How to own an airline in 3 easy steps and grab the TSA nofly list along the way

Headline buries the real lede a bit in my opinion; the author has gotten a snapshot of the no-fly list from 2019. Presumably the system under attack processes more up-to-date versions of it regularly.<p>Corresponding news story: <a href="https:&#x2F;&#x2F;www.dailydot.com&#x2F;debug&#x2F;no-fly-list-us-tsa-unprotected-server-commuteair&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.dailydot.com&#x2F;debug&#x2F;no-fly-list-us-tsa-unprotecte...</a>

Hah shodan, the title made me think this was about starting a dummy airline and getting the nofly list from the government.

As a software engineer even I sometimes can&#x27;t help romanticising hacking in my imagination. But so many times it turns out to be just like some company left the front gate wide open and the &quot;hacker&quot; walked in and took a look around.<p>Eg when an airline had a public API where you could get someone&#x27;s passport number and details just from their boarding pass <a href="https:&#x2F;&#x2F;mango.pdf.zone&#x2F;finding-former-australian-prime-minister-tony-abbotts-passport-number-on-instagram" rel="nofollow">https:&#x2F;&#x2F;mango.pdf.zone&#x2F;finding-former-australian-prime-minis...</a>

Interesting hack, but this seems quite the brazen confession to a fair number of computer crimes. If I were the author, I&#x27;d be worried about getting arrested and potentially extradited for this. Especially as he deliberately downloaded a load of confidential information after gaining access, and then shared it around. He&#x27;d be looking at years in prison for this, in the US.

I had always assumed that the “no fly” list was a phrase and that it didn’t refer to an actual list, but rather a database with more detailed information than a “can they fly?” Column with a Y&#x2F;N entry. In pharmacy we have a database we have to access when we suspect there is abuse, fraud, or diversion of controlled substances. The database is regularly updated with current information about prescriptions that were dispensed including location, prescribing physician, etc. I had always assumed the “no fly” list would be something similar. Now that I think about it though, that wouldn’t be efficient or useful at all. It would make sense for it to be much more simple.

I expected to read an article about actually owning an airline in 3 easy steps. :(

For those unaware, maia is a pretty prolific hacktivist, and it has been indicted by a grand jury for a variety of USA govt penetrations but has USA proceedings on hold until it&#x27;s extradited, which it&#x27;s confident won&#x27;t happen.<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Maia_arson_crimew" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Maia_arson_crimew</a>

This is clearly on the darker side of gray-hat. Hate to be preachy but anyone seeking to emulate this sort of attack-finding should consider their ethical obligations as a computer scientist and follow best practices for responsible disclosure. It appears this was completely ignored here, including sharing stolen sensitive data of <i>normal people</i> with whoever can plead a case.

While VPN&#x27;s shouldn&#x27;t be the only device, it seems like that should be part of any competent security posture. E.g. Jenkins should only be accessible from known VPN endpoint IP addresses.<p>Administrative IAM&#x27;s should be IP restricted as well: <a href="https:&#x2F;&#x2F;aws.amazon.com&#x2F;premiumsupport&#x2F;knowledge-center&#x2F;iam-restrict-calls-ip-addresses&#x2F;" rel="nofollow">https:&#x2F;&#x2F;aws.amazon.com&#x2F;premiumsupport&#x2F;knowledge-center&#x2F;iam-r...</a>

From the accompanying (and linked) <i>Daily Dot</i> article[1]:<p>&gt; On the list were several notable figures, including the recently freed Russian arms dealer Viktor Bout, alongside over 16 potential aliases for him.<p>&gt; [...]<p>&gt; Numerous names included aliases that were common misspellings or slightly altered versions of their names.<p>For non-natively-Latin names, the US government is thorough to the point of hilarity in including every possible romanization and misspelling of one, and they list full names not their individual parts so combinatorics ahoy, as well. For example, if you know a bit of any Slavic language written in Cyrillic, browse the Russian sanction lists, it’s going to give you a chuckle.<p>In all seriousness, this actually makes perfect sense given the prospective consumers of the lists may not have any clue about the languages the targeted people speak. It’s just that the article makes 16 aliases sound vaguely sinister, whereas if you’re a Russian—or, for that matter, a Ukrainian or a Belarusian—that’s just a reasonably low estimate for how many romanizations of your name people may think up. (Not that Bout isn’t sinister as hell.)<p>[1] <a href="https:&#x2F;&#x2F;www.dailydot.com&#x2F;debug&#x2F;no-fly-list-us-tsa-unprotected-server-commuteair&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.dailydot.com&#x2F;debug&#x2F;no-fly-list-us-tsa-unprotecte...</a>

TIL <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Maia_arson_crimew" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Maia_arson_crimew</a><p>&gt; In March 2021, crimew was indicted by a grand jury in the United States on criminal charges related to her alleged hacking activity between 2019 and 2021. The charges were unrelated to the hack of Verkada. Her home and her parents&#x27; home were raided by the Swiss police at the request of United States authorities, and her electronic devices were seized. People used the hashtag &quot;#freetillie&quot; to express support for her in the aftermath of the raid, and the Swiss magazine Republik compared her to Jeremy Hammond and Aaron Swartz.

Wow, actual hacker news.<p>For once.<p>Meanwhile, another front page article is some genius asking why there aren’t any cars in 1984.

And this kids, is why you always need 2FA and you need to whitelist your build servers with ipranges. Yes Like the 90s.

Apropos of nothing, I also just really appreciate crimew.gay&#x27;s aesthetic.<p>This website is what me from 1993 thought a hacker&#x27;s website would look like. A nod of respect to them for kickin&#x27; it old-school.

Cached version from the internet archive: <a href="http:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20230119220130&#x2F;https:&#x2F;&#x2F;maia.crimew.gay&#x2F;posts&#x2F;how-to-hack-an-airline&#x2F;" rel="nofollow">http:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20230119220130&#x2F;https:&#x2F;&#x2F;maia.crime...</a>

&gt; with pretty much no skill required<p>Seriously? I know like none of the tools or terms they used, like wtf is shodan?<p>In general the author doesn&#x27;t seem to follow the white hat guidelines, and I&#x27;d be worried what they&#x27;ve done is quite illegal (possibly on a federal level if the nofly list is so secret)

Oh it must be nice to be able to do things like this, while only keeping an eye out for the laws of your own country, safe in the knowledge that your government won&#x27;t extradite you for breaking the laws of another country.

Hack aside, there&#x27;s something poetic about leaking the no fly list from an email address called &quot;nofly@crimew.gay&quot;

Interesting to see ASCII SOH&#x2F;STX&#x2F;ETX in the wild! (^A, ^B, ^C in the .RCV files.)

That&#x27;s the Lawnchair app founder LOL

The headline made me think this was about a scheme where you register as an airline, just to get access to the list. I mean, how many planes do you need to own to be an airline?

<i>assuming i was willing to ever interact with a SOAP api in my life which i sure as hell am not</i><p>^^^ this killed me. i&#x27;m sure everyone who has ever interacted with a SOAP api feels the same. god bless this tiny kitten&#x2F;person&#x2F;hacktivist, the world needs more of this energy.

<a href="https:&#x2F;&#x2F;www.egattorneys.com&#x2F;federal-computer-hacking" rel="nofollow">https:&#x2F;&#x2F;www.egattorneys.com&#x2F;federal-computer-hacking</a><p>See in particular the broad definition of “protected computer.”

This is gonna be random but I love people just shamelessly being themselves on the Internet. This person is literally a kitty cat playing around and I find that adorable~<p>Oh, also secure your Jenkins servers.

The TSA no fly list is a blatant violation of the Constitution: for the government to be able to remove a right, you must be convicted at trial.<p>The fact it still exists at all is incredible, but a disturbing precedent.

This would be a good candidate for a k-anonymous API where you can query if a specified full name, DoB, etc., is in the list without divulging the list or the request.

I love the implication that this random person should be the authority on whether or not I can see the no-fly list.

&quot;That would be the gayest site I&#x27;ve ever seen&quot; :D<p>Seriously, though, is the list on the github yet?

Was there any penalty for CommuteAir or their employees for negligently distributing the list?

You never fail to amaze us, Maia

Surprised to see this guy wasn&#x27;t already in prison due to his previous antics, and it&#x27;s too bad he didn&#x27;t responsibly report this issue through the proper channels. Everyone&#x27;s luck is bound to run out at some point.

They should just send the list to the New York Times and Fox News.

I&#x27;m not confident that is it safe to link to the site operated by such hacktivist. I prefer to see link for news article on HN headline, rather than criminal hacker&#x27;s website itself, but I don&#x27;t know rules.

Why is the no fly list sensitive information?

`cat` aliased to `bat`, nice. :) I really like bat.

A

Hey all im new. Didnt expect so many of yall to actively check &amp; comment on this one app

&gt; Suspected members of the IRA, the Irish paramilitary organization, were also on the list.<p>Oof the international politics always come out in things like this. Twitter also publicizes all of its suspensions and bans. There&#x27;s a Wikipedia article with a list of all the notable suspensions since 2010. It&#x27;s interesting to see that, contrary to popular narratives, many of the international groups banned were actually far-left aligned.<p>The list gets really boring the more you scroll down however. The last notable ban was Paul Graham for simply sharing their Mastodon handle. A boring dystopia indeed<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Twitter_suspensions" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Twitter_suspensions</a>

After seeing the title but before clicking on the article, I thought this would be about a legal hack rather than a security hole. More specifically, creating the minimum possible corporation that qualifies as an airline (so that you literally <i>own</i> an airline), and then saying to the government, &quot;hey, we need the nofly list, we&#x27;re an airline, see?&quot;. The actual hack sounds way easier, to be sure, but I still like my version the best.

Relatively off-topic, but I absolutely love the 90s&#x2F;early 2000s vibes I get from this. I can&#x27;t remember the last time I saw a webring, much less one with animated logos.

For reference, it&#x2F;she [1] previously was named Tillie Kottman [2] and was indicted by the US in 2021 [3].<p>[1] <a href="https:&#x2F;&#x2F;maia.crimew.gay&#x2F;" rel="nofollow">https:&#x2F;&#x2F;maia.crimew.gay&#x2F;</a><p>[2] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Maia_arson_crimew" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Maia_arson_crimew</a><p>[3] <a href="https:&#x2F;&#x2F;www.justice.gov&#x2F;usao-wdwa&#x2F;pr&#x2F;swiss-hacker-indicted-conspiracy-wire-fraud-and-aggravated-identity-theft" rel="nofollow">https:&#x2F;&#x2F;www.justice.gov&#x2F;usao-wdwa&#x2F;pr&#x2F;swiss-hacker-indicted-c...</a>

This guy is a (hobbyist?) security researcher who responsibly alerts companies of vulnerabilities.<p>However are his actions of downloading the no fly list and offering to share with journalists legal? Or does that cross into overreach and criminal activity?

Maia should try proton mail, it’s fine