Get the latest tech news
Researchers say a bug let them add fake pilots to rosters used for TSA checks
Becoming a pilot through SQL expertise.
Carroll and his partner, Sam Curry, apparently discovered the vulnerability while probing the third-party website of a vendor called FlyCASS that provides smaller airlines access to the TSA’s Known Crewmember (KCM) system and Cockpit Access Security System (CASS). Once they were in, Carroll writes that there was “no further check or authentication” preventing them from adding crew records and photos for any airline that uses FlyCASS. TSA press secretary R. Carter Langston denied that, telling Bleeping Computer that the agency “does not solely rely on this database to authenticate flight crew, and that “only verified crewmembers are permitted access to the secure area in airports.”
Or read this on The Verge
