&gt; Now that we are an administrator of Air Transport International...LOL&gt; Unfortunately, our test user was now approved to use both KCM and CASSsmh...

This should be news lol, I’m surprised a bored year 17 year old with a fake id hasn’t made a TikTok sneaking on board a plane. Sql injection ffs

The author made the right move by doing this through FAA and CISA (via DHS), rather than directly via TSA. It&#x27;s not inconceivable that a direct report to TSA would have resulted in legal threats and bluster.

I&#x27;ll take that bet. How long of a time window? 1 year, 2 years?

Those kind of wheels turn very slowly. I will bet any takers $50 that Ian will be prosecuted.

Not surprised that they deny the severity of the issue, but I am quite surprised they didn&#x27;t inform the FBI and&#x2F;or try to have you arrested. Baby steps?

This was a wild read, that something like this could be so easy, but the later part describing the TSA response is incredibly alarming

I don&#x27;t<a href="https:&#x2F;&#x2F;www.schneier.com&#x2F;crypto-gram&#x2F;archives&#x2F;2003&#x2F;0815.html#6" rel="nofollow">https:&#x2F;&#x2F;www.schneier.com&#x2F;crypto-gram&#x2F;archives&#x2F;2003&#x2F;0815.html...</a><a href="https:&#x2F;&#x2F;www.schneier.com&#x2F;essays&#x2F;archives&#x2F;2006&#x2F;11&#x2F;the_boarding_pass_br.html" rel="nofollow">https:&#x2F;&#x2F;www.schneier.com&#x2F;essays&#x2F;archives&#x2F;2006&#x2F;11&#x2F;the_boardin...</a>

Does anyone remember Bruce Schneier and his faked boarding passes? The TSA scribble used to be the weak point of the entire system.

A good old SQL injection negates the entire security theatre worth probably billions a year, hilarious, but probably not all too surprising.

that is apparently not a popular move anymore since people keep logs and have credentials, strong social media presence and readily available cloud enabled cameras. one email to any news org and whoever authorizes the raid will probably face some music. but knowing TSA, we can expect this any minute now...

That&#x27;s not really how this works. TSA is maliciously incompetent, but there is a reporting pipeline and procedure for these things that&#x27;s formalized and designed to protect exactly this kind of good-faith reporting[1].(It&#x27;s very easy to believe the worst possible thing about every corner of our government, since every corner of our government has something bad about it. But it&#x27;s a fundamental error to think that every bad thing is always present in every interaction.)[1]: <a href="https:&#x2F;&#x2F;www.cisa.gov&#x2F;report" rel="nofollow">https:&#x2F;&#x2F;www.cisa.gov&#x2F;report</a>

Yeah, I don&#x27;t know if I would go testing such systems and then reporting the results under my own name (presumably)...I didn&#x27;t see any comment about them being contracted to do this at least.

There&#x27;s still _plenty_ of time for that to happen. I wouldn&#x27;t want to be this person right now. I like my dog alive.

What was surprising to me was that they didn&#x27;t immediately do pre-dawn raids on the pentesters&#x27; homes and hold them without a lawyer under some provision of an anti-terror law.

TSA is DHS, though. At some point, it&#x27;s the same high-level manager...

&gt; It&#x27;s interesting to see that DHS seemingly (initially) handled the report promptly...I think DHS mid level manager yelled at a TSA mid level manager who reported this to the senior TSA officials and then their usual policy kicked in... deny&#x2F;deflect&#x2F;ignore

This is the Transportation SECURITY Agency. If the managers involved here can&#x27;t understand why this is a huge deal, they&#x27;re exceptionally unqualified for their jobs.Edit: Fixed a double negative (previously: This is the Transportation SECURITY Agency. If the managers involved here can&#x27;t understand why this is a huge deal, they&#x27;re not exceptionally unqualified for their jobs.)

Part of being a good manager is knowing how to get good folks to give you advice on things you don&#x27;t understand, and knowing how to follow that advice. Yeah, its hard- but that&#x27;s a huge part of the whole dang job!No manager (or human) is perfect, mistakes happen- we need to be humble enough to listen and learn from mistakes.

&gt;&gt; The TSA&#x27;s response here is childish and embarrassing,&gt; It’s very hard for management, even IT managers,I&#x27;m confident that the grandparent&#x27;s comment is correct.TSA is closer to the issue than HSA; I&#x27;d wager big that they sense embarrassment.¹²TSA management would have immediate access to people capable of framing the issue correctly, including their own parent agency. Their reaction was never going to be held back by technical facts.<pre><code> ¹ US Sec&#x2F;LEO&#x2F;IC agencies have a long and unbroken history of attacking messengers that bring embarrassment. There is ~no crime they are more dedicated to punishing.

 ² The worlds easiest presupposition: Discussions took&#x2F;are taking place on how they might leverage the CFAA to deploy revenge against the author.</code></pre>

It’s very hard for management, even IT managers, to fully understand what such things mean.I’ve seen huge issues, like exposed keys, being treated as a small issue. While an outdated js library, or lack of ip6 support being escalated.I’m sure TSA and their partners wants to downplay potential exposure, I’m also sure it’s hard for a lot of their managers to fully understand what the vulnerability entails (most likely their developers are downplaying their responsibility and pointing fingers at others)

TSA is security theater, it is there to give the illusion of security. In reality it seems more like the goal is the entrenchment of surveillance and the appearance of strength.

The TSA&#x27;s response here is childish and embarrassing, although perhaps unsurprising given the TSA&#x27;s institutional disinterest in actual security. It&#x27;s interesting to see that DHS seemingly (initially) handled the report promptly and professionally, but then failed to maintain top-level authority over the fix and disclosure process.

So you&#x27;re suggesting they&#x27;re not out of the woods?

The statute of limitations is long and HSI often delays their indictment until the investigation is mostly wrapped up.

What if they incremented a number in a url on a publicly available website?

&gt;You&#x27;re not wrong, but I would have a hard time as a jury memberWhich is why Jury selection usually removes people who understand the situation.

Yeah so best case you spend tens of thousands on lawyers and probably win.Doing this under your own name is insane.

That&#x27;s what jury instructions are for. The judge can instruct the jury to ignore pretty much any facts and consider any subset of what really happened that they want. So they&#x27;d just instruct &quot;did they access the system? Were they authorized? If the answer to the first question is yes, and to the second is no, the verdict is guilty, ignore all the rest&quot;. The jury won&#x27;t be from the HN crowd, it would be random people who don&#x27;t know anything about CFAA or computer systems, it will be the easiest thing in the world to convict. Those guys got so lucky DHS exhibited unusually sensible behavior, they could have ruined their lives.

But would it really matter if they were convicted, after being in jail for who knows how long awaiting trial, losing their job, etc?

&gt; You&#x27;re not wrong, but I would have a hard time as a jury member convicting them of a CFAA violation or whatever for creating a user named &quot;Test TestOnly&quot; with a bright pink image instead of a photo.
If they had added themselves as known crewmembers and used that to actually bypass airport screening, then yeah, they&#x27;d be in jail.I think it could go any which way. The prosecution could argue that the defendant may have tampered with existing records or deleted some. In this particular case, it’s probable that the system does not have any or adequate audit trails to prove what exactly transpired. Or the claim could be that the defendant exfiltrated sensitive data (or that the defendant is trying to hide it) to share with hostile entities.

You&#x27;re not wrong, but I would have a hard time as a jury member convicting them of a CFAA violation or whatever for creating a user named &quot;Test TestOnly&quot; with a bright pink image instead of a photo.If they had added themselves as known crewmembers and used that to actually bypass airport screening, then yeah, they&#x27;d be in jail.

I personally don&#x27;t comprehend how these people are taking such a huge risks. Once bureaucrat wakes one morning in the wrong mood and your life is ruined at least for the next decade, maybe forever. Why would anyone do it - just for the thrill of it? I don&#x27;t think they even got paid for it?

I’m not sure any country’s bureaucracy really appreciates responsible disclosures that make the government’s systems look very poorly designed. There is always the risk of being classified as an enemy agent&#x2F;criminal depending on who’s reading the report and their own biases.

If anyone from there reads the parent, they should know they have created an atmosphere where the worry of possible prosecution over responsible disclosure has the potential to scare away the best minds in our country from picking at these systems.That just means the best minds from other, potentially less friendly countries, will do the picking. I doubt they will responsibly disclose.

The timeline mentions the disclosure was made through CISA, and on their website there is an official incident report form.I can imagine an email to some generic email address could have gone down the way you describe, but I guess they look at these reports more professionally.<a href="https:&#x2F;&#x2F;myservices.cisa.gov&#x2F;irf" rel="nofollow">https:&#x2F;&#x2F;myservices.cisa.gov&#x2F;irf</a>

I mean... they still might if the wrong people end up getting embarrassed by this.  The wheels of bureaucracy are slow.

Good catch. Of course, different people wear different shades of hat, and I guess the author might have good rationale for going quite as far as they did, I don&#x27;t know.Kudos to the author for alerting DHS. Methodology questions aside, it sounds like the author did a service, by alerting of a technical vulnerability that would be plausible for a bad actor to seek out and successfully discover.But regardless, I hope any new&#x2F;aspiring security researchers don&#x27;t read this writeup, and assume that they could do something analogous in an investigation, without possibly getting into trouble they&#x27;d sorely regret. Some of the lines are fuzzy and complicated.BTW, if it turns out that the author made a legality&#x2F;responsibility mistake in any of the details of how they investigated, then maybe the best outcome would be to coordinate publishing a genuine mea culpa and post mortem on that. It could explain what the mistake was, why it was a mistake, and what in hindsight they would&#x27;ve done differently. Help others know where the righteous path is, amidst all the fuzziness, and don&#x27;t make contacting the proper authorities look like a mistake.

In some countries where this is the norm, like Germany, the usual route is to report the issue to journalists or to non-profits like the CCC and those then report the issue to the government agency&#x2F;company. This way you won&#x27;t get prosecuted for responsible disclosure. Alternatively an even safer route is to write a report and send it to them anonymously with a hard deadline on public&#x2F;full disclosure, won&#x27;t get any credit for the discovery this way of course.

DHS officially uses bugcrowd, for what it&#x27;s worth.<a href="https:&#x2F;&#x2F;bugcrowd.com&#x2F;engagements&#x2F;dhs-vdp" rel="nofollow">https:&#x2F;&#x2F;bugcrowd.com&#x2F;engagements&#x2F;dhs-vdp</a>They&#x27;ve had that relationship for a few years now, so I&#x27;m guessing they&#x27;re somewhat versed. TSA specifically might be less so, but I can&#x27;t imagine the DHS referring anything to the DOJ for prosecution given that they both have a VDP for the entire department and advise other departments on how to run VDPs (via CISA).But I might just be overly optimistic.

Since they actually went past the SQL injection and then created a fake record for an employee, I&#x27;m shocked that Homeland did not come after and arrest those involved. Homeland would have been top of the list to misinterpret a disclosure and prefer to refer to the disclosure as malicious hacking instead of responsible disclosure. I&#x27;m more impressed by this than the incompetence of the actual issue.

Oh it gets even more amusing. By the logic of the GP, Bush must have impersonated every member of the house and senate because they&#x27;re not aware of how the TSA came into existence&#x2F;how a law is created. The Aviation and Transportation Act garnered broad bipartisan support.

We as a civilization are terrible at getting over things, it seems.

The problem boils down to two issues:1. Ok, security is bad, what are you going to do? Go to different, competing security?2. Nobody wants to be the politician that relaxes the security right before an accident, even if the accident wouldn&#x27;t be prevented with tighter security anyway.

&gt;It doesn&#x27;t seem particularly unique to TSA. Flying elsewhere in the world has essentially identical security screening, with all the same stupidity.That&#x27;s largely due to the US and 9&#x2F;11. In fact, the US even pressures other countries into creating a separate mini TSA at their boarding gate for flights that fly into the US.

It doesn&#x27;t seem particularly unique to TSA. Flying elsewhere in the world has essentially identical security screening, with all the same stupidity.I&#x27;m a little butthurt right now, in particular, about the security at Heathrow. They confiscated a bottle of whisky that we got in Edinburgh. After 10 minutes of head-scratching and consulting with a supervisor, they concluded that &quot;it does not say 100ml&quot; (it had &quot;10cl&quot; cast into the glass) and &quot;even then, that is just the size of the bottle, not the liquid inside it.&quot; What an incredible demonstration of intelligence there.They gave us a receipt and said we could have it shipped. We checked when we got home. 130 GBP with shipping. Ended up just buying a 700ml bottle from an importer, cost about half as much.

&gt; I can get through with sharp metallic tools and weird unlabeled boxes with wires hanging out of them, but I can&#x27;t leave my kindle in my backpack?Because all airport security is reactionary. They don&#x27;t try to anticipate what an attacker might do, and how they could prevent that. They simply add one more item to a check-list of &quot;no good&quot; items or of &quot;must be separately screened&quot; items.Therefore, because, one time, someone tried to ignite their shoes, there&#x27;s now a checkbox that says: &quot;shoes must be scanned separately&quot;.As well, because, one time, someone purportedly tried to mix together two liquids into an explosive that they brought on board in bottles, you are now limited to 100ml max in any bottle, but you can freely walk in with a 7-11 64oz Big Gulp cup and they won&#x27;t blink an eye. The &quot;bottles&quot; are on the check-list, but the check-list has no entry (yet) for &quot;64oz 7-11 Big Gulp&quot;.

They&#x27;re one of the most seemingly incompetent agencies I am forced to deal with every year.For one, why does is it that every TSA checkpoint feels like it was scrambled together? 9&#x2F;11 was a long time ago. There&#x27;s no reason why checkpoints can&#x27;t have better signage, clearer instructions for what should or shouldn&#x27;t go on a conveyor belt, an efficient system for returning containers (I&#x27;ve lost count of how many times the line was held up because employees didn&#x27;t feel like bringing over a stack of containers in clear view), and so on. The checkpoints do seem to go a bit faster than they used to a long time ago, but it&#x27;s still a frustrating process that makes me feel like an imbecile every time I use it. I do my best to follow directions, but directions are often lacking so I have to use my best judgment from past experience, and often get yelled at anyway. Do does the TSA want to be hated?Secondly, there&#x27;s been multiple occasions where I&#x27;ve made it through the security checkpoint with items that should obviously set off red flags. I recently made it through with a humongous center punch which, while not sharp like a knife, could do some serious damage to another person if used as a weapon. Got it through with no questions asked. I&#x27;ve also gotten through with scissors, knives, strangely shaped electronics, a custom build electronic device that a naive person could see as suspicious, and so on. Never have I been stopped for those things.But laptops and e-readers? I&#x27;d better not forget one of them in my carry-on bag or I&#x27;m gonna get shouted at and be forced to re-run the bag through the scanner again. I can get through with sharp metallic tools and weird unlabeled boxes with wires hanging out of them, but I can&#x27;t leave my kindle in my backpack? And what about the humongous battery packs I carry? No problem having 2 or 3 of those in my bag. I guess my Macbook Air or my e-reader possess uniquely dangerous powers I don&#x27;t comprehend. Even if I try to comply with the &quot;laptops out of your bag&quot; rule, I might still get shouted at if I place it in a container instead of right on the conveyor belt... or if I place it in a container with some other belongings next to it.Maybe the TSA stops terrorists that are as stupid as they are, which I guess is a good thing. But how good can stupid people be at catching other stupid people? Is it really worth it to waste everyone else&#x27;s time and to treat them like crap in the process?Yup, not surprised that the TSA also reacts with as much stupidity to cybersecurity flaws. If I became supreme leader overnight, I would work to completely dismantle the TSA and rebuild it from scratch. There doesn&#x27;t appear to be any value in that agency that can&#x27;t be easily replaced with something better.

I hate the TSA with every ounce of my being and these articles reinforce why. Incompetent and useless agency that only serves to waste people&#x27;s time. Can&#x27;t believe it still exists; 9&#x2F;11 and the Bush administration really did a number on this country.

The screenshot in the article shows MD5() is returned as part of the error message from the web server, so it is probably also a part of the original server-side query.

There is already a call to MD5 in the original query; see the first image in the article, which they apparently obtained by submitting &#x27; as the username: <a href="https:&#x2F;&#x2F;images.spr.so&#x2F;cdn-cgi&#x2F;imagedelivery&#x2F;j42No7y-dcokJuNgXeA0ig&#x2F;68274892-b9e5-485b-a7d5-b05ddfb57518&#x2F;Untitled&#x2F;w=3840,quality=90,fit=scale-down" rel="nofollow">https:&#x2F;&#x2F;images.spr.so&#x2F;cdn-cgi&#x2F;imagedelivery&#x2F;j42No7y-dcokJuNg...</a>

The md5 part of the sqli is added by the pentester, likely because they needed a call that would end in a parenthesis within the injection parameter

Damn. Using salts and avoiding MD5 in favour of SHA-1 was well known even around 2005. Rainbow tables were a thing even then.

This used to be a question on the Triplebyte interview almost verbatim, and a huge percentage of (even quite good) engineers got it wrong. I&#x27;d say probably &lt;20% both salted and used a cryptographically-secure hash; MD5 specifically came up all the time. And keep in mind that we filtered substantially before this interview, so the baseline is even worse than that!

You know it&#x27;s bad when it&#x27;s so bad that as I write this no one has even bothered talking about how bad storing MD5&#x27;d passwords is. This even proves they aren&#x27;t even so much as salting it, which is itself insufficient for MD5.But that isn&#x27;t even relevant when you can go traipsing through the SQL query itself just by asking; wouldn&#x27;t matter how well the passwords were stored.

Honestly, this is the most shocking part:&gt; We did not want to contact FlyCASS first as it appeared to be operated only by one person and we did not want to alarm themIt’s incredible (and entirely too credible) that this kind of “high security” integration could be built in such an amateur way: and a good reminder why government projects often seem to be run with more complexity than your startup devs might think is necessary.

Someting I’ve been thinking about, esp since that crowdstrike debacle. Why do major distributors of infrastructure (msft in case of crowdstrike, DHS&#x2F;TSA here) not require that vendors with privileged software access have passed some sort of software distribution&#x2F;security audit? If FlyCASS had been required to undergo basic security testing, this (specific) issue would not exist

We know that backdoors can be intentional for use by 3-letter agencies. And there is plausible deniability of the bureaucracy when they can pass blame onto a single individual.Or it&#x27;s beuracracy being beuracracy. The TSA is a lot of security theater anyways.

The problem is deeper and simpler than that.Authentication should not need to be re-implemented by every single organization. We should have official auth servers so that FlyCASS doesn&#x27;t need to worry about identity management and can instead just hand that off to id.texas.gov (or whatever state they operate from) the same way most single-use tool websites use Google&#x27;s login.

&gt; FlyCASS seems to be run by one personIs their name Jia Tan, by chance?

Based on the language on their site about requiring an existing CASS subscription, my guess is there was no approval at all. It appears this person has knowledge of the CASS&#x2F;KCM systems and APIs, and built a web interface for them that uses the airline&#x27;s credentials to access the central system. My speculation is that ARINC doesn&#x27;t restrict access by network&#x2F;IP, so they wouldn&#x27;t directly know this tool even exists.Some quick googling shows the FlyCASS author used to work for a small airline, so this may piggyback off of his prior experience working with these systems for that job. He just turned it into a separate product and started selling it.The biggest failure here is with ARINC for not properly securing such a critical system for flight safety.

Well my username, &quot;\\&#x27;\truncate table user;;\&#x27;&#x27;&quot;  has served me well over the years.  But some sites I cannot log into for some reason.

&gt; This isn&#x27;t a matter of technical chops, this is a matter of someone who is good at navigating bureaucracy convincing the powers that be that they should have a special hook into the system.I would love to know how one can get what I&#x27;d imagine is at least a 6 figures contract with the government? How does this work?I imagine the author of FlyCASS must be making a good amount of money off their product.

&gt; The article mentions that FlyCASS seems to be run by one person.I wonder if they just subcontract everything? One popular hack of the preferences they give to veterans and minorities in government procurement is to have essentially one person fronts that get maximum preference and which subcontract everything to a real company at a markup.

&gt; Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutesThe article mentions that FlyCASS seems to be run by one person. This isn&#x27;t a matter of technical chops, this is a matter of someone who is good at navigating bureaucracy convincing the powers that be that they should have a special hook into the system.What should really be investigated is who on the government side approved and vetted the initial FlyCASS proposal and subsequent development? And why, as something with a special hook into airline security infrastructure, was it never security audited?

&gt;pretend it never happenedI&#x27;m not suggesting this is what they have done here, but this is exactly what authoritarian governments do. Straight from the pneumatic into the furnace.

For an overtly authoritarian institution it actually surprises me they do the old delete and pretend it never happened approach to basic security.

Just goes to prove that old saying true: &quot;With friends with helicopters, who needs more friends!&quot;

So it&#x27;s also vulnerable to a Helicopter Injection Attack?

&gt; Hilarious that the entire TSA system is vulnerable to the most basic web programming errorBecause it&#x27;s a scam and the system is a grift.I&#x27;m a pilot and own a private aircraft. Landing at any airport, even my home airport which is restricted by TSA is legal without any special requirement or background check. In fact, I have heard horror stories where TSA wouldn&#x27;t let a pilot retrieve their aircraft for some bullshit administrative reason or another, so they enlisted a friend with a helicopter to drop them into the secure area to fly it out. Perfectly legal. The fact that the system can be brought down with a SQL attack is the least of it.

Having done software development with other federal agencies, they probably outsourced maintenance of critical national security mandates to Deloitte who has a team with managers in India running everything with a completely counterproductive culture of hubris solely to make the two managers look good, and anybody that questions that gets terminated in a week

Being that CISA is under the same parent org of TSA that there should be ongoing internal evaluation&#x2F;remediation of sibling services.<a href="https:&#x2F;&#x2F;www.cisa.gov&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.cisa.gov&#x2F;</a>

It might have been an insanely old application that predates SQL injection being common knowledge (or required to be protected against) and has been forgotten about&#x2F;poorly maintained.There are oodles and oodles of apps like this powering our daily lives.

That&#x27;s bc TSA is all theatre. They fail Homeland Security audits more often then they pass. [1]It&#x27;s supposed to give you the illusions of security while giving a DHS a bigger budget, and it employs a lot of low skilled workers.It is what you should think of when you think &quot;big, dumb government.&quot;[1] <a href="https:&#x2F;&#x2F;abcnews.go.com&#x2F;US&#x2F;tsa-fails-tests-latest-undercover-operation-us-airports&#x2F;story?id=51022188" rel="nofollow">https:&#x2F;&#x2F;abcnews.go.com&#x2F;US&#x2F;tsa-fails-tests-latest-undercover-...</a>

TBF, TSA =&#x2F;= &#x27;Trained SQL Administrator&#x27; - so we can&#x27;t hold _that_ against them...

In practice, these systems get stronger rather than imploding.  Any failure becomes a justification for more power that they can use to &quot;prevent this from ever happening again&quot;.  A system that ran smoothly and never had issues wouldn&#x27;t be able to grow like this (and might even shrink as people start to take it for granted).

What mythical private sector accountability are we talking about? A government agency didn’t build the software, it was a one man, private sector company. Maybe the moral is not outsourcing every last thing in existence?

I find it amusing (actually more tragic than amusing) that the same politicians who tell us all day that corporations can&#x27;t be trusted because they are run by people with character flaws (greed, lying, laziness, etc.); will turn around and tell us that handing more power and influence over to a government agency is a good idea.They make it sound like the job pool between the public and private sector is completely separate when many people move back and forth between the two.Take away the accountability that often governs the private sector and that seems to be the recipe for situations like this.

It sure would be nice if someday we get to have some TSA-free airlines and TSA-free flights for people that don’t want to get sprayed by ionizing radiation before every flight but don’t fly often enough to warrant a yearly membership fee. It would be interesting to see what people choose if a choice is available.We haven’t had a large commercial plane go down in over 10 years since 9&#x2F;11. Everyone that comes to the USA has been fully screened, vetted, and background checked. We’re all very safe. Mayorkis at the DHS has made sure there aren’t any terrorists in our homeland because the government only exists to protect us from danger and make our lives better.

Authoritarians don&#x27;t like being challenged like this and it tends to enrage them. Its not unheard of for them to arrest&#x2F;imprison well meaning security researchers who rightfully point out their own failings.That&#x27;s a problem with authoritarian organisations&#x2F;regimes in general. They value loyalty over competence and you end up with people being in positions they shouldn&#x27;t be in.

True but even though I’ve always been careful to escape sql, I’ve also made an oversight once by writing a custom SQL filter and missing to escape it. The code reviews also missed it (we were so used to the framework solving it for us). Luckily a pen test found it and was only shortly in production.

Looks to me like there&#x27;s a reason this vulnerability exists ... for example, to help certain people have a simple way to avoid TSA searches and&#x2F;or credential checks.

Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes into reading about web programming- and that every decent quality web framework automatically prevents.It is really telling that they try to cover up and deny instead of fix it, but not surprising. That is a natural consequence of authoritarian thinking, which is the entire premise and culture of the TSA. Any institution that covers up and ignores existential risks instead of confronting them head on will eventually implode by consequences of its own negligence- which hopefully will happen to the TSA.

I said there should be, not that there will be :)

If there are any criminal charges here it will be for the reporters.
Not the developers.To think otherwise is beyond naive.

The safety of airports and air travel compromised by a simple SQL injection ?What is it, the year 2000 ?It should be a criminal offence for whoever developed that system.

Does anyone know how the KCM barcodes differ from employee IDs? Seems like TSA is indexing pretty heavily on those.

I’m wondering if their thinking was: if they contacted the sole developer, and he perceived it as a threat (whether security or personal livelihood) then the deck is stacked against them when they then have to escalate. The dev has already said “some hackers say they hacked my service” to TSA and kicked the beehive.I wouldn’t have a clue who to report it to myself; the record of DHS is pretty awful too. Lots of folks are saying (and one even betting on!) them being charged for their find within the next couple of years, and given US federal agencies’ records when it comes to these vulns I’d be quite worried about it too if I had found it.

This is confusing to me as well. You could always escalate later, right?

Real reason: the dev would fix it and they&#x27;d be stuffed. That doesn&#x27;t encourage the DHS to actually look into the issue and see what else is broken.

&gt; We had difficulty identifying the right disclosure contact for this issue. We did not want to contact FlyCASS first as it appeared to be operated only by one person and we did not want to alarm them.Wait, what? Is this a euphemism for they didn&#x27;t believe they would take it seriously? Reporting it over their heads to DHS was probably not less &quot;alarming&quot; to anyone...

These aren&#x27;t two dudes acting ethically, these are &quot;two hackers arrested by the FBI for breaking into TSA security&quot;, good job FBI!

And what will homeland security or the FBI get out of it after concluding that that these &quot;dudes&quot; are two well known talented security researchers trying to conduct responsible disclosure to make air travel safer?

The dudes who did this are going to probably be visited by homeland security or FBI. Not sure what they thought they will get out of this. I don&#x27;t think the government cares about security, but they are vengeful.

i wonder if TSA will audit the entire list, also it opens up more questions too like how long accounts remain active? are they simply assuming each airline will update pilot status? they clearly haven&#x27;t been treating this sytem as important it seems.

&gt; 05&#x2F;17&#x2F;2024: Follow-up to DHS CISO about TSA statements (no reply)&gt; 06&#x2F;04&#x2F;2024: Follow-up to DHS CISO about TSA statements (no reply)There should be a public Shitlist of Organisations that don&#x27;t get the Benefit of Responsible Disclosure anymore, just a Pastebin drop linked to 4chan.

&gt; The simple presence of them might be enough of a deterrentThe planning for 9&#x2F;11 took several years, $500k in financing, and had a lot of moving parts between recruiting, research, travel&#x2F;visas, flight training etc. It&#x27;s hard to believe that people motivated at that level would truly be deterred by what you see happening at the typical American airport these days.

Well, the TSA has been tested for their ability to detect weapons being brought through security screenings, and they were absolutely horrible at it. Can&#x27;t grab a link at the moment, but if you search for it, you&#x27;ll easily find the report published... by the TSA.So are they stopping anything serious? It&#x27;s a safe bet they&#x27;re not.

Have they caught and arrested any would-be bad guys? Should be pretty easy to verify.

Thing is, terrorism makes people afraid, even if no attack actually happened; one theory I have is that foiled plots are not reported on. Maybe in 20-50 years some of the records will be unsealed and we&#x27;ll hear about loads of foiled plots.But the counterpoint to that is that a gunman almost succeeded in killing Trump despite showing the behaviours online and offline of your stereotypical amateur assassin.

It’s also just one of those hard things to prove: is TSA actually stopping attacks like 9&#x2F;11? The simple presence of them might be enough of a deterrent or we might just be extremely lucky. Seems these days the real threat is drunk passengers attacking flight attendants.

Not to mention international cooperation, like the Dutch secret service having agents or contacts in Ukraine after MH17 that tipped off the CIA about a possible attack on the Nord Stream pipelines.

Maybe I am a naive idiot, but I would assume that other agencies like the FBI provide some protection even if TSA is not great. I occasionally see notable examples, like the CIA being responsible for discovering planned attacks on the recent Taylor Swift concert in Vienna that was then canceled.

I&#x27;ve written this comment here before, but I&#x27;ll do it again.&quot;Post-9&#x2F;11&quot; began minutes after the first planes found their targets. Flight 93—the one that crashed in Pennsylvania—never made it because the passengers revolted after hearing about the other planes.It only took a few minutes for the calculus to change. Knowing what was up, those passengers flipped from wait-and-see mode to fuck-you mode. This is pretty good evidence that you&#x27;re right: the biggest increase in security was and still is that passengers will not be meek anymore.

Pilots are also now told to not open the cockpit door, no matter what&#x27;s happening in the cabin and to land the plane. There is a near 0 change you could take control of the plane. I would be more concerned about someone bringing a bomb on board.

If you can sneak in armed to a jump seat in the cockpit, better cockpit doors are actually in your favour.

I would argue, the most effective change post 9&#x2F;11, is the reinforcement of cockpit doors, and stricter cockpit access procedures.

&gt; I believe the biggest increase in security since 9&#x2F;11, is that passengers are no longer expected to sit down and behave.While that may be a factor, there&#x27;s never any news about this happening, except maybe shortly after 9&#x2F;11 with shoe or underwear bombs.

I believe the biggest increase in security since 9&#x2F;11, is that passengers are no longer expected to sit down and behave.Pre-9&#x2F;11, the expectation was you don&#x27;t draw attention to yourself, wait it out, you&#x27;re going to have a long day and a story to tell. Post-9&#x2F;11, the expectation is you fight for your life.Better cockpit doors and access hygiene probably come second.

We&#x27;ll never have another golden age of hijacks thanks to 9&#x2F;11.

&gt; The attacks of September 11th 2001 are fundamentally not reproducible irrespective of whether there is _any_ security screening at airports.How so? The delay between the hijacking and the crashes in the buildings for both planes were around 40 minutes... even if there were jet fighters ready to go at the time, the lack of knowledge of the hijacking being in progress for much of this time and the short delay make this kind of attack still feasible.What was actually improved our chances to avoid such attacks are the limited access to the cockpit and processes pilots must follow in case of hijacking.The measures at the airport are to limit the risks of hijackings to begin with.

&gt; zero difficulty replaying 911.The attacks of September 11th 2001 are fundamentally not reproducible irrespective of whether there is _any_ security screening at airports.The default assumption before that morning was that a hijacked plane would fly around for a bit, then land. The default assumption afterwards is that it will be crashed if a hijacker is allowed to gain control, so the calculus on passenger intervention is quite different.

The real reason is that people make mistakes all the time. There is no shortage of potential mass murderers, are there are plenty of successful ones. But if their plans are too ambitious or involve too many people, they tend to fail due to stupid mistakes. And when those stupid mistakes happen, security agencies (and even ordinary police) have a good chance of catching them.

&gt;destabilisation of Middle East diverted them away from continental USI put on my critical thinking hat and look at the timeline of &quot;US meddling in the Middle East&quot; and &quot;first terror attack in the US by a middle eastern&quot;.I then notice that the years are 1948 and 1993 respectively and that wet roads actually do not cause rain after all.

&gt; The reason there aren&#x27;t more terrorist attacks isn&#x27;t because various security agencies around the world protect us from them. It&#x27;s because there are extremely few terrorists.There&#x27;s plenty of terrorists, but destabilisation of Middle East diverted them away from continental US. Wasn&#x27;t that the whole point of Afghanistan and Iraq wars?

This shows that anyone with the slightest motivation to do harm would have zero difficulty replaying 911.The reason there aren&#x27;t more terrorist attacks isn&#x27;t because various security agencies around the world protect us from them. It&#x27;s because there are extremely few terrorists.

... and that was the last time Ian was allowed to fly without a printed boarding pass with SSSS on it.

My presumption was that when you give TSA your ID and they scan it, their systems check that there’s a boarding pass in your name (and DOB)?

Pretty much, although most TsA check lines no longer require even a boarding pass- so in theory you could pack a bomb with you then bypass all the security theater with this.

Yes you could sit in the third seat, the jumper seat, with this. I feel like one could already sneak something malicious through TSA (this already happens and if you attempt it enough times eventually you&#x27;ll get through), but being able to sit in the freaking cockpit behind the pilots who assume you&#x27;re another pilot is CRAZY.

Sounds like you get to sit in the cockpit too?

So, the trick here would be to purchase a ticket with a major airline, pack a no-no in your carry-on, and then bypass TSA security by adding yourself to the Known Crew Member list of a small airline using the third-party FlyCASS system, via the SQL-injection. You&#x27;d then board the major airline with the no-no. Is that the vulnerability?

I found the pink picture underwhelming. So many possibilities, yet a missed opportunity.

yeah i would not mess around with this and get put into a for-life no fly list dude. you even wrote data to the prod system, christ!

You&#x27;d need more than this to board an aircraft, but who&#x27;s to say that the goal of an attacker is to board an aircraft?

At the very least it sounds like you can get the password of many users (MD5 isn&#x27;t exactly secure) and if they&#x27;re sharing passwords then that&#x27;s bad for them. You can also gain admin access and mess around with the site practically undetected for an indefinite amount of time.

Accessing CASS is a big deal, and should be fixed but you’re gonna need more than this to board an aircraft.Also… you can fix all the SQL issues, but you’re still not going to be able to fix the “men in hoodies with a big wrench talk to an authorized administrator (while their kids are kidnapped in Mexico)”

I&#x27;m curious why a small cargo airline would even need to use the KCM system. If they don&#x27;t fly passengers, then wouldn&#x27;t their crew access the aircraft from the cargo ramp (with a SIDA badge) and never need to enter the passenger terminal&#x2F;sterile area?

I mean, yes, in this particular situation it seems like there is many layers of screw ups from several different organizations.Though given that airlines are responsible for the safety of their crew, passengers, and anyone in the vicinity of their aircraft, requiring them to do some basic vetting of their chosen vendors related to safety and security doesn’t seem unreasonable.

The &quot;airlines&quot; that are using something like FlyCASS are themselves smaller operations and typically running on razor thin margins (if not just unprofitable and wishfully thinking that money will suddenly appear and make their business viable). Literally everything on their backend is held together with more duct tape than the average small business.You could be an &quot;airline&quot; by purchasing a couple of older airliners and converting them to cargo use. Is it valuable for new airlines to get started? Should we force them out of business because they don&#x27;t already have the systems in place that take years to decades to build out? Should they pay $$$ for boutique systems designed for a large passenger airline when they have 2 aircraft flying 1 route between nowhere and nowhere?Requirements and audits really aren&#x27;t the answer here. The fundamental design problem is that the TSA has used authentication &quot;airline XXX says you&#x27;re an employee&quot; with a very large blanket authorization &quot;you&#x27;re allowed to bypass all security checks at any airport nationwide&quot; without even the basic step of &quot;does your airline even operate here?&quot;

&gt; We did not want to contact FlyCASS first as it appeared to be operated only by one person...It seems pretty remarkable that airlines are buying such a security sensitive piece of software from a one person shop. If you make it very far into selling any piece of SaaS software to most companies in corporate America, at the absolute minimum they&#x27;re going to ask you for your SOC2 audit report.SOC2 is pretty damn easy to get through with minimal findings as far as audits go, but there are definitely several criteria that would should generate some red flags in your report if the company is operated by a single person. And I would have assumed that if your writing software that integrates with TSA access systems, the requirements would be a whole lot more rigorous than SOC2.

&gt; KCM is a TSA program that allows pilots and flight attendants to bypass security screening, even when flying on domestic personal trips.This program seems like the root cause of the security issue.(Outside of the US) I&#x27;ve often gone through security screenings just before or after crew groups in fast track, but otherwise normal security screening lanes.

Security Theatre 3000... keeping us entertained

Only malicious foreign actors are encouraged to survey the security of systems of national interest, since they can&#x27;t easily get prosecuted. Systems working as intended.

I disagree. Give me an example of a white hat hacker in Germany going to jail.

Straight to jail, if this would have happened in Germany.The TSA would have been the one suing you and would easily win.

Other issues aside my biggest takeaway is that no one at TSA employed even the most basic auditing of external systems accessing their secure process.

I feel like TSA is downplaying it to avoid public backlash. This is not childish or amateur. They are just doing what any government agency would do. If you speak up louder you will get arrested or screwed by some random agency knocking on your door, FYI.

How can this even be possible? What the hell...

What’s so special about bar codes that the testers couldn’t create one themselves?Are they cryptographically signed by a system that was inaccessible?Or is it just a matter of figuring out the bar code format and writing out some KCM id?

SQL was devised far before web apps or the internet were even a thing…

SQL in itself is not the weak point in this case (or any of the other cases of a successful SQLi attack). The problem is the treatment of user-controllable input data and using that data as part of a SQL query without properly sanitising&#x2F;escaping special characters first.

How would you &quot;fix&quot; it, while still allowing people to write ad hoc queries?

really feels like SQL should have never been written in such a fundamentally insecure manner, or immediately fixed once it was discovered that it was

Little Bobby Tables strikes again:<a href="https:&#x2F;&#x2F;xkcd.com&#x2F;327&#x2F;" rel="nofollow">https:&#x2F;&#x2F;xkcd.com&#x2F;327&#x2F;</a>

Love reading this while sitting in the MCO terminal waiting to go home after the fourth non-stop flight in a week.

post it on 4chan from behind seven proxies and let full disclosure do its thing

Yes!Time and time again these cancerous institutions have shown that their only interest is in surviving and they attempt that by concealing the flaws and brutally harassing the people that report them.At this point only useful idiots give them the benefit of the doubt.

They should just leave the system wide open?

Why do people even attempto to disclose this?These guy are going to end up with some serious federal charges.

I’m glad they uncovered and reported this but I’d be super reluctant to actually log in using purloined credentials if I were them. As macNchz says elsewhere in this discussion, CISA&#x2F;TSA&#x2F;DHS does not appear to make any assurances that they won’t prosecute what appears to be a facial CFAA violation just because someone is doing valid security research.To be clear, I really hope they don’t, but they are also clearly trying to spin this in a way at odds with the researchers, and I’d hate to be in a position where they want to have leverage over me if I’d done this.Brave that they did so though and I do think the severity of the vuln warrants this.

If NYTimes or WSJ had any backbone or journalistic integrity, they would write a front page piece on this to fix our agencies from being defensive to bug reports, shed light to the horrid incompetency in these agencies and how there was no oversight to any of this. They would also protect the two individuals as white hat hackers and teach non-technical people that these are good guys. You know, the job of the press.

I don&#x27;t remember any case over the last 5 years or so TSA even asked me for a boarding pass. I think they gave up on that entirely. They do ask for an ID (and take a picture now - looks like bots are better at matching faces than TSA agents) but until you get to the boarding nobody now even looks at the boarding pass, so anything before the gate is freely accessible to anyone with an ID.

Reminds me of the guy that created a simple one-page website to make fake boarding passes, only to get into controlled areas of airports (not to actually fly).&lt;knock&gt; &lt;knock&gt;&#x27;d

I agree they shouldn&#x27;t have written it in such a &quot;now let me embarrass you and show how right I am&quot; way (and they also should have shown a lot more awareness of how embarrassing this was and, also of how: while infosec is super important, there are other priorities that need to be protected in how this is disclosed, too -- especially if they are hoping for constructive engagement with the orgs involved which, like it or not, is what practical security requires, if your point in disclosing is to make a meaningful positive difference, which is really important given the scale&#x2F;scope of this vulnerability), but I don&#x27;t think it worked out bad for these two judging from their Twitter feeds. I don&#x27;t know them, but:Two guys from (or based in) the Midwest:Ian did his first DEFCON talk a couple weeks ago (<a href="https:&#x2F;&#x2F;x.com&#x2F;iangcarroll" rel="nofollow">https:&#x2F;&#x2F;x.com&#x2F;iangcarroll</a>), and Sam (the other author), was the guy that a couple years back Google accidentally sent 200K USD to, and has 81K X followers, and was recently singing the praises of that much lauded recent PHRACK article on &quot;Hacking means understanding the world&quot; (that was also popular round here): <a href="https:&#x2F;&#x2F;x.com&#x2F;samwcyo&#x2F;status&#x2F;1823571295189008601" rel="nofollow">https:&#x2F;&#x2F;x.com&#x2F;samwcyo&#x2F;status&#x2F;1823571295189008601</a>They both seem like legit security researchers from their X feeds.I guess that petulance-tinged adolescent attitude is like the secret handshake of the security researcher world, which sounds too disparaging -- but it&#x27;s not meant to be...only that probably that&#x27;s what you need to expect from folks who &quot;understand the world&quot;, where they&#x27;re smarter, what&#x27;s broken, and should be fixed.I get how that attitude rubs people the wrong way and causes more harm than good - but I don&#x27;t mind it much myself - I guess I just set high expectations for the kind of impact such folks could have, and I think they could have more impact if they adopted a more professional, collegiate attitude in their way of working.But I guess that comes with the territory. Because it&#x27;s really only the &quot;outsiders&quot; who will sit around poking at things to figure out how they work, and how to fix em, make em better. Those who feel themselves to be &quot;rejects&#x27; from the normal world, in sense, are always gonna carry a bit of the tinge of that perspective with them. But, whaddayagonnado? Those are really only gonna be the ones who &quot;understand the world&quot;, so you have to rely on them. Odd couples, that pairing. Between industry and these hackers.

Guys, I think you should not have done this. You can really piss a lot of people off doing that kind of stuff.

Of course the worst part is TSA and Homeland Security trying to sweep everything under the rug and ignoring the problem.

&gt; FlyCASS seems to be run by one personBobby is growing up

Bobby Tables strikes again!<a href="https:&#x2F;&#x2F;xkcd.com&#x2F;327&#x2F;" rel="nofollow">https:&#x2F;&#x2F;xkcd.com&#x2F;327&#x2F;</a>I’m continually amused, amazed, and exasperated at how classes of software defects older than I am continue to be a problem.

Agreed that they wanted to fully understand the extent of the hack before disclosing

Whatever their motive was, the engineering process that allowed such a common bug to sneak in is broken. If the sole developer immediately fixed it, it would have been hard to escalate the issue so that maybe someone up the chain can fix this systematically. I&#x27;m not sure such overhaul would really happen but it&#x27;s more likely that it won&#x27;t if not escalated.

This is exactly the kinda bug where you want to make a big splash though. You don&#x27;t just want the guy to silently fix it, everyone in the database needs to be vetted again.

ya because the person who developed this is totally trustworthy to fully fix it and assess any other possible vulnerabilities. he definitely isn&#x27;t gonna just add a front 
end validation to throw a message on the front end when you submit a single quote...

Yes, and what about the possibility that an attacker already accessed this database and added themself as an employee?Would you rather to be prepared and do a full (well, for a govt agency, full enough) check on all people allowed to access flying death machines, or have a dev silently fix the issue with possible issues later?

I came here to say this. Totally uncalled for not to contact the site first that had these holes and instead go to homeland security.

&gt; We did not want to contact FlyCASS first
&gt; as it appeared to be operated only by one person
&gt; and we did not want to alarm themI’m not buying this. Feels more like they knew the site developer would just fix it immediately and they wanted to make a bigger splash with their findings.

What mind-melting levels of incompetency. I would love to suggest pay raises so the Government can hire better individuals... but I worry the problem is so systemic it wouldn&#x27;t do any good.Everyone dropped the ball... and kept dropping it. The part where its handed to them on a silver platter and its essentially smacked away. Maddening.

this isn&#x27;t a &quot;weakest link breaks the chain&quot; this is a chain with 10000 weak links and we found one.

Honestly, if I discovered and reported this, I&#x27;d be so scared of being charged with a crime under the CFAA or some other statute, there are just too many high profile faces that can be covered with egg here.(edit) the charging guidelines are somewhat re-assuring but still <a href="https:&#x2F;&#x2F;www.justice.gov&#x2F;opa&#x2F;pr&#x2F;department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act" rel="nofollow">https:&#x2F;&#x2F;www.justice.gov&#x2F;opa&#x2F;pr&#x2F;department-justice-announces-...</a>

I wonder how many entities knew about this before today

Why does KCM still need to exist? It doesn&#x27;t help airlines nor air crew:Pilot: &quot;Years ago we’d get a random enhanced check (which just means go to TSA precheck) now and then. These days it’s 60% of the time, so it’s not possible to get a whole crew through KCM anymore, and we wait on each other because the jet can’t be boarded until the flight attendants are ALL through security, and with the 2022&#x2F;2023 KCM random checks being so high, that just doesn’t happen. Honestly, I rarely use KCM anymore. I just walk through TSA precheck. The odds are we’re going there anyway so just cut to the chase and hit precheck.&quot;[1]VIP treatments (including the likes of KCM) should be removed no matter if someone is a prime minister[2], media personality[3] or airline CEO. In this way, VIPs can experience the inadequate security processes and staffing levels that everyone else has to deal with, and hopefully with their louder voices will be able to force airports and government agencies to improve the situation for all.[1] <a href="https:&#x2F;&#x2F;www.quora.com&#x2F;As-a-pilot-how-does-it-feel-like-to-have-a-KCM-membership-to-skip-security-checks&#x2F;answer&#x2F;John-Tringali" rel="nofollow">https:&#x2F;&#x2F;www.quora.com&#x2F;As-a-pilot-how-does-it-feel-like-to-ha...</a>[2] <a href="https:&#x2F;&#x2F;www.theage.com.au&#x2F;national&#x2F;red-faces-as-nz-leader-gets-frisked-20031124-gdwssn.html" rel="nofollow">https:&#x2F;&#x2F;www.theage.com.au&#x2F;national&#x2F;red-faces-as-nz-leader-ge...</a>[3] <a href="https:&#x2F;&#x2F;www.smh.com.au&#x2F;traveller&#x2F;travel-news&#x2F;louise-milligan-sydney-airport-incident-security-rules-may-change-after-abc-journalists-humiliating-experience-20220624-h24nhb.html" rel="nofollow">https:&#x2F;&#x2F;www.smh.com.au&#x2F;traveller&#x2F;travel-news&#x2F;louise-milligan...</a>

Lol, that&#x27;s the oldest trick [fail?] in the book

TSA is a $10.4B [1] security theater and mistake born out of fear.Out of that multibillion dollar budget, TSA allocates $10.4M for “cybersecurity staffing, as well as the development and implementation of enhanced cybersecurity-related measures to improve cyber resiliency across the U.S. Transportation Systems Sector.”Glad to see our tax dollars working so effectively! \sWhat a joke of a country this is[1] <a href="https:&#x2F;&#x2F;www.tsa.gov&#x2F;news&#x2F;press&#x2F;testimony&#x2F;2023&#x2F;03&#x2F;29&#x2F;fiscal-year-2024-presidents-budget-request-transportation-security" rel="nofollow">https:&#x2F;&#x2F;www.tsa.gov&#x2F;news&#x2F;press&#x2F;testimony&#x2F;2023&#x2F;03&#x2F;29&#x2F;fiscal-y...</a>

SQL injection, a real blast from the past, like a child with mumps

Very brave of them to report this. They&#x27;re likely on no-fly lists for life now, and will probably be investigated by the FBI. The government does not like to be embarrassed.

I&#x27;m not sure I&#x27;d write this off because having a weak spot like this and information gained could lead to more discovery of the obscure. It&#x27;s never a good security design to rely on someone never finding my secret API routes that I named after my co-workers that I despised

I am sorry, are you non-sarcastically arguing that being able to pass through airport security, potentially accessing cockpits and planting bombs onboard airplanes, with a high-school level SQL injection on a federal website used by dozens of airlines &amp; airlines employees, is actually, &quot;fine&quot;?Besides, I am not sure what sort of &quot;security through obscurity&quot; you are talking about? Ian and Sam found it, and frankly - with a public page, page title + first h1 tag clearly stating that this relates to a Cockpit Access system, this has got to show up in a shit ton of security research search engines instantly.

Every person working in security, or even familiar with security, would know how to exploit this. It was a ticking time bomb. And it gives you admin access to the entire system. People could have already have exploited it and we wouldn&#x27;t even know.

While this report is embarrassing for all involved, in a practical sense, I&#x27;d argue the security of this app was &quot;fine.&quot;What I mean: security through obscurity is imo the best situation to be in. You can&#x27;t attack something if you don&#x27;t know it exists in the first place. That alone gives this system a leg up over more exposed (but hardened) platforms.Second, convenience always beats secure. Requiring password rotations is worse than requiring none at all, because people tend to find the path of least resistance (writing a password on a notepad instead of memorizing).If it was faster&#x2F;easier to ship a useful (but vulnerable) app, that&#x27;s net better than the app not shipping at all because of security hurdles. I have to imagine sanitizing inputs doesn&#x27;t take much more time to include, but I don&#x27;t know the systems involved.Ultimately, what damage was experienced here? We can throw out hypotheticals about what -could- have happened, but you can&#x27;t sue every driver on the road because they -could- have hit you.An insecure system served a useful purpose for years, got more secure, and continues ticking.

I wouldn&#x27;t get myself into this honestly. Wrong turn and you&#x27;re a terrorist. Especially with how crooked and backward the people responsible for it seem.

Little Bobby Tables&#x27; story is still a valuable lesson.

I can&#x27;t find the essay now, but I remember reading something from years and years ago: Bruce Schneier arguing that it made sense for airline pilots to go through security with everyone else, in spite of the silly appearance, because the inherent complication in implementing a two tier system would both eat up efficiency gains and unavoidably introduce security flaws.He convinced me at the time, but I wasn&#x27;t expecting such an on-the-nose demonstration.

Like something you&#x27;d see in a movie and think &quot;well, that could never really happen&quot;. Yikes.

Because you can&#x27;t get near the pilots anymore, and because everybody assumes a hijack is suicidal and reacts accordingly.

Maybe a SQL injection gets you onto the plane, but crashing that plane gets your country destroyed and the neighboring ones bombed for good measure.What the US lacks in cybersec, it tends to make up for with IRL pew pews...

Makes you wonder why there were no plane hijacks since 9&#x2F;11. TSA does not seem a credible prevention mechanism given how easy it is to go around it.

Meanwhile, my wife just had a beautiful ameythyst she bought as a birthday gift for my son stolen by security in Mexico because it &quot;could be used as a weapon&quot;. I say stolen because they wouldn&#x27;t throw it away and just smirked the whole time at her.It is sadly an all-too-common occurence when you give uneducated dimwits police-level power with no oversight and no recourse for anyone affected. I assume flexing government power is the real objective here since everybody knows that security is not.

Well, government is being government. I never think bureaucracy could solve an issue when they could just hide it.

It&#x27;s a stupid system anyway. Corrupt airline staff can easily bypass all security checks, bring a pistol in a handbag and leave that in the cabin luggage bin for prearranged pickup by an unscrupulous passenger or any sort of shenanigans.How do they protect against corrupt staff. It&#x27;s like they&#x27;re not even thinking. Why don&#x27;t they just fast track staff checks.

Xnxnxnkzjzmxnnzcskdyxk buenos días amor cómo amaneciste mi cielo bello como te fue en el estudio shdtdhdc te e dicho algo y me avisas cuando llegues a tu casa para ti gracias a Dios por tu salud te amo mucho en el trabajo de dgd
Je je pero no sé dónde es eso de las cosas y te sientes por usted es que no me avisas cuando te e udbgzdh si te amo más extremo de

Part of the issue here may be the policy of &quot;need to know&quot; for these high profile secret systems. If the only person who &quot;needs to know&quot; doesn&#x27;t know what they&#x27;re doing then the proper audits of the code will never be done.

Bypassing airport security via SQL injection