Safety researchers have discovered a vulnerability in a key air transport safety system that allowed unauthorized people to probably bypass airport safety screenings and acquire entry to plane cockpits.
Researchers Ian Carroll and Sam Curry found the vulnerability in FlyCASS, a third-party web-based service that some airways use to handle the Identified Crewmember (KCM) program and the Cockpit Entry Safety System (CASS). KCM is a Transportation Safety Administration (TSA) initiative that permits pilots and flight attendants to skip safety screening, and CASS allows approved pilots to make use of jumpseats in cockpits when touring.
The KCM system, operated by ARINC (a subsidiary of Collins Aerospace), verifies airline workers’ credentials by way of an internet platform. The method includes scanning a KCM barcode or getting into an worker quantity, then cross-checking with the airline’s database to grant entry with out requiring a safety screening. Equally, the CASS system verifies pilots for cockpit jumpseat entry when they should commute or journey.
The researchers found that FlyCASS’s login system was prone to SQL injection, a vulnerability that permits attackers to insert SQL statements for malicious database queries. By exploiting this flaw, they might log in as an administrator for a collaborating airline, Air Transport Worldwide, and manipulate worker information inside the system.
They added a fictitious worker, “Test TestOnly,” and granted this account entry to KCM and CASS, which successfully allowed them to “skip security screening and then access the cockpits of commercial airliners.”
“Anyone with basic knowledge of SQL injection could login to this site and add anyone they wanted to KCM and CASS, allowing themselves to both skip security screening and then access the cockpits of commercial airliners,” Carroll stated.
​Realizing the severity of the difficulty, the researchers instantly started a disclosure course of, contacting the Division of Homeland Safety (DHS) on April 23, 2024. The researchers determined to not contact the FlyCASS web site immediately because it gave the impression to be run by a single particular person and had been afraid the disclosure would alarm them.
The DHS responded, acknowledging the seriousness of the vulnerability, and confirmed that FlyCASS was disconnected from the KCM/CASS system on Might 7, 2024, as a precautionary measure. Quickly after, the vulnerability was mounted on FyCASS.
Nevertheless, efforts to additional coordinate a secure disclosure of the vulnerability had been met with resistance after the DHS stopped responding to their emails.
The TSA press workplace additionally despatched the researchers a press release denying the vulnerability’s impression, claiming that the system’s vetting course of would stop unauthorized entry. After being knowledgeable by the researchers, the TSA additionally quietly eliminated data from its web site that contradicted its statements.
“After we informed the TSA of this, they deleted the section of their website that mentions manually entering an employee ID, and did not respond to our correction. We have confirmed that the interface used by TSOs still allows manual input of employee IDs,” Carroll stated.
Carroll additionally stated that the flaw may have allowed for extra in depth safety breaches, corresponding to altering current KCM member profiles to bypass any vetting processes for brand spanking new members.
After the researchers’ report was launched, one other researcher named Alesandro Ortiz found that FlyCASS appeared to have suffered a MedusaLocker ransomware assault in February 2024, with a Joe Sandbox evaluation displaying encrypted recordsdata and a ransom observe.
​”In April, TSA became aware of a report that a vulnerability in a third party’s database containing airline crewmember information was discovered and that through testing of the vulnerability, an unverified name was added to a list of crewmembers in the database. No government data or systems were compromised and there are no transportation security impacts related to the activities,” TSA press secretary R. Carter Langston informed BleepingComputer.
“TSA does not solely rely on this database to verify the identity of crewmembers. TSA has procedures in place to verify the identity of crewmembers and only verified crewmembers are permitted access to the secure area in airports. TSA worked with stakeholders to mitigate against any ​identified cyber vulnerabilities.”
BleepingComputer additionally contacted the DHS earlier in the present day, however a spokesperson was not instantly obtainable for remark.
