Bypassing airport security via SQL injection (ian.sh)
from jaromil@fed.dyne.org to technology@lemmy.ml on 30 Aug 2024 01:37
https://fed.dyne.org/post/228238

cross-posted from: fed.dyne.org/post/228188

#technology

threaded - newest

bamboo@lemmy.blahaj.zone on 30 Aug 2024 01:56 next collapse

The TSA press office said in a statement that this vulnerability could not be used to access a KCM checkpoint because the TSA initiates a vetting process before issuing a KCM barcode to a new member. However, a KCM barcode is not required to use KCM checkpoints, as the TSO can enter an airline employee ID manually. After we informed the TSA of this, they deleted the section of their website that mentions manually entering an employee ID, and did not respond to our correction. We have confirmed that the interface used by TSOs still allows manual input of employee IDs.

TSA: lalala i can’t hear you, everything is fine, no issue here

bradorsomething@ttrpg.network on 30 Aug 2024 02:48 next collapse

If Security through Obscurity isn’t working, consider Security through Stupidity, I guess.

I worked with some oilfield SCADS folks in the early 2000’s who used open IP for their valves, who were very convinced no one would use their equipment because “no one knew they were there.” At some point, it’s no longer trust in good actors.

Compliments to the authors, someone owes these guys challenge coins.

Botzo@lemmy.world on 30 Aug 2024 05:24 collapse

Good ol’ hanlon’s razor.

jaybone@lemmy.world on 30 Aug 2024 07:16 next collapse

TSA is such a joke. And now we’ll never be rid of them. Thanks Al Quaida, you have successfully achieved your goal of inconveniencing the infidel travelers for decades now. I hope you are happy with yourselves.

delirious_owl@discuss.online on 30 Aug 2024 14:58 collapse

They were created for the purpose of security theater. That intent won’t to away with time

TechnologyChef@lemmy.world on 31 Aug 2024 22:04 collapse

It seems also harmful to our humanity of Amendments treating disabled, brown, and black people without suspicion and abuse.

Taser@lemmy.dbzer0.com on 31 Aug 2024 22:18 collapse

100% not true.

A bar code is required for KCM. Has been for a while now. Manual entries have not been allowed for quite some time.

Darkassassin07@lemmy.ca on 30 Aug 2024 02:02 next collapse

WOW.

I can understand making a mistake in the website design, leaving such a vulnerability; but to shove it under the rug and ghost the people that reported it???

The TSA and DHS are begging for an incident.

Glad Ian Carroll+Sam Curry made the info public. Maybe that’ll be the push needed to actually fix this.

astanix@lemmy.world on 30 Aug 2024 02:21 collapse

I would be shocked if they don’t get enhanced screening every time now… or placed on the do not fly list.

plumcreek@lemmy.ml on 30 Aug 2024 07:06 collapse

Ahhh, the classic “shoot the messengers” defense.

DeltaTangoLima@reddrefuge.com on 30 Aug 2024 05:36 next collapse

Fucking hell. Where’s the incentive for responsible disclosure, if that’s the sort of (non) response you get?

haydng@lemmy.nz on 30 Aug 2024 12:19 next collapse

I’m sorry, but WTF is

We did not want to contact FlyCASS first as it appeared to be operated only by one person and we did not want to alarm them.

They are the company, running the thing. You are going to alarm them a whole lot more by going to the damn DHS. Like, I think DHS and TSA probably do need to know about this, but why not start with the actual intimately responsible party?

sorter_plainview@lemmy.today on 31 Aug 2024 01:42 collapse

I also didn’t understand the logic here. Why did they “did not want to alarm them”? Is it because a one person company can simply fix the issue and not report to any other authority? What is the rationale behind it?

istanbullu@lemmy.ml on 30 Aug 2024 17:17 collapse

This story is hilarious. TSA is comically incompetent.

TechnologyChef@lemmy.world on 31 Aug 2024 22:03 collapse

It seems also harmful to our humanity of Amendments treating disabled, brown, and black people without suspicion and abuse.