and hotel rewards platform (2023)

#81

Post by udev4096 »

toyg wrote: post #46
remus wrote: post #38

Earlier quoted context omitted.

It's a strange disconnect between the quality of the incident response and the extremely basic nature of many of the bugs reported. I mean SECRET_KEY='secret'?! Seriously straightforward stuff.

Why? One depends on development practices, the other on security-team practices. You can have a team of donkeys building a product and the sharpest hackers guarding it. Ideally best practices would trickle down, but that's not a given.

Why would anyone even use such a predictable word for dev environment? I am baffled by this practice of not following the bare minimum security mindset even when you are just running it in a dev environment

Re: Hacking the largest airline and hotel rewards platform (2023)

#82

Post by sova »

It's so funny to me, this is normally read aloud as "security vulnerabilities disclosed after patching" but in reality this is a natural part of how software is made. You make compromises. Terrible ones. Security ones. In the beginning. Not always, but some places, some applications, some websites, some languages, sometimes you make some concessions for sake of simplicity or prototyping or proof-of-concept'ing that ends up making it all the way to prod. And then these "vulnerabilities" are really things that mean your company grew way faster than you anticipated, and lucky for you some ethical hackers "exploited" these concessions, first.

Re: Hacking the largest airline and hotel rewards platform (2023)

#83

Post by ddorian43 »

samsonradu wrote: post #80
ddorian43 wrote: post #76

Earlier quoted context omitted.

Because you might have multiple webservers.

There are solutions for that: Shared NAS, sticky sessions etc.

Good luck with maintaining that NAS. Your sticky sessions will logout all users on a server that goes down. It's better to have a db.

Please stop.

Re: Hacking the largest airline and hotel rewards platform (2023)

#84

Post by jessriedel »

shakna wrote: post #69
dewey wrote: post #65

Earlier quoted context omitted.

It is a very real option. If it's not being exploited by hundreds of people right now and you make more money keeping the site up vs. what you lose in "fraud" it makes sense to keep it running. Just like you don't shut down your store if someone stole some merchandise or how credit cards just factor fraud into the fees.

It's often a violation of both government laws and insurance contracts, if you knowingly expose that much financial information to a proven vulnerability. There are businesses where if you suffer a theft, you shut everything down and run a stocktake. For example, an arms dealer. And there are times credit card providers shut down - because there is a known vulnerability, and they have to immediately mitigate, or lose…

Ok, but shutting down the website because of legal/moral responsibility to protect customer info is very different than doing so because of the “real money involved”, which is what commenter dewey was responding to. You can choose to just take the fraud cost hit in the latter case.

Re: Hacking the largest airline and hotel rewards platform (2023)

#85

Post by tehryanx »

dewey wrote: post #65
simondotau wrote: post #61

Earlier quoted context omitted.

Given the real money involved, keeping it online with this flaw in place isn’t an option.

It is a very real option. If it's not being exploited by hundreds of people right now and you make more money keeping the site up vs. what you lose in "fraud" it makes sense to keep it running. Just like you don't shut down your store if someone stole some merchandise or how credit cards just factor fraud into the fees.

I don't think this is a good analogy. It's more like you find that the lock on your stores front door has been broken for a long time and you just hadn't noticed. Nobody has broken in yet, but could at any moment. Also, it's not just your goods and business that are at risk, instead you're responsible for the protection of things that belong to other people.

Re: Hacking the largest airline and hotel rewards platform (2023)

#86

Post by jmb99 »

remus wrote: post #77
toyg wrote: post #46

Earlier quoted context omitted.

Why? One depends on development practices, the other on security-team practices. You can have a team of donkeys building a product and the sharpest hackers guarding it. Ideally best practices would trickle down, but that's not a given.

> You can have a team of donkeys building a product and the sharpest hackers guarding it. You could do but it's a pretty risky way to run a business. Obviously the real world often gets in the way, but a competent manager would look at that org structure and say "shouldn't we move some of those smart ppl on to the build team to catch issues before they're in prod? Seems awfully risky waiting until it's live to catch…

From experience, a lot of talent security people really just don’t want to be developers, even if they’re good at it. It’s not always as simple as shuffling people around between teams.

Re: Hacking the largest airline and hotel rewards platform (2023)

#87

Post by Marsymars »

486sx33 wrote: post #64

Is this why / when airmiles when bankrupt and get bought out at the 11th hour by BMO? https://newsroom.bmo.com/2023-03-10-BMO-Confirms-Agreement-t...

There was nothing abrupt about the Air Miles bankruptcy, they'd been in long-term decline and had lost nearly all of their major partners by that point. I called the BMO purchase months before it happened.

Re: Hacking the largest airline and hotel rewards platform (2023)

#88

Post by samsonradu »

ddorian43 wrote: post #83
samsonradu wrote: post #80

Earlier quoted context omitted.

There are solutions for that: Shared NAS, sticky sessions etc.

Good luck with maintaining that NAS. Your sticky sessions will logout all users on a server that goes down. It's better to have a db. Please stop.

Of course it's better to have a db doh... I'm replying to your

> By default flask doesnt have a db.

Re: Hacking the largest airline and hotel rewards platform (2023)

#89

Post by Thorrez »

hansvm wrote: post #10
jollofricepeas wrote: post #8

Earlier quoted context omitted.

You almost have to pull the site to stroke bounty hunter egos when you could just push a change to prod instead. If not, they are quick to bash you publicly. There’s too much hubris in the “professional” web app bug hunter community. Generally, their attitude is very “look at these stupid developers,” “developers suck at security,” or “a conspiracy is happening because company X didn’t take their app down within 10 m…

> when you could just push a change to prod instead. I wonder if there's an attack vector hiding where you induce a malicious bug via an illegitimate bounty and the developers' bias against inaction.

How about this one: https://hackerone.com/reports/745324

It's a $20k bounty for simply taking a cookie that a HackerOne employee accidentally pasted when responding to a different vuln report on HackerOne.

Re: Hacking the largest airline and hotel rewards platform (2023)

#90

Post by ddorian43 »

samsonradu wrote: post #88
ddorian43 wrote: post #83

Earlier quoted context omitted.

Good luck with maintaining that NAS. Your sticky sessions will logout all users on a server that goes down. It's better to have a db. Please stop.

Of course it's better to have a db doh... I'm replying to your > By default flask doesnt have a db.

People don't have NAS laying around. And don't use a filesystem as a db, especially a remote filesystem.
Post reply on HN