116 pointsby bearsyankeesa day ago13 comments
  • ISL18 hours ago
    Avelo assists ICE daily with deporting people from the United States:

    https://bsky.app/profile/jjindc.bsky.social/search?q=avelo

    • Scoundreller11 hours ago
      > Search is currently unavailable when logged out

      Can you hook us up with some deep links?

    • mattmaroon15 hours ago
      Can’t load that but don’t they all? I can’t imagine any airline telling the federal government no.
      • 13 hours ago
        undefined
      • apical_dendrite12 hours ago
        I think Avelo is the only airline that participates. The rest are charter companies.
    • dogemaster203214 hours ago
      [flagged]
    • thedrbrian9 hours ago
      [flagged]
      • saikia816 hours ago
        good question. After reading his passionate plea for the immigrants, anyone would ask your question.
  • jberglera day ago
    The 6 hour claim is interesting, but I highly doubt Avelo (or any airline) would handle 100k requests/sec

    If we consider that the real major's move about 400k-500k passengers/day, let's be really optimistic and say that they check their booking 6 times a day for the week before they fly. That's around 250 requests/sec.

    Anyone know about the consumer facing tech stacks at airlines these days? Seems unlikely that they'd have databases that would auto scale 400x...

    • kiklion21 hours ago
      I doubt their API would handle 100k requests per second. That math was roughly indictive of what the cost to send 100k requests per second would look like. He did mention that that was assuming the target didn't have rate limiting, either intentional or just pure limits of the hardware.
    • bronco2101616 hours ago
      Cloud API gateway providers advertise ~10,000 rps.

      I think more likely the API would be behind some kind of bot protection that would shut this down before any kind of technical rate limit is reached.

  • mtlyncha day ago
    >The Avelo team was responsive, professional, and took the findings seriously throughout the disclosure process. They acknowledged the severity, worked quickly to remediate the issues, and maintained clear communication. This is a model example of how organizations should handle security disclosures.

    Sounds like no bug bounty?

    It's great if OP is happy with the outcome, but it's so infuriating that companies are allowed to leak everyone's data with zero accountability and rely on the kindness of security researchers to do free work to notify them.

    I wish there was a law that assigned a dollar value to different types of PII leaks and fined the organization that amount with some percentage going to the whistleblower. So a security researcher could approach a vendor and say, "Hi! I discovered vulnerabilities in your system that would result in a $500k fine for you. For $400k, I'll disclose it to you privately, or you can turn me down and I'll receive $250k from your fines."

    • edenta day ago
      > I wish there was a law that assigned a dollar value to different types of PII leaks

      There is. It is called GDPR.

      Plenty of companies have been fined for leaks like this.

      Some countries also have whistleblower bounties but, as you might expect, there are some perverse incentives there.

      • mtlyncha day ago
        Yeah, as an American, I'm jealous of many aspects of GDPR. I really appreciate you blogging / tooting about experiences protecting your rights under GDPR. I wish we had 1/10th of the consumer privacy protections you have.

        How does security research like this work out in practice, in the EU?

        I read a lot of vulnerability writeups like this and don't recall seeing any where the author is European and gets a better outcome. Are security researchers actually compensated for this type of work in the EU?

      • advisedwang20 hours ago
        The GDPR (in art 32) only requires that "the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk". I expect it's quite common for a company to get hacked even if they meet that level. I think the parent comment was imagining that any leak is automatically fined, regardless of whether the company had met some security requirement.
      • samuria4 hours ago
        Does GDPR mandate a payout to the researcher after disclosure?
      • billy99k21 hours ago
        The GPDR makes it so small companies need to hire expensive lawyers to be compliant (and you still don't know for sure, based on the laws)

        How about fining individual developers with poor coding practices?

        • immibis4 hours ago
          No it actually doesn't. It just needs someone in the company executive to not have their head up their ass, and read the law, which is fairly straightforward.

          Also, it needs your company's business model to not be selling user data. That's why American companies find it hard to comply with.

        • matthewmacleod20 hours ago
          It does not mean this.
    • bossyTeacher21 hours ago
      > it's so infuriating that companies are allowed to leak everyone's data with zero accountability and rely on the kindness of security researchers to do free work to notify them.

      This is a matter for lawmakers and law enforcement. Campaign for it. Nothing will change otherwise

  • didgetmaster21 hours ago
    The lack of needing the last name might have allowed a hacker to brute force the whole list; but it seems that even with a last name, it could expose a lot of PII. Just pass codes along with popular last names (Smith, Jones, Nelson, etc.) and it seems like it could spit out a bunch of reservations.
    • miki12321121 hours ago
      I'd go for wang, Li and Zhang instead, maybe also Patel and Nguyen. Asian countries have a much more skewed surname distribution.
    • morpheuskafka13 hours ago
      Yes, it's also an issue when someone posts their bag tag/boarding pass/booking email online.

      But that's the "industry standard" for checking a reservation online. Requiring airline login doesn't work because of tickets issued by travel agents or other airlines.

    • codethief6 hours ago
      Exactly, I came here to say this!

      > This two-factor system is generally secure. The space of all 6-character alphanumeric confirmation codes combined with all possible last names is astronomically large, making it impossible to “guess” a valid pair.

      Depending on the threat model, the attacker's goal might not be to guess a single pair but to access any valid pair (of a booking with a flight date in the future, or maybe even in the past). Suddenly you're looking at thousands of valid booking codes and the attacker can try a couple dozen of common names. Brute-forcing valid pairs then becomes relatively easy.

  • > They were responsive, professional, and took the findings seriously, patching the issues promptly.

    The "issue" is that they're returning the entire PNR dataset to the front-end in the first place. He doesn't detail how they fixed it, but there's no reason in the world that this entire dataset should be dumped into Javascript. I got into pretty heated arguments with folks about this at Travelocity and this shit is exactly why I was so adamant.

  • miki12321121 hours ago
    Do we know what GDS Avelo is using? In other GDSes, is the confirmation code always sufficient to fully identify a booking? I was under the impression that PRLs could be re-used as long as the passenger surname was different.

    The space of all possible PRLs is about 2 billion, I can imagine a really big Airline moving that many passengers.

    • rootsudo20 hours ago
      They use a service of Sabre but not Sabre GDS. it’s called Radixx.

      Yes in other GDS, it can be enough to identify a full booking. That’s why airlines prefer ticket or coupon number since the first two digits are the airline ticket stock / identifier and then fare codes, etc

      The requiring last name, and more info is more or less security since any pss system can query the airline first for that combination before requiring more info to return a match.

      • lxgr20 hours ago
        6 alphanumeric, case insensitive characters only allow for about 2 billion unique combinations. I’d have guessed there were more reservations made than that?

        Or are PNR locators recycled after a while?

        • bleepblap19 hours ago
          Yes, I've got in my drawer two physical boarding passes with the same PNR
    • aardvark17920 hours ago
      Confirmation codes are not sufficient on their own, they cycle through them relatively quickly so they have to be combined with things like the passengers family name to actually identify the booking.
  • CtrlAltNerda day ago
    Great work, very impressive find.
  • RealSoyboyRoy11 hours ago
    > I immediately disclosed this to the Avelo team. They were responsive, professional, and took the findings seriously, patching the issues promptly.

    (emphasis my own)

    Sorry but I strongly disagree with this phrasing. This is a company "serving over 6 million customers since its 2021 launch" (from Google) that took four weeks to patch an embarrassing security flaw, after being handed all the details on a silver platter.

    Imagine a food chain serving a million meals a year was revealed to be storing their food products in unsanitary conditions, and it took them a full month to correct this. That story would make national headlines, not to mention they could get promptly shut down by any competent health ministry.

    I think this attitude mostly reveals how complacent we've become about these """incidents""": we just expect this to happen, everywhere and all the time, then we just shrug and say "they fixed it within a month, how responsible of them".

  • dboreham20 hours ago
    Always consider rate limiting if you deploy a public endpoint. Always require authentication to perform resource-consuming and/or privacy leaking requests. (Requiring authentication makes rate limiting more practical since even a distributed attacker would need many credentials, which they probably don't have).
    • cake6 hours ago
      Any tips on how to define the rate limits for a web app with moderate traffic? For logged and anonymous users?
  • a day ago
    undefined
  • klysma day ago
    Annoying sensationalist writing, but good find!
  • mattmaroona day ago
    Major? Avelo?
    • s1mon19 hours ago
      Agreed. I read the headline as "... US Airlines' ..." not "... US Airline's ..." and it seemed much more concerning. Instead it's a single airline I've never heard of. Looking them up, they are more established than I might have guessed (started as Casino Express Airlines 38 years ago, but current incarnation is only 4 years old), but also pretty small - roughly 1/100 the staff and 1/50 the fleet of United.

      https://en.wikipedia.org/wiki/Avelo_Airlines

      • mattmaroon14 hours ago
        Ha I guess I flew them in a past incarnation but didn’t know that.
  • Nextgrida day ago
    This is about a non-rate-limited endpoint providing ticket data given a booking code only (and not last name as it's usually the case), which makes it feasible to bruteforce the entire search space.

    (unfortunately, I feel like AI was overused in authoring the writeup)

    • fileartsa day ago
      Is it really AI slop if someone leverages AI to improve / transform their novel experiences and ideas into a rendition that they prefer?

      I'm not suggesting whether or not the article is AI assisted. I'm wondering if the ease of calling someone's work "AI slop" is a step along the slippery slope towards trivializing this sort of drive-by hostility that can be toxic in a community.

      • Nextgrida day ago
        You are right about the toxicity, I will edit my comment.

        There's a difference between leveraging AI to proofread or improve parts of their writing and this - I feel like AI was overused here; gave the whole article that distinctive smell and significantly reduced its information density.

    • dado3212a day ago
      What makes you say that? This didn't read like AI slop to me.
      • Nextgrida day ago
        Overuse of bulleted lists, unnecessary sensationalism, sentences like "The requests flew. There was no WAF, no IP blocking, no CAPTCHA." and so on. It reeks of someone pasting some notes into a chat prompt and asking it to spruce it up for publication.
      • PKopa day ago
        Pattern recognition skill issue then. It did to me.

        "The fallout"

        This flaw was critical.

        And other vibes. You know it when you see it, though it may be hard to define.

        • mmoossa day ago
          > You know it when you see it

          How do you know your perception is accurate? One of humanity's biggest weaknesses is trusting that kind of response.

          • PKopa day ago
            Maybe just try having confidence in yourself. Trust your instincts. I'm not going to impugn my own abilities based on some purported flaw in an abstract amorphous blog called "humanity", whatever that is. A lot of individuals of distinction have many characteristics better than the average, why wouldn't I trust myself more than other people?

            Pattern recognition is a many millions of years evolved ability best exemplified in the "human" species by the way, so I basically disagree with your whole premise anyways.

            • tempsaasexample16 hours ago
              The Brown killer was basically caught by a homeless man getting a bad vehicle about the future shooter. So I agree, trusting your gut is definitely a thing.
            • mmooss14 hours ago
              People believe in witchcraft and lots of other things - including many horrible prejudices - just as confidently as you. There's a reason any scholarship, courts, medicine, and any other serious endeavors require objective evidence.

              Imagine that - doctors, who have seen everything, have years of study, treat all those people, still require objective evidence. Anyone in IT looks for objective evidence - timing, stepping through code, etc.

              Confidence doesn't correlate well with accuracy; in fact the more someone expresses your kind of confidence, the less I rely on them at all.

              What if you wrongfully accuse someone? Does that matter? Are you responsible for the consequences of what you do?

              • PKop14 hours ago
                You turn your brain off and outsource your thinking to other people, because you're incapable of perceiving reality for yourself, is what you're telling me.

                Of course everyone is responsible for their accuracy and their errors, doesn't mean it's impossible to infer things based on observation experience and intuition. This is an evolved ability, but I do agree some people are better than others like most things.

                You're conflating a lot of things. Many prejudices are accurate and prudent, which craft is stupid, but so what? I'm not going to deny my perception on something that's correct just because some other idiot believes in magic; non sequitur.

                • mmoossan hour ago
                  It's really a bizarre argument. You are making evidence-free claims, based on nothing - including the things you say about me. It discards all of critical thought, empiricism, reasoning, philosophy, etc. ....
          • verall17 hours ago
            It's definitely AI dude
            • mmooss14 hours ago
              Have you ever tested your accuracy? I think there are tests out there.
        • sallveburrpia day ago
          What is the AI slop version of “This looks shopped. I can tell from some of the pixels and from seeing quite a few shops in my time.”

          ?

          • A4ET8a8uTh0_v26 hours ago
            'Having seen this cognitive payload a lot in my time' maybe? I like the idea.
      • tverbeurea day ago
        > This incident is a stark reminder

        A stark reminder is a stark reminder about the existence of AI slop. You see the phrase a lot in social media comment spam.

      • delfinoma day ago
        There's an emdash, no human being uses emdashes.