Video: Hackers Bypass TSA Security with SQL Injection

what if I told you that an old but recent vulnerability could have allowed anyone to bypass airport security well buckle up Travelers cuz it's about to be some turbulence what's up everybody welcome back to e security Planet your go-to channel for all things cyber security security researchers Ian Carroll and Sam Curry were on a routine flight recently when they noticed something interesting while waiting in the airport security line and in true hacker fashion they decided to do some d what they found was a classic security vulnerability in a TSA application that could have allowed them to bypass security checks at several major airports or even fly in the cockpit or flight deck section of some Airlines now if you've been to the airport instead of those long TSA lines you might have noticed a section that runs very smoothly and allows authorized Personnel to skip the lines and Security checks altoe nope I'm not talking about the TSA pre-check or the clear section what I'm referring to is the KCM or known crew member section the KCM is a TSA program that allows pilots and flight attendants to bypass security checks for airline flights instead they provide the TSA agent with information like their employee number aircraft crew member photo ID current government issued photo ID and a KCM barcode the TSA verifies this information and if successful grants the employee access without any further screening there's also a similar system called the cockpit access security system or Cass that grants Pilots access to the jump seat located on the flight deck or cockpit area of mos Airline Jets gate agents use Cass to verify that the person is indeed a pilot and authorized to be in that jump seat they then notify the crew that the Pilot's being authenticated by this program the KCM and the cas programs can be accessed online via a website pilots and flight attendant from 77 different airlines can access the application and check their KCM status one of these websites is fly cast.com and that's where things get interesting the researchers discovered a login page of a smaller airline that uses that application however that's all they found and as they were about to call it quits they tried one last thing a single quote or a tick in the username section and this is what came back now most regular users would see this as some type of glitch or a mundane error message but to hackers and Security Professionals this message is a blast from the past and for Ian and Sam this meant a realm of possibilities and that's because that MySQL error message meant that the username input was being processed as a SQL query making it vulnerable to SQL injection now before we get into what happened next first I need to explain what SQL injection is SQL or SQL injection is a Cyber attack where malicious SQL quote is injected into a vulnerable web application this allows an attacker to manipulate the application's database potentially leading to unauthorized Access Data Theft or even full control of the system in the past SQL injection attacks were very popular resulting in several major data breaches including 7-Eleven Heartland Payment Systems Sony Pictures and Equifax what made things worse was that exploiting the vulnerability was relatively simple developers would neglect to properly sanitize user input allowing attackers to insert malicious SQL quote into forms or query strings for example an attacker might input something like this this code would trick the application into executing a query that always returned is true granting the attacker access to all data in the database over the years web application has improved significant ly developers have become more aware of SQL injection vulnerabilities and have implemented various measures to prevent them these are things like input validation that sanitizes user input web application firewalls to detect and block common attacks and parameterized queries that separate SQL code from data this prevents attackers from injecting malicious SQL code resulting in SQL injection being harder to find and even harder to exploit and it's even lost its top spot in the OAS top 10 it was number one and now it's is currently number three so what happened next well after discovering the vulnerability Ian and Sam quickly confirmed it by typing this in the username and this in the password with the help of a tool called SQL map these malicious queries granted them access to the flycast application as an administrator of the airline that they found earlier and with that access they could manage the list of pilots and flight attendants change the names and photos of existing users and add anyone as an authorized user for KCM and Cass so this means means that anyone with Google and basic knowledge of how SQL injection works could skip security and possibly sit in the cockpit section of a commercial airline saman then contacted the Department of Homeland Security who confirmed and acknowledged the finding with the Chief Information Security Officer saying that the issue was quote being taken very seriously the next day the flycast application was disconnected from KCM and casss and the vulnerability appeared to have been fixed however after the issue was resolved DHS cut Communications with the researchers when they attempted to coordinate the safe disclosure of the vulnerability a common practice for Security Professionals who discover major vulnerabilities in companies and applications to make matters worse the TSA press office issued according to Ian Carroll dangerously incorrect statements essentially denying what Ian and Sam had discovered according to Ian the TSA press office said in a statement that this vulnerability could not be used to access a KCM checkpoint because the TSA initiates a vetting process before issuing a KCM barcode to a new member however a KCM barcode is not required to use a KCM checkpoint as a transportation security officer or TSO can enter an employee ID manually he continues to say after we inform the TSA of this they deleted a section of their website that mentions manually entering an employee ID and did not respond to our correction we have confirmed that the interface used by the tsos allows manual input of employee IDs a spokesperson from the TSA responded to the register with the following statement in April TSA became aware of a report that a vulnerability in a third party's database containing Airline crew member information was discovered and through testing of the vulnerability an unverified name was added to the list of crew members in a database no government data or systems were compromised and there are no Transportation Security impacts related to the activities they then say TSA does not solely rely on this database to verify the identity of crew members TSA has procedures in place to verify the identity of crew members and only verified crew members are permitted access to the secure area in the airports TSA worked with stakeholders to mitigate against any identified cyber vulnerabilities now this incident has people divided some argue that such an old vulnerability that's relatively easy to exploit and existing on a system in 2024 exposes a massive hole in airport security and the lack of transparency and the initial denial from the TSA raises concerns about how serious the authorities take such security flaws however others side with the TSA and say things like background Security checks would have still prevented any unauthorized access whatever side you're on I think we can all agree that it's great that responsible security researchers discovered the issue and reported it which led to it being fixed what do you think let us know in the comment section below what you think about this entire situation and also let us know if you'd like to see more content like this and don't forget to like the video and subscribe to the channel for more security related content thanks for watching the security planet and I'll see you next time

This transcript was generated automatically from the video's captions and may contain errors.