A hacker stumbled upon TSA's no-fly list via unsecured airline server

A hacker stumbled upon TSA's no-fly list via unsecured airline server

Everybody makes mistakes at work but, leaving the no-fly list exposed on the internet seems like a really bad mess-up. That's reportedly what happened with the U.S.

Everybody makes mistakes at work but, leaving the no-fly list exposed on the internet seems like a really bad mess-up. That's reportedly what happened with the U.S.

airline CommuteAir. The Daily Dot reported that a Swiss hacker known as "maia arson crimew" found the unsecured server while using the specialized search engine Shodan. There was

airline CommuteAir. The Daily Dot reported that a Swiss hacker known as "maia arson crimew" found the unsecured server while using the specialized search engine Shodan. There was

apparently a lot of sensitive information on the server, including a version of the no-fly list from four years ago. Somewhat hilariously that was reportedly found via a text file

apparently a lot of sensitive information on the server, including a version of the no-fly list from four years ago. Somewhat hilariously that was reportedly found via a text file

labeled "NoFly.csv." That is...not hard to guess. A blog post from crimew titled "how to completely own an airline in 3 easy steps" cited boredom as the reason for finding

labeled "NoFly.csv." That is...not hard to guess. A blog post from crimew titled "how to completely own an airline in 3 easy steps" cited boredom as the reason for finding

the server. They were just poking around and found it. "At this point, I've probably clicked through about 20 boring exposed servers with very little of any interest, when I

the server. They were just poking around and found it. "At this point, I've probably clicked through about 20 boring exposed servers with very little of any interest, when I

suddenly start seeing some familiar words," crimew says in their blogpost. "'ACARS', lots of mentions of 'crew' and so on. Lots of words I've heard before, most likely while

suddenly start seeing some familiar words," crimew says in their blogpost. "'ACARS', lots of mentions of 'crew' and so on. Lots of words I've heard before, most likely while

binge-watching Mentour Pilot YouTube videos. Jackpot. An exposed jenkins server belonging to CommuteAir." CommuteAir, a regional US airline headquartered in Ohio, confirmed

binge-watching Mentour Pilot YouTube videos. Jackpot. An exposed jenkins server belonging to CommuteAir." CommuteAir, a regional US airline headquartered in Ohio, confirmed

the info on the server was authentic to the Daily Dot. The server has been taken offline. "The server contained data from a 2019 version of the federal no-fly list that

the info on the server was authentic to the Daily Dot. The server has been taken offline. "The server contained data from a 2019 version of the federal no-fly list that

included first and last names and dates of birth," CommuteAir Corporate Communications Manager Erik Kane told the Daily Dot. "In addition, certain CommuteAir employee and flight

included first and last names and dates of birth," CommuteAir Corporate Communications Manager Erik Kane told the Daily Dot. "In addition, certain CommuteAir employee and flight

information was accessible. We have submitted notification to the Cybersecurity and Infrastructure Security Agency and we are continuing with a full investigation."

information was accessible. We have submitted notification to the Cybersecurity and Infrastructure Security Agency and we are continuing with a full investigation."