Personal post written to the class. I had posted this because I felt it needed sharing, so I am saving it here too. From February 16, 2012.
Here is the paper for which this was research.
I was looking at airport websites as research and discovered a SQL Injection into an upcoming flights database. Upon verifying and documenting the vunerability, I went looking for a contact that I should send my report to and the only thing I could find was a minor TSA contact email. I ended up on the phone with a low level police information desk person and sent the report to both him and the TSA email, hoping it finds its way to the people that need the report.
The police information desk was definately not the best person to be talking to and I had to back pedel and re-explain that I was a Cybersecurity student after he asked, in a very accusing tone, "Are you a hacker?" Does he regularly have black hats calling him to report vulnerabilities? It was an Airport Police (Information / Assistance) number available on the state aviation administration contact page. I tried.
I don't have much faith in the TSA email either as I got back an auto generated response that implied that most of their incoming email is about what can and can't be carried onto a plane.
Matthew
Update: The airport in question has replaced the page in question, so this vulnerability has been corrected.
No comments:
Post a Comment