Two security researchers have discovered a vulnerability in the record sign-in systems the Transportation Security Administration (TSA) uses to screen flight crew members at airport security checkpoints. The flaw allowed anyone with “basic knowledge of SQL injection” to sign up for airline schedules, potentially allowing them to pass through security and into the cockpit of a commercial aircraft, researcher Ian Carroll wrote in a blog post in August.
Carroll and his partner Sam Curry apparently discovered the vulnerability while examining the website of a third-party provider called FlyCASS, which provides smaller airlines with access to the TSA's Known Crewmember (KCM) system and Cockpit Access Security System (CASS). They found that if they entered a simple apostrophe in the username field, they received a MySQL error.
This was a very bad sign, as it looked like the username had been inserted directly into the SQL login query. In fact, we had discovered a SQL injection and were able to confirm the problem using sqlmap. Using the username ' or '1'='1 and the password ') OR MD5('1')=MD5('1, we were able to log into FlyCASS as the administrator of Air Transport International!
Once they were in, Carroll said, there was “no further verification or authentication” that would have prevented them from adding crew records and photos for any airline using FlyCASS. Anyone who might have exploited the vulnerability could have presented a false employee number to get through a KCM security check, the blog said.
TSA spokesman R. Carter Langston denied this and said Beeping computer that the authority does not rely exclusively on this database to authenticate flight personnel and that “only verified crew members have access to the security areas of the airports”.