U.S. airline accidentally exposes ‘No Fly List’ on unsecured server

guest · Jan 23, 2023

One of the most sensitive U.S. government documents was left online.
By Mikael Thalen @MikaelThalen, David Covucci - January 19, 2023

An unsecured server discovered by a security researcher last week contained the identities of hundreds of thousands of individuals from the U.S. government’s Terrorist Screening Database and “No Fly List.”
Click to expand...

Located by the Swiss hacker known as maia arson crimew, the server, run by the U.S. national airline CommuteAir, was left exposed on the public internet. It revealed a vast amount of company data, including private information on almost 1,000 CommuteAir employees.

Analysis of the server resulted in the discovery of a text file named “NoFly.csv,” a reference to the subset of individuals in the Terrorist Screening Database who have been barred from air travel due to having suspected or known ties to terrorist organizations.
Click to expand...

The list, according to crimew, appeared to have more than 1.5 million entries in total. The data included names as well as birth dates. It also included multiple aliases, placing the number of unique individuals at far less than 1.5 million.
Click to expand...

CommuteAir added that the server, which was taken offline prior to publication after being flagged by the Daily Dot, did not expose any customer information based on an initial investigation.

CommuteAir also confirmed the legitimacy of the data, stating that it was a version of the “federal no-fly list” from roughly four years prior.
Click to expand...

EASTER · Jan 23, 2023

Was it really? Or are all these floods of digital releases from so very many companies the work of some determination or purpose. Or is it that the people responsible for security of data simply clueless what they do and grossly inexperienced? Many these days seem are simply completely out of their element working with computer data and don't possess the necessary skill to adapt to the work of seeing to it data remains secure.

chrisretusn · Jan 24, 2023

@EASTER, my first thought when reading that headline... you mean accidentally on purpose? I agree with you post above.

guest · Jan 24, 2023

Congressman ‘coming for answers’ after ‘no-fly list’ hack
By Jonathan Greig - January 23, 2023

A Republican congressman on the House Committee on Homeland Security is seeking answers about last week’s hack of regional airline CommuteAir, which led to the exposure of a copy of the federal no-fly list from 2019.
Click to expand...

Alarm has grown since the researcher behind the hack, a Swiss national who goes by maia arson crimew, published a blog post explaining that the information was left exposed on an unsecured server alongside other sensitive data from CommuteAir, a regional airline under United Airlines.

On Saturday, Rep. Dan Bishop (R-NC), expressed outrage at the situation.

“The entire US no-fly list – with 1.5 million+ entries – was found on an unsecured server by a Swiss hacker,” he said.
“Besides the fact that the list is a civil liberties nightmare, how was this info so easily accessible? We’ll be coming for answers.”
Click to expand...

According to crimew, the list was found on an exposed Jenkins server, which companies use to build and test software. The server was found using the research tool Shodan.

While crimew said they don’t think the list should be public, they do feel that it is important for researchers to examine and assess the breadth of the impact it has and “how absolutely nonsensical it all is.”
United Airlines declined to comment on the hack and directed The Record to a spokesperson for CommuteAir, which confirmed that a researcher informed them of the misconfigured development server.
Click to expand...

EASTER · Jan 24, 2023

chrisretusn said: ↑

@EASTER, my first thought when reading that headline... you mean accidentally on purpose? I agree with you post above.
Click to expand...

Quite possibly @chrisretusn - You will agree i'm sure that too much is simply too many.

chrisretusn · Jan 25, 2023

All part of PR damage control, somebody did something stupid, so it was an accident.

EASTER · Jan 25, 2023

Mistakes do happen. Computers are excellent support devices yet their human controllers (managers) are pretty tasked with something on the order of multitasking controlled databases and i doubt none of them have been perfect 100% of the time. Of course anything is possible.

guest · Jan 30, 2023

U.S. No Fly list shared on a hacking forum, government investigating
By Ax Sharma @Ax_Sharma - January 30, 2023

A U.S. No Fly list with over 1.5 million records of banned flyers and upwards of 250,000 'selectees' has been shared publicly on a hacking forum.

BleepingComputer has confirmed the list is the same TSA No Fly list that was discovered recently on an unsecured CommuteAir server.
Click to expand...

No Fly list made public
This month, Swiss hacker maia arson crimew (formerly Tillie Kottmann), stumbled upon a misconfigured AWS server containing TSA's No Fly list, as first reported by Daily Dot journalist Mikael Thalen.

The server in question belonged to Ohio-based airline CommuteAir. Although steps were taken earlier to patch the leak, the No Fly list regardless surfaced online as of January 26th on a publicly-accessible hacking forum:
We verified with Thalen and another source that the lists posted on the forum are the same no-fly and selectee lists that were recently discovered on the CommuteAir server.
Click to expand...

U.S. Government investigating
Although the security breach originated at an exposed AWS server belonging to an airline, it has sent chills down the U.S. government machinery, with government officials and lawmakers probing into the matter.

TSA has been investigating the cybersecurity incident.

"On January 27, TSA issued a security directive to airports and air carriers," a TSA spokesperson told BleepingComputer in an updated statement.
"The security directive reinforces existing requirements on handling sensitive security information and personally identifiable information. We will continue to work with partners to ensure that they implement security requirements to safeguard systems and networks from cyberattacks."
Click to expand...

Log in or Sign up

U.S. airline accidentally exposes ‘No Fly List’ on unsecured server

guest Guest

EASTER Registered Member

chrisretusn Registered Member

guest Guest

EASTER Registered Member

chrisretusn Registered Member

EASTER Registered Member

guest Guest

Log in or Sign up

U.S. airline accidentally exposes ‘No Fly List’ on unsecured server

guest Guest

EASTER Registered Member

chrisretusn Registered Member

guest Guest

EASTER Registered Member

chrisretusn Registered Member

EASTER Registered Member

guest Guest

Useful Searches