FlightAware Leaks Customer Data (Name, Email Addresses and Passwords)

https://loyaltylobby.com/2024/08/16/flightaware-leaks-customer-data-name-email-addresses-passwords/

by croemer • 2 years ago

215 134 2 years ago

croemer20• 2 years ago

I can confirm the veracity of the email. I got it myself. Note that they say they leaked passwords. They didn't mention whether they were hashed or not, and if so whether with salt or not. I couldn't find a blog post either. The notification email took more than 3 weeks, not impressed.

flutas2• 2 years ago

Interesting, as I have an active account (ADS-B data feed) with them and never got this email.

croemer20• 2 years ago

You will probably still get it then. I only got it 3 hours ago. And the first tweets are almost 2 days old.

They seem to use some email delivery service that can't handle sending an email to all users within an hour.

SushiHippie• 2 years ago

Same, but I tried logging in and got the reset your password popup because of a breach.

bigmoat3• 2 years ago

As someone who used to work there, the passwords were definitely stored salted and hashed in the database.

The email mostly makes it sound like what’s in the user account table, though last 4 of credit card I didn’t think was in it. And mentioning passwords, not salted/hashed passwords, makes me think it was more.

I’m wondering if this is an Apache or Apache Rivet issue that possibly intercepted everything you sent to the server, which could then be your actual password if you logged in during the timeframe or even credit card if you bought something.

Also Rivet was full of footguns. IIRC, variables would exist for the life of the Apache child, so you had to clear them out or the next request had access to them, so if someone deleted or didn’t run the huge “delete all variables we probably set” proc, and someone was able to get an “info var” output, they’d see everything set in the previous request or further back if nothing overrode it. Like user info, which was just stored in a big global “user” array

croemer20• 2 years ago

Thanks that the most informative thing about this incident that exists at this point. Nothing on the website at all. It's terrible.

The blog mentions recently moving away from TCL. Could it have been related to that?

Do you have an idea why the emails arrive as a drip, spread over days?

croemer20• 2 years ago

A few more links: https://www.404media.co/flightaware-exposed-pilots-and-users...

Automatic reply when replying to email: https://x.com/fergindc/status/1824648418544816222?t=vqjrPsqb...

https://x.com/josephfcox/status/1824192314991882545?t=IIZE0V...

gosub100• 2 years ago

Possible pirate deviation.

croemer20• 2 years ago

What does pirate deviation mean? ChatGPT doesn't get it either.

leetrout3• 2 years ago

In air traffic control they say "possible pilot deviation" so they were making a play on words.

okanat• 2 years ago

Not so smart eh? So are we smarter than LLMs?

croemer20• 2 years ago

8 months ago, Flight aware wrote a blog post about moving their entire tech stack from TCL. The post is called "Managing a Technical Transformation (Part 1)". I couldn't find Part 2.

https://flightaware.engineering/managing-a-technical-transfo...

23B1• 2 years ago

Privacy amendment NOW.

gkanai• 2 years ago

Until there are significant financial damages associated with each of these breaches, companies just won't invest enough to secure the information. These sorts of breaches should be existential to the company- they should never happen. And yet because the penalties are almost nothing, companies just are not incentivized to secure the data appropriately.

If a breach meant the firing of the CEO and the CTO and the board, then you'd know that companies would spend a lot more on security and privacy.

layer82• 2 years ago

I’m completely sympathetic to that view. However, until such data breaches regularly lead to severe outcomes for subjects whose data was leaked, and those outcomes can be causally linked to the breaches in an indisputable manner, I’m afraid that we won’t see any such penalties.

croemer20• 2 years ago

Very good point. In addition, my email address etc has been breached so many times that each extra leak has almost no marginal impact.

stackskipton6• 2 years ago

However, until such data breaches regularly lead to severe outcomes for subjects whose data was leaked, and those outcomes can be causally linked to the breaches in an indisputable manner

Which means nothing gets done because it's pretty hard to prove where any one misusing your information got it from. My identity was stolen after breach but when I took it up with entity that lost my information, they were like "Prove it" which of course I couldn't because people who did it to me were never caught.

MrJohz2• 2 years ago

With GDPR, simply leaking personal data is enough to earn you penalties. If your security is insufficient that someone can take this much personal data (and based on some of the other comments here it was a lot of personal data), then you have not upheld your responsibility according to GDPR.

So I disagree, we don't need to wait until the data breaches lead to any particular outcomes, we need laws that make it clear that data breaches alone constitute damages to the people whose data was released. More people should be protected by GDPR-style laws, and more companies need to recognise that data security is something they need to take deeply seriously.

amsterdorn4• 2 years ago

I don't like this take, companies use this same mentality to justify inaction with their impact on climate change.

Who decides what a "severe" outcome is? The companies themselves? Why don't we hold them to a higher standard?

jfoster• 2 years ago

It would mean that if all current & prospective customers abandon them for it.

KingOfCoders• 2 years ago

If a breach means jailtime, we would see a drastic reduction.

dgoldstein0• 2 years ago

If breaches were automatic jail time, no one in their right mind would want these jobs. One same reaction would be to stop collecting personal data, but a lot of Internet businesses would have a hard time adjusting to that.

A more practical policy proposal would criminalize extreme negligence while focusing on financial penalties for lesser beaches. Possibly the young missing vs current policies is that the duty to protect user data should probably increase with the amount of data collected - the juicier target you make your company, the more the penalty needs to hurt. This could mean companies taking a hard look e.g. at whether they really need your address and phone number because every extra bit of hacked information should cost them more.

n_plus_1_acc2• 2 years ago

They'd simply be hired as a manager in another company

Simon_ORourke• 2 years ago

Surely a mealy-mouthed email without a formal apology or admission of culpability will be the order the day - perhaps with a $2 Amazon voucher for those willing to click a box and agree to not sue for damages or engage in public disparagement.

What I find surprising more that the usual lack of accountability in these cases is how little its impact tends to be felt on Wall Street. A slight dip in the share price maybe for a week or so, but then it's back to business as usual.

Log_out_• 2 years ago

The only solution..throw away one time pad generated personal data,tightly coupled to the lifetime of the used service.

trustno23• 2 years ago

If security breaches lead to jail time, nobody but a few big companies will build anything. Be careful what you wish for.

figassis2• 2 years ago

My side projects will never leak passwords. How is that not security 101? You do not need to "invest" in this, every single engineer needs to have this level of working knowledge. Not having this in place should absolutely mean not being allowed to run a business online.

haswell• 2 years ago

I disagree.

I do think it would incentivize new security products/libraries/services focused on helping companies fulfill their security requirements instead of rolling their own crappy solutions.

If a startup cannot secure their customer’s data effectively, I don’t want their product to exist. If that means fewer startups get products off the ground, I fail to see that as a bad thing if a lack of security was the reason.

Slowing the industry down after a decade of breach after breach after breach seems like a reasonable and possible necessary intervention.

xlinux• 2 years ago

Why not the people who built such crappy software?

Ekaros• 2 years ago

I'm starting to think there should be some statutory minimum like 10€ per account that will be automatic minimum fine. Then depending on type of information it scales up from there.

ilrwbwrkhv• 2 years ago

Always always put in fake names emails etc when creating accounts. I do not know why anybody puts in their real names in the first place.

zadokshi• 2 years ago

Yes, i don’t understand why anyone would ever enter real personal details into any website unless it was absolutely required for correct functionality of the website. Is it older people having a more overall general trust of institutions? or is it all ages that do this?

bluGill2• 2 years ago

The problem is if you forget the fake details you can't recover the account. I was born around 1900 for my old yahoo groups email, but I forgot when exactly and so I got emails for a group I no longer cared about until (not sure what died, yahoo groups or the list)

Dalewyn• 2 years ago

Is it older people having a more overall general trust of institutions? or is it all ages that do this?

If I had to guess, probably a combination of baby boomers (really old people) and Gen XZers (really young people).

Those of us who grew up with the internet (me, millenials) got drilled in to never ever fucking never share our real name or street address. That 18/F/CA in the chatroom? That's a middle age GIRL (Guy In Real Life).

sureIy4• 2 years ago

Why not? It’s honestly a pain entering fake data and then realizing it won’t work on the next page. Easier to let the browser autofill it.

I junk-fill some signup forms and use Hide my Email for others, but it’s never less work than just using real data (well, with few exceptions like WiFi registration pages that I encountered before and don’t require data validation)

croemer20• 2 years ago

Still nothing about it on the website. Only on the official Discourse:

https://discussions.flightaware.com/t/closing-account-due-th...

idatum• 2 years ago

I have an ADS-B receiver. It's a hobby. I didn't get any notification yet.

Looks like I let my guard down with Flightware. Again, it's a hobby -- supposed to be a joy. I wrote some code to use TTS to play the departure, aircraft, and flight info so I can sit on my deck and enjoy as flights passed by.

Flightware has my exact location. Of course, so does Google via my phone. But this isn't supposed to be Google. It's a hobby.

And now my hobby is part of the sh*t world of Google and every other data hoarding sociopath enterprise.

I'll stop using piaware.

EDIT:

Logged in to Flightaware.com and got this:

Reset Your Password

Due to a data security incident that potentially involves your personal information and out of an abundance of caution, we are requiring you to reset your password. Additional information was sent to you via email. Please enter your FlightAware username or e-mail address below to reset your password:

anyfoo• 2 years ago

Title is incomplete/almost misleading: much more data than name, email, passwords is leaked:

   Depending on the information you provided, the information may also have included your full name, billing address, shipping address, IP address, social media accounts, telephone numbers, year of birth, last four digits of your credit card number, information about aircraft owned, industry, title, pilot status (yes/no), and your account activity (such as flights viewed and comments posted).

Sounded to me like most/everything associated with the profile is affected. Fortunately I didn’t use my account for anything that I can remember, and it used throwaway email and password.

jbverschoor• 2 years ago

Sounds like a complete database dump

croemer20• 2 years ago

I didn't want to editorialize - but happy for dang to change the title

ryandrake4• 2 years ago

FlightAware’s iOS app also just stopped supporting iOS 15 and, instead of just letting the old app continue to work, they did it with a full-screen modal telling iOS 15 users to fuck off and buy a new phone, preventing us from using the app that worked last week. Every other app on my phone gracefully continues to work on my old device except this one. This is absolutely bonkers and not the way any legitimate app does backwards compatibility. The developers over there are pretty clearly clowns that don’t know what they are doing.

BarryMilo• 2 years ago

I love the idea that developers had the power to decide what is and isn't supported. That's clearly a manager's decision if not CEO.

stackskipton6• 2 years ago

Or they are shocked. Most companies I’ve been at, iOS version support is N-1. After that, we wouldn’t lock you out unless there was technical reason but no testing or support was done.

iOS ecosystem has always been like this since Apple supports phones for a long time.

jeltz• 2 years ago

At most companies I have been at the devs have had a lot of say in discussions like this.

eviks2• 2 years ago

They do, CEOs usually don't make such minor decisions

sureIy4• 2 years ago

To be fair, you’re using a 8-year old device that has been unsupported by Apple for 2. I’m sure some websites already aren’t working for you and I’d expect a “web service” app wrapper to have similar limitations. To support your device, they probably would have to keep a legacy version of their web apps around, so it does not come free.

For a free app, supporting a device for 7 years is already a long time. With iOS 18 around the corner, it makes every day more sense to cut you off.

verandaguy• 2 years ago

Don't look at it as "not supporting an 8-year-old device" which can't get the update; look at it through the lens of "not supporting an OS which had its initial release just under 3 years ago and is still receiving support itself."

There are plenty of reasons (of varying reasonableness) to avoid an update; people on an OS version this new shouldn't be getting this kind of harsh treatment.

If you have app features that rely on a new iOS feature, you could just put those behind a feature flag.

If your core API changes substantially over time meaning that out-of-date versions of your app quickly stop working without updates, it's better for the user if you use something like Swagger to auto-generate the API stubs; it makes it much easier to support your app in the long term, even for users on what would otherwise be unsupported platforms.

If you're dropping support because supporting an older OS creates irreparable security issues, well, I guess in this case they might actually be ok with that.

ryandrake4• 2 years ago

Apps stop issuing updates for my old device all the time. I understand why and I live with it. What they don’t do is remotely disable their apps, forcing me to stop using them. That’s totally unacceptable, even for a free app. Especially for a free app! They spent developer effort to deliberately do it.

eviks2• 2 years ago

There is nothing fair about this since the OS/device would continue to work just fine, and for many more years, unless the user hostile decision to block was made

anothername12• 2 years ago

Ah shit I just interviewed there

whs• 2 years ago

As someone who worked in a company during breaches, I'd say if the company is willing to not getting another breach it's a unique learning experience. You'll see company standards stricten, more pentests and perhaps at least for 6 months more emphasis put on product security than time to market. A good time to also suggest tech debt to be fixed related to security.

yard20102• 2 years ago

Bah bro they sent an email with some euphemisms, they have no need to do any of this it's already handled

tjpnz• 2 years ago

It's never fun learning that your HR records are among the data being sold on the dark web. Depending on your business you might also have a target on your back afterwards - we had to implement "no company branded t-shirt" rules when leaving the office after an employee got accosted by an irritate customer. We also lost the relaxed policy we had on visitors.

Yes, perhaps you'll learn something. But you won't want to stick around there long afterwards.

udev4096• 2 years ago

Breaches are never going to stop because security is never a priority during an initial product release. It's always an after thought

croemer20• 2 years ago

This product is hardly in initial release though. FlightAware has been around since 2004 and has recently been migrating their stack away from Tcl (!)

perch56• 2 years ago

The author of the article seems to be confused about the GDPR notification requirements. In the event of a personal data breach, the controller is required to notify the supervisory authority without undue delay, and where feasible, no later than 72 hours after becoming aware of the breach—not the users themselves. However, when it comes to informing end users, the GDPR requires that they be notified without undue delay if the breach is likely to result in a high risk to their rights and freedoms. It’s mind-boggling that FlightAware took three weeks to inform users, which raises concerns about their handling of the situation. It’s also suspicious that they haven’t clarified whether they are aware if the exposed data was actually copied by bad actors—one should assume it was.

croemer20• 2 years ago

This sentence is also mind bogglingly ambiguous:

Please note that this notification was not delayed as a result of a law enforcement investigation.

Was there a law enforcement investigation or wasn't there? The sentence can either mean:

a) A law enforcement investigation happened, but it didn't delay the notification

b) It may or may not have been delayed, but a law enforcement investigation played no causal role in a delay - whether it had happened or not

c) A law enforcement investigation happened, and it delayed the notification, but not in the legal sense of a "late notification"

nomilk• 2 years ago

Nowhere in the article says 'hashed' passwords, so I presume plaintext (!!!) passwords were leaked.

That's 100x worse than all the other data combined for two reasons: it can be devastating for users, and it's easily preventable (by not storing them in plaintext in the first place).

EDIT: Someone suggests stored passwords were hashed [1]. Hope they're right.

[1] https://news.ycombinator.com/item?id=41278855

croemer20• 2 years ago

It's a bit disappointing how there's a total blackout from the company. Nothing on their website/blog/social media. Even the notification emails are arriving stagged over a period of 3 or more days.

zelphirkalt• 2 years ago

Time for management to take the responsibility, that they so often raise as a point, when it comes to salary negotiations.

ciabattabread• 2 years ago

I have the FlightAware free account, but on occasion I’ve bought the Ad removal IAP, via Apple. What personal/billing information beyond my email address do they actually have from me?

FlightAware Leaks Customer Data (Name, Email Addresses and Passwords)

Related Stories