Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing airport security via SQL injection

ian.sh

Post reply on HN
Print view View original

91–100 of 459 posts

Re: Bypassing airport security via SQL injection

#91

Post by sandworm101 »

preciousoo wrote: post #50
VyseofArcadia wrote: post #30

Earlier quoted context omitted.

> Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes The article mentions that FlyCASS seems to be run by one person. This isn't a matter of technical chops, this is a matter of someone who is good at navigating bureaucracy convincing the powers that be that they should have a special hook into the system. What should really be inves…

Someting I’ve been thinking about, esp since that crowdstrike debacle. Why do major distributors of infrastructure (msft in case of crowdstrike, DHS/TSA here) not require that vendors with privileged software access have passed some sort of software distribution/security audit? If FlyCASS had been required to undergo basic security testing, this (specific) issue would not exist

They do. But market forces have pushed the standards down. Once upon a time a "pen test team" was a bunch of security ninjas that showed up at your office and did magic things to point out security flaws you didn't know were even a thing. Now it is a online service done remotely by a machine running a script looking for known issues.

Re: Bypassing airport security via SQL injection

#92

Post by dawnerd »

bambax wrote: post #84

This shows that anyone with the slightest motivation to do harm would have zero difficulty replaying 911. The reason there aren't more terrorist attacks isn't because various security agencies around the world protect us from them. It's because there are extremely few terrorists.

It’s also just one of those hard things to prove: is TSA actually stopping attacks like 9/11? The simple presence of them might be enough of a deterrent or we might just be extremely lucky. Seems these days the real threat is drunk passengers attacking flight attendants.

Re: Bypassing airport security via SQL injection

#93

Post by aftbit »

IshKebab wrote: post #52
aftbit wrote: post #14

Earlier quoted context omitted.

You're not wrong, but I would have a hard time as a jury member convicting them of a CFAA violation or whatever for creating a user named "Test TestOnly" with a bright pink image instead of a photo. If they had added themselves as known crewmembers and used that to actually bypass airport screening, then yeah, they'd be in jail.

Yeah so best case you spend tens of thousands on lawyers and probably win. Doing this under your own name is insane.

Best case, assuming you even get charged, your case gets picked up by the EFF, ACLU, IFJ, etc. You spend nothing, you win, and you get a lot of free publicity for your pen testing company.

Worst case, nobody comes to help you, you spend all of your money, still lose the case, end up in a shitty US prison, and get stabbed in the shower by some guy driven crazy by spending months in solitary.

Personally, I would not mess with security research on anything even distantly related to US Gov.

Re: Bypassing airport security via SQL injection

#94

Post by rachofsunshine »

jerf wrote: post #13

You know it's bad when it's so bad that as I write this no one has even bothered talking about how bad storing MD5'd passwords is. This even proves they aren't even so much as salting it, which is itself insufficient for MD5. But that isn't even relevant when you can go traipsing through the SQL query itself just by asking; wouldn't matter how well the passwords were stored.

This used to be a question on the Triplebyte interview almost verbatim, and a huge percentage of (even quite good) engineers got it wrong. I'd say probably <20% both salted and used a cryptographically-secure hash; MD5 specifically came up all the time. And keep in mind that we filtered substantially before this interview, so the baseline is even worse than that!

Re: Bypassing airport security via SQL injection

#95

Post by preciousoo »

vips7L wrote: post #65
preciousoo wrote: post #50

Earlier quoted context omitted.

Someting I’ve been thinking about, esp since that crowdstrike debacle. Why do major distributors of infrastructure (msft in case of crowdstrike, DHS/TSA here) not require that vendors with privileged software access have passed some sort of software distribution/security audit? If FlyCASS had been required to undergo basic security testing, this (specific) issue would not exist

In the case of msft/crowdstrike isn't this exactly the opposite of what HN rallies against? The users installed crowdstrike on their own machines. Why should microsoft be the arbiter of what a user can do to their own system?

Microsoft determines who they give root access signing keys to

Re: Bypassing airport security via SQL injection

#96

Post by pwg »

ravenstine wrote: post #39
hypeatei wrote: post #11

I hate the TSA with every ounce of my being and these articles reinforce why. Incompetent and useless agency that only serves to waste people's time. Can't believe it still exists; 9/11 and the Bush administration really did a number on this country.

They're one of the most seemingly incompetent agencies I am forced to deal with every year. For one, why does is it that every TSA checkpoint feels like it was scrambled together? 9/11 was a long time ago. There's no reason why checkpoints can't have better signage, clearer instructions for what should or shouldn't go on a conveyor belt, an efficient system for returning containers (I've lost count of how many times…

> I can get through with sharp metallic tools and weird unlabeled boxes with wires hanging out of them, but I can't leave my kindle in my backpack?

Because all airport security is reactionary. They don't try to anticipate what an attacker might do, and how they could prevent that. They simply add one more item to a check-list of "no good" items or of "must be separately screened" items.

Therefore, because, one time, someone tried to ignite their shoes, there's now a checkbox that says: "shoes must be scanned separately".

As well, because, one time, someone purportedly tried to mix together two liquids into an explosive that they brought on board in bottles, you are now limited to 100ml max in any bottle, but you can freely walk in with a 7-11 64oz Big Gulp cup and they won't blink an eye. The "bottles" are on the check-list, but the check-list has no entry (yet) for "64oz 7-11 Big Gulp".

Re: Bypassing airport security via SQL injection

#98

Post by rachofsunshine »

cyberax wrote: post #56
anal_reactor wrote: post #36

Earlier quoted context omitted.

The problem boils down to two issues: 1. Ok, security is bad, what are you going to do? Go to different, competing security? 2. Nobody wants to be the politician that relaxes the security right before an accident, even if the accident wouldn't be prevented with tighter security anyway.

> 1. Ok, security is bad, what are you going to do? Go to different, competing security? Amazingly, you can do that. SFO doesn't use the TSA, for example.

Does it not? I fly out of SFO all the time and the experience is very similar. I guess I never checked if it was officially the TSA, but I never noticed any difference.

Re: Bypassing airport security via SQL injection

#99

Post by mariodiana »

So, the trick here would be to purchase a ticket with a major airline, pack a no-no in your carry-on, and then bypass TSA security by adding yourself to the Known Crew Member list of a small airline using the third-party FlyCASS system, via the SQL-injection. You'd then board the major airline with the no-no. Is that the vulnerability?
Post reply on HN