How to own an airline in 3 easy steps and grab the TSA nofly list along the way

https://maia.crimew.gay/posts/how-to-hack-an-airline/

1028 478 4 years ago

maia.crimew.gay

Headline buries the real lede a bit in my opinion; the author has gotten a snapshot of the no-fly list from 2019. Presumably the system under attack processes more up-to-date versions of it regularly.

Corresponding news story: https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotecte...

karlkatzke• 4 years ago

Also seems to have gotten a crew list from the CommutAir’s CASS or possibly from other airlines as part of the shared deadheading crew list, which includes crew addresses and employment information.

There were also prod AWS credentials in the files exposed in Jenkins.

ryandrake• 4 years ago

I wonder which no-fly list it is. Is it a government no-fly list that would contain suspected international criminals and terrorists, or an airline's private no-fly list that would contain people who cause a ruckus on flights, drunks, anti-maskers, and so on. Maybe one shared between airlines? I would imagine that second list has grown substantially since 2020 given all the craziness airlines have had to deal with since then.

Rhinozz4• 4 years ago

The Daily Dot article specifies that it's the United States' (the Terrorist Screening Center's).

asn0• 4 years ago

the nofly csv is almost 80mb in size and contains over 1.56 million rows of data. this HAS to be the real deal (we later get confirmation that it is indeed a copy of the nofly list from 2019).

stolen_biscuit• 4 years ago

read the article before speculating? it answers that question

birdyrooster5• 4 years ago

You can follow their steps to find this data it’s not that hard. Then do whatever you want with it. Shodan isn’t some mythical tool.

NieDzejkob• 4 years ago

They say the access got closed before publication.

racnid• 4 years ago

Basically any air charter service (no matter how small) will have access to the no fly list. It's honestly surprising that it's not up to date online within minutes.

DocTomoe• 4 years ago

If I was the US government, I would add some fake but legitimate-looking IDs in such lists, different ones for every airline I send the list to, so I can identify who leaked the list ex post facto, and come down with God's Wrath on any airline that leaked theirs.

But then, I am not a Bond-esque criminal organization bent for world domination.

shadowgovt4• 4 years ago

And as always... Never use production data in the test pipeline.

At the very least, I don't think the company was operating like every random developer should have full-access to the no-fly list, which is what they de-facto gave them when they dumped an old copy into the test pipeline.

personjerry• 4 years ago

with pretty much no skill required

Seriously? I know like none of the tools or terms they used, like wtf is shodan?

In general the author doesn't seem to follow the white hat guidelines, and I'd be worried what they've done is quite illegal (possibly on a federal level if the nofly list is so secret)

jkingsman2• 4 years ago

maia[0] (it/she pronouns) is almost certainly aware of that this is illegal, and has been indicted by a grand jury for other government hacks.

shodan[1] is a search engine that deals in hosts and ip addresses rather than web pages, and is a goldmine for finding everything from exposed ip webcams to jenkins instances.

[0] https://en.wikipedia.org/wiki/Maia_arson_crimew

[1] https://www.shodan.io/

mrsuprawsm• 4 years ago

US law is neither a universal law nor an international one.

Accessing computer systems owned by a US company based in the US might constitute a violation of US law, but the hacker is based in Switzerland - where US law does not apply.

As you can see in the linked Wikipedia article, accessing these systems is probably not illegal in Switzerland, thus, for all intents and purposes, no crime was committed.

srgpqt• 4 years ago

"Look at you, hacker. A pathetic creature of meat and bone. Panting and sweating as you run through my corridors. How can you challenge a perfect immortal machine?" — Shodan

KyleBerezin3• 4 years ago

You actually have most likely come across mentions of shodan if you use HN often. It is that search engine for insecure systems like exposed/insecure webcams.

mpeg• 4 years ago

Anyone even tangentially involved in infosec knows shodan though... so in that context everything done in the article was trivial.

atlasunshrugged• 4 years ago

As a nontechnical person who enjoys this stuff, also wasn't familiar. Anyone have a good rec for a starter guide for a nontechnical person to be able to do similar research (albeit in ideally more of a white hat approach)?

intelVISA• 4 years ago

Hosting public facing Jenkins should be illegal tbh

mihaaly3• 4 years ago

I think she used publicly available common tools in this regard without specific knowledge of the airline industry. Even searching the internet is a special skill for those never used a computer or held a smartphone but is a no brainer for those never created a search engine algorithm.

sureglymop• 4 years ago

I know those tools and i agree. There's no skill required to use a search engine for compromised/misconducted servers to find a compromised/misconfigured server and then pile around on it. I don't think it's so good to publish it instead of reporting to the airline but I'm pretty sure that is for political reasons considering the author's political views.

jkingsman2• 4 years ago

For those unaware, maia is a pretty prolific hacktivist, and it has been indicted by a grand jury for a variety of USA govt penetrations but has USA proceedings on hold until it's extradited, which it's confident won't happen.

https://en.wikipedia.org/wiki/Maia_arson_crimew

yellow_lead• 4 years ago

so are there any repercussions for hacking US entities from switzerland ? Not that I think there ought to be.

nibbleshifter3• 4 years ago

The Swiss tend to make your life vaguely difficult by confiscating your computers every now and then at the request of the US.

You won't be extradited though.

The Swiss could maybe prosecute domestically, but its not (currently) in the public interest to do so.

ericpauley2• 4 years ago

This is clearly on the darker side of gray-hat. Hate to be preachy but anyone seeking to emulate this sort of attack-finding should consider their ethical obligations as a computer scientist and follow best practices for responsible disclosure. It appears this was completely ignored here, including sharing stolen sensitive data of normal people with whoever can plead a case.

calvinmorrison3• 4 years ago

Yeah cause we should totally have a top secret no fly list

ericpauley2• 4 years ago

Maybe we should or shouldn't, but the potential victims of this aren't just some greedy corporation. Leaking the no fly list could cause irreparable harm to individuals whose names are on it or even similar, causing discrimination by employers and other organizations.

steve_adams_86• 4 years ago

Though I don’t like the idea of it, I’m also not certain that I know better than people whose careers are in national defence. I’m not convinced that it’s a black and white thing. There are bad actors out there, and sometimes it’s clearly advantageous to hide information from them, which means hiding it from everyone.

Maybe there are reasons this is short sighted or I’m missing a greater point. I’d be interested to hear ideas in any case.

UniverseHacker4• 4 years ago

Am I missing something? It seems Maia didn't share the data at all, and only offers to if someone can demonstrate they will use it responsibly.

Moreover, depending on the contents of the list, this likely offers proof of what is generally suspected, that the no fly list is a form of discrimination and authoritarian overreach, targeting people that haven't been convicted of a crime but are "suspected" due to race, religion, etc. The whole thing is probably unconstitutional/illegal, but it's hard to prove that since it's been secret.

This seems like a clear case of hacktivism- trying to expose an unethical government program for what it is, so that it can be stopped.

toss13• 4 years ago

>demonstrate they will use it responsibly.

The problem is to define "demonstrate" and the criteria. Remember the gatekeeper is now an unemployed gal who "know lot's of things about cyber security" according to her main page. Seems likely a competent bad actor could easily impersonate a well-meaning reporter...

Yes, security through obscurity isn't security, but this also seems incredibly irresponsible for any "security researcher". AFAIK, just basic standard good practice is to report the flaws and allow a reasonable interval before publishing, and there seems to be no hint of this.

Modern society really is held together with duct tape, baling twine, and a few pieces of bubble gum...

[EDIT: pronouns]

Pixeleen2• 4 years ago

I get the impression that she's/it's doing this from a place of pain and desire to lash out, and "the system" is an easy target for her to fix onto. Not out of any sense of morality.

lamontcg4• 4 years ago

Maia didn't share the data at all

You literally immediately falsified that assertion:

and only offers to if someone can demonstrate they will use it responsibly.

And nobody ever lies of course.

infoseek12• 4 years ago

And incidentally some of it is entirely illegal but sense she is already facing extradition for a federal indictment - in for a penny, in for a pound.

WatchDog• 4 years ago

Seems to making it's prosecutors jobs really easy, by incriminating itself.

ripdog9• 4 years ago

Perhaps this is just my autism speaking, but am I the only one who gets completely freaked out by sentences like the above? "It" refers to inanimate objects, things which can't have free will, do crimes, or be prosecuted.

It's almost like you're talking about how a lawnmower decided to run a child over and then incriminate itself by boasting about it on social media. It makes no sense!

I know she picked that pronoun herself, but I really wish she didn't. It just makes communication difficult.

driverdan• 4 years ago

You have it backwards. Ethical obligations mean unethical things like government blacklists should be leaked in their entirety.

Miner49er2• 4 years ago

Maybe I missed it, but what data of normal people was stolen?

Rebelgecko2• 4 years ago

full names, addresses, phone numbers, passport numbers, pilot's license numbers, when their next linecheck is due and much more

dclowd99013• 4 years ago

Hacker is anti-capitalist (cool), so I’m not sure they’re concerned with what hat they’re wearing in the endeavor.

Graciously, though, they’re at least feigning caution with handing out the no-fly list.

this_steve_j• 4 years ago

Hard agree here, with a qualifier.

Breaking into private S3 buckets because you are bored is not considered an appropriate “Step 1” by the _professional community_ (people who get paid to do this for a living) at large.

Among people who plan to be financially rewarded for their work and also not be in handcuffs, Step 1 is usually to “Get written permission”.

justinpombrio• 4 years ago

Cached version from the internet archive: http://web.archive.org/web/20230119220130/https://maia.crime...

mananaysiempre2• 4 years ago

From the accompanying (and linked) Daily Dot article[1]:

On the list were several notable figures, including the recently freed Russian arms dealer Viktor Bout, alongside over 16 potential aliases for him.
[...]
Numerous names included aliases that were common misspellings or slightly altered versions of their names.

For non-natively-Latin names, the US government is thorough to the point of hilarity in including every possible romanization and misspelling of one, and they list full names not their individual parts so combinatorics ahoy, as well. For example, if you know a bit of any Slavic language written in Cyrillic, browse the Russian sanction lists, it’s going to give you a chuckle.

In all seriousness, this actually makes perfect sense given the prospective consumers of the lists may not have any clue about the languages the targeted people speak. It’s just that the article makes 16 aliases sound vaguely sinister, whereas if you’re a Russian—or, for that matter, a Ukrainian or a Belarusian—that’s just a reasonably low estimate for how many romanizations of your name people may think up. (Not that Bout isn’t sinister as hell.)

[1] https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotecte...

Scoundreller2• 4 years ago

It’s bad in Canada too, where they don’t even use dates of birth, so small children end up caught on a no-fly-list:

https://www.cbc.ca/news/canada/london/no-fly-child-redress-1...

interestica2• 4 years ago

"On Wednesday, Public Safety Minister Bill Blair said in the coming days, certain travellers, like Sebastian Khan, will be able to apply for a Canadian Travel Number, a unique number they will be able to use when they book a flight to distinguish them from people on the list."

Soon they'll give everyone a number so they can travel. And print it out in physical form too. And call it a passport.

That "solution" seems a bit backwards.

l0b0• 4 years ago

Shouldn't take much for this to overflow beyond 2**whatever names, which is probably going to be all sorts of fun for the 1970s software probably involved in processing this data.

WrtCdEvrydy• 4 years ago

... nah, it has error catching, it just won't process beyond that much.

twunde• 4 years ago

Relatively off-topic, but I absolutely love the 90s/early 2000s vibes I get from this. I can't remember the last time I saw a webring, much less one with animated logos.

half-kh-hacker• 4 years ago

that's my webring :3

KyleBerezin3• 4 years ago

I spent like 30 mins clicking links lol. brings back old memories of a web long gone. oatmealine's site also convinced me to install cowsay

wedn3sday• 4 years ago

This whole thing has made me incredibly happy to see that somewhere, someone out there on the internet is pwning people for stupid vulnerabilities and posting about it on a site that looks like this one. I admit the flashing ACAB really did it for me.

novok• 4 years ago

It's even more entertaining when the people who make it weren't even alive or old enough to understand or have memory of it. It's a bit of a trip for me.

Made me realize that 'vintage' basically means to many people 'things that are before my living memory' and it can literally only be 0 to 5 years back before they were born.

teaearlgraycold• 4 years ago

Anything post WW2 and pre 1995 feels pretty much the same to me.

agotterer• 4 years ago

Also loved the vibe. One of the web ring sites goes to http://cyber.dabamos.de/88x31/ which was an absolute blast from the past!

berniedurfee• 4 years ago

I got 1983 vibes of Matthew Broderick owning an airline in 3 easy steps to grab tickets to Paris.

richwater• 4 years ago

I love the implication that this random person should be the authority on whether or not I can see the no-fly list.

belval• 4 years ago

I mean she pretty much explains the whole process of getting it. If you're willing to get prosecuted just go get it yourself.

Rhinozz4• 4 years ago

In the Daily Dot article above:

CommuteAir added that the server, which was taken offline prior to publication after being flagged by the Daily Dot, did not expose any customer information based on an initial investigation.

vunicipna3• 4 years ago

I wouldn't be surprised if he gets added to the list as well after pulling this stunt.

ceejayoz3• 4 years ago

She's already been indicted on federal charges for hacking. Not being allowed to fly wouldn't be the main issue if she found her way into an American airport or airliner.

https://en.wikipedia.org/wiki/Maia_arson_crimew

KyleBerezin3• 4 years ago

So the fact that she has gained access to this restricted list, has somehow granted you entitlement to it? Or are you implying that every person on that list should be doxed to satisfy your curiosity?

raydiatian• 4 years ago

Wow, actual hacker news.

For once.

Meanwhile, another front page article is some genius asking why there aren’t any cars in 1984.

Animats• 4 years ago

They should just send the list to the New York Times and Fox News.

birdyrooster5• 4 years ago

Maia should try proton mail, it’s fine

vortegne• 4 years ago

maia is Swiss, i don't think protonmail is fine

https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre...

birdyrooster5• 4 years ago

Oh damn lol

culi7• 4 years ago

Suspected members of the IRA, the Irish paramilitary organization, were also on the list.

Oof the international politics always come out in things like this. Twitter also publicizes all of its suspensions and bans. There's a Wikipedia article with a list of all the notable suspensions since 2010. It's interesting to see that, contrary to popular narratives, many of the international groups banned were actually far-left aligned.

The list gets really boring the more you scroll down however. The last notable ban was Paul Graham for simply sharing their Mastodon handle. A boring dystopia indeed

https://en.wikipedia.org/wiki/Twitter_suspensions

zeveb• 4 years ago

The last notable ban was Paul Graham for simply sharing their Mastodon handle.

Paul Graham is a man, not a plural entity.

0x44• 4 years ago

Singular they predates singular you in the English language by about three hundred years.

mproud2• 4 years ago

A very modern convention is now using “they/their” when a person may not be aware of someone’s preferred pronoun. And even still, I have also seen people abandon gendered pronouns entirely.

plusminusplus2• 4 years ago

"the suspect jumped in their car and fled the scene"

In English the word can be used as a singular pronoun

emsixteen• 4 years ago

Good observation! Hope this wasn't an attempted, and failed, grammar 'correction'?

dmix• 4 years ago

It's interesting to see that, contrary to popular narratives, many of the international groups banned were actually far-left aligned.

The list that Wikipedia determines "notable suspensions" is probably not the best gauge to counter "popular narratives". What Wikipedia chooses to highlight is often the sum of actual popular narratives - not simply popular protests [1]- which is sourced almost entirely from the media and then filtered through the culture found among Wikipedia power users.

A raw database of suspensions and their rationale [2] would probably be the only useful analysis.

[1] The people most often protesting bans aren't always the people getting the most media-sourceable attention for their bans

[2] Recent leaks show that that the US state/federal gov employees (and other well connected power players) often sent lists of tens/hundreds of accounts to be banned and Twitter employees often retroactively found reasons to do so when the given reason wasn't justified. So both the rationale and "notable" part both have questionable value for general analysis

lettergram• 4 years ago

It's also possible that wikipedia (and the editors there of) are more likely to be far-left aligned / knowledgeable -- thus leaving the far-right unaccounted for.

That said, I also see bans of accounts with few followers regularly being far-right (white supremacist jokes for instance). They may just not be able to gather large followings at this point and / or be on alternative platforms.

kragen• 4 years ago

he didn't share his mastodon handle, since that had been prohibited; he just said he had one and you could look on his site for it

KennyBlanken• 4 years ago

contrary to popular narratives, many of the international groups banned were actually far-left aligned.

Massachusetts state police posted a photo on twitter from inside one of the emergency management command post whatever facilities.

In the background was a projector screen showing a web browser and in the toolbar was at least one link to a facebook group for one of the occupy movements.

Of course, no visible bookmarks to any of the state's numerous white supremacist or far right groups.

Those polo-shirt-and-khaki wearing clowns? From numerous accounts by witnesses, reporters, and photos on twitter they received what amounted to a police escort from the public transit station where they all parked, all the way into the city...and then from the transit station to their protest site. And then back again.

See: FBI report from a decade or two ago citing the huge problem with white supremacist groups infiltrating law enforcement.

actually_a_dog• 4 years ago

I looked at the 2022 ban list and didn't see anything I recognized as "far left" until Elon took over.

dang3• 4 years ago

We detached this subthread from https://news.ycombinator.com/item?id=34446878.

culi7• 4 years ago

too political?

sc077y• 4 years ago

????? I just went through the entire table of suspended people and there were almost no far left groups besides Antifa. Most of the suspended were either far-right/alt-right, trump related, doxing related or spreading miss-information.

elnr2• 4 years ago

Suspected members of the IRA, the Irish paramilitary organization, were also on the list.

A list that details primarily terrorists having terrorists listed on it. Colour me surprised.

colanderman• 4 years ago

Interesting to see ASCII SOH/STX/ETX in the wild! (^A, ^B, ^C in the .RCV files.)

papercrane• 4 years ago

Those are pretty standard ACARS messages. It's the only time I've seen SOH/STX/ETX used, probably because originally in the 70s they were designed to be typed used with Telex machines.

arcastroe• 4 years ago

This guy is a (hobbyist?) security researcher who responsibly alerts companies of vulnerabilities.

However are his actions of downloading the no fly list and offering to share with journalists legal? Or does that cross into overreach and criminal activity?

munk-a• 4 years ago

The fact that they can do it so casually means there's a problem journalists need to know about.

easrng2• 4 years ago

it isn't a guy and it uses it/its pronouns.

ripdog9• 4 years ago

What? "It" identifies as an inanimate object? This neopronoun thing really is getting absurd.

arp2424• 4 years ago

This is downvoted, but the homepage really does say "hello i am maia arson crimew (it/she)".

I'd feel uncomfortable referring to anyone as "it" though, as there are some connotations with that :-/

kristofferR• 4 years ago

Guys doesn't refer to men anymore, it's now a neutral word that can refer to both genders.

pelasaco• 4 years ago

Interesting to see in which prison "it" will land

culi7• 4 years ago

I think you're confused. The main person in the OP is crimew. The Daily Dot article talks about her in the first few paragraphs but towards the end they talk about a different security researcher that came across the same-ish list from a different source

qbasic_forever• 4 years ago

The laws around digital access to networks are archaic and very broad, they were mostly defined in the 80s and 90s. I believe any unauthorized access (i.e. not having consent from the owner/operator) to a private network is technically a crime. Even if the Jenkins server was open, I bet finding and using the S3 credentials would have crossed the line of the law. Those S3 buckets are private and if you didn't have permission to access them, even if you have the credentials because you found them elsewhere, you could be breaking the law.

account-53• 4 years ago

Regards the archaic laws I'm not convinced, they tend to just parallel real world crimes. For example if you parallel it to the real world then the crime of trespass covers the Jenkins server situation (you can trespass on land that is open and easy to access) and you still commit a crime if you enter a house where you found the key on the floor outside the door, which covers the S3 situation.

logifail2• 4 years ago

downloading the no fly list and offering to share

(This is a genuine question) but where's the actual value in having this list?

I'm afraid I regard it as yet another piece of security theatre.

Full disclosure: my passport always fails to scan at the UK Border automated gates.

I had a discussion this week with yet another border agent after getting another "seek assistance" message and having to queue for a manual check.

I pushed for more information on why, for the last couple of years, it refuses to scan.

He suggested it's because I have very common first and middle names (although my surname is not common at all), so let's say I'm called Alice Bob MacQuaffle, someone called Alice and/or Bob is "on a list" somewhere. I would bet a substantial sum there is no-one on any terrorist watch list called MacQuaffle.

This sounds like someone approved a ridiculously broad match, meaning anyone called Alice and/or Bob is inconvenienced every single time they go near a border.

I would prefer to be safe when travelling just like the next guy, but matching watch lists using common first names ... only .... really?

japanman4254• 4 years ago

It’s trivial to change your name in the UK so this is bonkers.

autoexec2• 4 years ago

We can be pretty sure it's not to protect anyone. Anybody too dangerous to allow on an airplane should probably be behind bars. What it does accomplish is letting the government punish people without justification let alone a trial and with pretty much no transparency or consequences when innocent people end up being hurt by it. I imagine that's a power which is hard to surrender, and 'we the people' haven't exactly been insisting that they give it up either.

dboreham2• 4 years ago

No passport in my family of 4 successfully scans at those gates, fwiw.

herbst• 4 years ago

I digged a little into this and to my understanding did she never actually 'hack' but just used publicy open data in a smart way which apparently is not illegal under swiss law.

nailer• 4 years ago

The guy is a woman. https://en.m.wikipedia.org/wiki/Maia_arson_crimew

dang3• 4 years ago

We detached this subthread from https://news.ycombinator.com/item?id=34446878.

vunicipna3• 4 years ago

Interesting hack, but this seems quite the brazen confession to a fair number of computer crimes. If I were the author, I'd be worried about getting arrested and potentially extradited for this. Especially as he deliberately downloaded a load of confidential information after gaining access, and then shared it around. He'd be looking at years in prison for this, in the US.

lom• 4 years ago

The author is already searched by US authorities for other hacks. See their wiki page here: https://en.wikipedia.org/wiki/Maia_arson_crimew#Indictment

helsinki• 4 years ago

She’s already potentially facing US extradition from Switzerland for unrelated computers crimes. No idea why she would publicize this exploit.

derelicta2• 4 years ago

Switzerland's federal constitution prohibits extradition of swiss citizens to foreign powers. Now technically, this one amendment can be overriden by a mere act of Parliement, so unless there is a special act I'm not aware of, they are safe.

IceWreck• 4 years ago

She's Swiss and the US already tried to extradite her for posting stuff on git.rip

easrng2• 4 years ago

it ran git.rip

as_bntd4• 4 years ago

I expected to read an article about actually owning an airline in 3 easy steps. :(

twelve403• 4 years ago

I too was at first annoyed by a bit of an overhyping in the title and the overall style as well, until I remembered how it felt when you discovered something yourself, or even just read a good clever report from someone else. You get this rush that this is the coolest craftiest thing in the world.

as_bntd4• 3 years ago

You are right! That's how this reads.

zootboy• 4 years ago

Indeed, the de-editorializing of the title made the interpretation more ambiguous. I'd actually prefer the real title ("how to completely own an airline...") or a more clear adjustment ("how to hack an airline...").

mihaaly3• 4 years ago

I was disappointed too. I wouldn't know what to do with an airline, I never had one, I wouldn't even know which one I'd like, perhaps Virgin Airlines?, but the thought of having one was exciting still.

jonp888• 4 years ago

I guess we do need the verb 'pwn' after all :D

interestica2• 4 years ago

you're....actually right. I totally misread this headline. There were no context clues to help with the reading.

kab0b• 4 years ago

I imagine it's something like Richard Bransons How to become a millionaire:

1) Be a billionaire

2) Start an Airline

rsynnott5• 4 years ago

I actually expected this to be "buy a bankrupt airline for ~nothing, and, oops, look, it still has a copy of the no fly list", to be honest...

as_bntd4• 3 years ago

Yep, that's exactly what I thought on first opening the article.

missedthecue• 4 years ago

For Musk's $44B Twitter bid, he could theoretically have purchased Delta, United, and American airlines.

as_bntd4• 3 years ago

3 easy steps :)

1. Create Tesla. 2.

tastysandwich• 4 years ago

As a software engineer even I sometimes can't help romanticising hacking in my imagination. But so many times it turns out to be just like some company left the front gate wide open and the "hacker" walked in and took a look around.

Eg when an airline had a public API where you could get someone's passport number and details just from their boarding pass https://mango.pdf.zone/finding-former-australian-prime-minis...

chaboud• 4 years ago

Private keys checked into code?

Password salts that were identical for the entire set?

"Random" initialization vectors always created from the same prng seed?

Without coders like these, hackers would really have to work for it.

(And, yes, I've encountered all of these in my career.)

gggggg57• 4 years ago

Since when are passport numbers supposed to be sensitive information? This isn't something you could use for identity fraud in any normal circumstances.

sverhagen• 4 years ago

Don't all sorts of person-related details come in handy to stage a social engineering hack? Maybe a caller could demonstrate legitimacy by coughing up a passport number. At this point, it may impress me more than someone having found my SSN (_love you for that, Equifax_). Yet, SSN is still by many institutions considered something that should be stored in the vault.

giza182• 4 years ago

Ha! Loved the linked story. Thanks for posting.

japanman4254• 4 years ago

Less hacking, more like exploring.

c7DJTLrn• 4 years ago

Check this out if you haven't heard of it: https://en.wikipedia.org/wiki/Stuxnet

Maursault• 4 years ago

Eg when an airline had a public API where you could get someone's passport number and details just from their boarding pass https://mango.pdf.zone/finding-former-australian-prime-minis...

Underneath all the garbage, good story. But Holy Hell, why do bloggers write so terribly and self-indulgently? That's a half hour of my life I'll never get back that shouldn't have been more than 10 minutes. Don't they have Ritalin in Australia? They really should.

vgb2k18• 4 years ago

Aussie, can confirm. They have Vyvanse, Dexamfetamine, Adderal and Ritalin. I didn't mind reading this one though, was a novel change to see sentences starting without capital letters.

hackmiester• 3 years ago

You could just say you don't prefer the writing style.

ohbleek• 4 years ago

I had always assumed that the “no fly” list was a phrase and that it didn’t refer to an actual list, but rather a database with more detailed information than a “can they fly?” Column with a Y/N entry. In pharmacy we have a database we have to access when we suspect there is abuse, fraud, or diversion of controlled substances. The database is regularly updated with current information about prescriptions that were dispensed including location, prescribing physician, etc. I had always assumed the “no fly” list would be something similar. Now that I think about it though, that wouldn’t be efficient or useful at all. It would make sense for it to be much more simple.

twelve403• 4 years ago

yeah, surprised as well. In finance, there is ofac for people forbidden from moving money, but it's also typically used as a service/db instead of passing around csv files to everyone. Very bizarre.

mproud2• 4 years ago

Could this have been an export given to someone upon request? Or maybe served as backup?

mrcode0072• 4 years ago

Not sure what service you’re referring to but the file is here:

https://www.treasury.gov/ofac/downloads/sdnlist.txt

mihaaly3• 4 years ago

I naively thought a secret list (file) with secret data is not distributed among random developers of random organizations in full but having a private access point where specific persons could be checked for no fly list by those with right for it, audited, with measures to avoid abusing the service. Potentially with training set available for developers separately. There are services where the accuracy of certain data can be validated (i.e. for cars by license plate and other data) so those who query should already possess the data of a particular person when using it and not just browse everyone in the secret list they please.

edpichler• 4 years ago

Every company keeps its list or it´s a USA government list?

namdnay• 4 years ago

Network connectivity in airports can be patchy at best, and connectivity from the airport internal network to the internet even worse. All the check-in and boarding systems are designed to be able to work offline (with semi-automatic reconciliation afterwards). You have to query the no-fly list at check-in and boarding, so it's more resilient to have a list that can be loaded airport-side every morning

mulmen• 3 years ago

Why can't the TSA run an onsite cache in a secure IT closet?

alexwasserman• 4 years ago

I had a friend with a common Indian name get bounced off a flight and then be unable to book flights after it turned out he shared his name with someone on the no-fly. He had to petition his senator/congress person to get off it. TSA had no easy way to prove innocence. It was very clear the list was just a list of names with no useful or distinguishing unique fields with it.

This was roughly 10 years ago, so things might have changed, but at the time it seemed like federal agencies could easily append to the list, but there was no standard process to get off it. I'd guess there are obvious incentive for agencies to add ("hey look, we've found terrorists", even if nothing was actually done about it), and none to remove people from it.

BMorearty• 4 years ago

`cat` aliased to `bat`, nice. :) I really like bat.

c1ccccc1• 4 years ago

After seeing the title but before clicking on the article, I thought this would be about a legal hack rather than a security hole. More specifically, creating the minimum possible corporation that qualifies as an airline (so that you literally own an airline), and then saying to the government, "hey, we need the nofly list, we're an airline, see?". The actual hack sounds way easier, to be sure, but I still like my version the best.

Scalene2• 4 years ago

I came here to make the same comment. Also, I now know that .gay is a tld and I'm trying to figure out how to take advantage, registration isn't terribly cheap, but the only restrictions are ones that don't apply to any of my ideas.

yamtaddle• 4 years ago

Oh man. 1890s.gay would be a good one.

[EDIT]

https://en.wikipedia.org/wiki/Gay_Nineties

stonepresto• 4 years ago

For reference, it/she [1] previously was named Tillie Kottman [2] and was indicted by the US in 2021 [3].

[1] https://maia.crimew.gay/

[2] https://en.wikipedia.org/wiki/Maia_arson_crimew

[3] https://www.justice.gov/usao-wdwa/pr/swiss-hacker-indicted-c...

shadowgovt4• 4 years ago

Apropos of nothing, I also just really appreciate crimew.gay's aesthetic.

This website is what me from 1993 thought a hacker's website would look like. A nod of respect to them for kickin' it old-school.

neilk• 4 years ago

And they were born in 1999. We are dealing with a unique mind here.

KyeRussell2• 4 years ago

In reality it’s like a kid listening to the beatles, but with computers. I’m a younger millennial that grew up entrenched in ‘hacker culture’ and even then there was a clear fetishisation of the good ol’ days.

concordDance2• 4 years ago

Amusingly, "they" is not one of the pronouns it prefers.

rsynnott5• 4 years ago

Consciously using retro design is very much a thing in industrial design, architecture, and so on; it only makes sense that it would come to websites, too (and indeed you'd expect younger people to be doing it; most retro _anything_ takes inspiration from a time period before the designer was around).

harryvederci• 4 years ago

Oh hell yeah, I turned off my dark mode extension, much better now. Thanks!

komali25• 4 years ago

I love the .gay TLD! Had no idea it existed and now I want to register some domains against it

lnxg33k1• 4 years ago

I agree with you, but probably in the 90s would have been a bit darker/greener :D But nice website brought me back in time ^^

rsynnott5• 4 years ago

This site is part of the lavender.software webring!

A webring! I'd completely forgotten that these were a thing.

shadowgovt4• 4 years ago

"An elegant social network, for a more civilized age."

ec109685• 4 years ago

While VPN's shouldn't be the only device, it seems like that should be part of any competent security posture. E.g. Jenkins should only be accessible from known VPN endpoint IP addresses.

Administrative IAM's should be IP restricted as well: https://aws.amazon.com/premiumsupport/knowledge-center/iam-r...

gcbirzan• 4 years ago

And the s3 buckets/dynamodb/whatever other data you store should be vpc restricted. Ours are like this by default, for exceptions (like aws services that run in some internal vpc that's not exposed) you can make an exception per role.

089513646753• 4 years ago

monkeya1• 4 years ago

Hey all im new. Didnt expect so many of yall to actively check & comment on this one app

mistersys• 4 years ago

https://news.ycombinator.com/item?id=34446673

mkl95• 4 years ago

TIL https://en.wikipedia.org/wiki/Maia_arson_crimew

In March 2021, crimew was indicted by a grand jury in the United States on criminal charges related to her alleged hacking activity between 2019 and 2021. The charges were unrelated to the hack of Verkada. Her home and her parents' home were raided by the Swiss police at the request of United States authorities, and her electronic devices were seized. People used the hashtag "#freetillie" to express support for her in the aftermath of the raid, and the Swiss magazine Republik compared her to Jeremy Hammond and Aaron Swartz.

japanman4254• 4 years ago

What a Wally. What purpose did it serve doing this?

komali25• 4 years ago

Are you asking, what purpose was there in bringing the hammer of the American Justice Department and down onto a random grey hat hacker? The same as always: enforce rigid authoritarianism and blind bureaucratic SOP.

Remember kids, clicking the "next page" button on court document websites is legal, doing it with javascript is a felony, off to jail with you, join the rapists and murderers!

jcq32• 4 years ago

How such supposedly talented hacker end up to be doxxed? It's not that hard to become 99.99% anonymous online...

implements• 4 years ago

Technically easy, operationally virtually impossible - everyone will slip up eventually.

Also, the need for recognition often drives any human endeavour - and that leads hackers, criminals, etc to boast of their exploits to at least someone … who might be under observation, or under pressure to give up information to escape severe punishment for their own activities.

dvdkon• 4 years ago

No doxxing was necessary, Tillie did it all publically, publishing on a home server, making announcements on Telegram under their real name. I don't quite get it either, but they specifically didn't want to hide in (pseudo)anonymity.

the_af• 4 years ago

crimew's stated viewpoint and goals are "radical transparency". Hiding her legal name would go against this goal. It has nothing to do with competency and everything to do with her worldview.

brador• 4 years ago

“Jan 19, 2023” — OP article date.

xyst• 4 years ago

Laws are written to protect multibillion corporations and billionaires. Prove me wrong.

If we truly lived in a sane society, companies with lax security and god awful security policies would be punished.

Scoundreller2• 4 years ago

Depends on the country.

Mine was founded by some overseas family that can still come over and start telling us what to do as they please.

So uhhh, yeah, can confirm, Canada’s laws basically revolve around keeping old money wealthy without providing any value to anyone.

lbwtaylor• 4 years ago

So if I leave my front door unlocked, I should go to jail when someone steals from me? What nonsense.

rib3ye• 4 years ago

Surely this comment does not fit HN comment guidelines: https://news.ycombinator.com/newsguidelines.html

Eschew flamebait. Avoid generic tangents. Omit internet tropes.
Please don't use Hacker News for political or ideological battle. That tramples curiosity.

aj73• 4 years ago

So it’s OK for individual vigilantes to punish them, am I right?

silexia• 4 years ago

Yes, punish the victims is the best policy.

neonsunset• 4 years ago

There is very little if anything similar between the subject and Aaron Swartz

aj73• 4 years ago

Exactly. There is a whole infrastructure of sympathizer-nuts, similar to US politics.

hot_gril• 4 years ago

Wonder if she's on the no-fly list now.

westhom• 4 years ago

Doubt it. The US would very much love it to fly pretty much anywhere outside Switzerland so it can be extradited.

INTPenis• 4 years ago

Hah shodan, the title made me think this was about starting a dummy airline and getting the nofly list from the government.

KyeRussell2• 4 years ago

Same. Sorely disappointed.

derelicta2• 4 years ago

You never fail to amaze us, Maia

fomine3• 4 years ago

I'm not confident that is it safe to link to the site operated by such hacktivist. I prefer to see link for news article on HN headline, rather than criminal hacker's website itself, but I don't know rules.

jhoelzel• 4 years ago

And this kids, is why you always need 2FA and you need to whitelist your build servers with ipranges. Yes Like the 90s.

dandongus• 4 years ago

Surprised to see this guy wasn't already in prison due to his previous antics, and it's too bad he didn't responsibly report this issue through the proper channels. Everyone's luck is bound to run out at some point.

kaapipo• 4 years ago

*her

pifm_guy• 4 years ago

Oh it must be nice to be able to do things like this, while only keeping an eye out for the laws of your own country, safe in the knowledge that your government won't extradite you for breaking the laws of another country.

exabrial• 4 years ago

The TSA no fly list is a blatant violation of the Constitution: for the government to be able to remove a right, you must be convicted at trial.

The fact it still exists at all is incredible, but a disturbing precedent.

Symbiote• 4 years ago

Was there any penalty for CommuteAir or their employees for negligently distributing the list?

flawn• 4 years ago

That's the Lawnchair app founder LOL

IYasha• 4 years ago

"That would be the gayest site I've ever seen" :D

Seriously, though, is the list on the github yet?

curiousllama• 4 years ago

Hack aside, there's something poetic about leaking the no fly list from an email address called "nofly@crimew.gay"

dboreham2• 4 years ago

The headline made me think this was about a scheme where you register as an airline, just to get access to the list. I mean, how many planes do you need to own to be an airline?

aj73• 4 years ago

https://www.egattorneys.com/federal-computer-hacking

See in particular the broad definition of “protected computer.”

computerfriend• 4 years ago

This would be a good candidate for a k-anonymous API where you can query if a specified full name, DoB, etc., is in the list without divulging the list or the request.

LoganDark• 4 years ago

This is gonna be random but I love people just shamelessly being themselves on the Internet. This person is literally a kitty cat playing around and I find that adorable~

Oh, also secure your Jenkins servers.

hattmall• 4 years ago

Why is the no fly list sensitive information?

ctb9• 3 years ago

assuming i was willing to ever interact with a SOAP api in my life which i sure as hell am not

^^^ this killed me. i'm sure everyone who has ever interacted with a SOAP api feels the same. god bless this tiny kitten/person/hacktivist, the world needs more of this energy.

How to own an airline in 3 easy steps and grab the TSA nofly list along the way

Related Stories