Swiss hacker stumbles upon FBI ‘no-fly list’ – what they found is alarming: report

The federal government’s good name seems to be hurting more and more every week these days, and the hacker’s move in Switzerland is just the latest blow to law enforcement’s once-stellar reputation for security.

On Thursday, a security researcher published a blog entry showing how she allegedly easily hacked into an unsecured server and was able to access the US government terrorist verification database and her controversial A “no fly list” that contains the names of hundreds of thousands of people suspected of having links to terrorism or other illegal activities.

The server was apparently under the control of the US national airline CommuteAir, and its hack led her to government files.

In her Blog posta hacker known as “maia arsoncrimew” said that within half an hour she exposed the names and schedules of CommuteAir crews and found security credentials that allowed her to access Transportation Security Administration (TSA) No fly list.

The list she found included more than 1.5 million names, as well as lists of aliases under which they could travel and names that the federal government had flagged as prohibited from air travel in the US. daily point reported.

“The list included several well-known figures, including the recently released Russian arms dealer Viktor Bout, as well as more than 16 potential aliases for him,” the Daily Dot added.

The list included a huge number of people with Arabic and Middle Eastern names, as well as suspected members of the Irish paramilitaries, the IRA and other organizations. terrorists. One person was eight years old according to the corresponding date of birth associated with the name.

“I’m just crazy about how big this terrorism screening database is, and yet there are very clear trends towards almost exclusively Arabic and Russian-sounding names in millions of entries,” Crimew told the Daily Dot.

The TSA released a statement simply saying they were “aware of a potential cybersecurity incident” on the airline’s servers, and the FBI has not commented on the incident.

For its part, CommuteAir said the server hacked by the hacker was not its work server, but was a “development server” that was used to store educational materials and programs.

CommuteAir added that the server, which they have since taken down, also contained no customer information.

The airline also noted that List of prohibited flights found by the hacker was outdated.

“The server contained data from the 2019 version of the federal no-fly list, which included first names, last names and dates of birth,” CommuteAir corporate communications manager Eric Kane told the Daily Dot.

“In addition, information was available on some CommuteAir employees and flights. We have sent a notice to the Cyber ​​and Infrastructure Security Agency and are continuing a full investigation.”

While this may be true, the server did contain the names, addresses, and even passport numbers of about 900 CommuteAir employees, and also creates a problem for airport security.

Activists have blown up No Fly list due to its bias towards Arabic and Middle Eastern names, and crimew also noted the seeming bias, telling business insider“Looking at the files, I just confirmed a lot of things that I and maybe everyone else suspected about the biases on this list. Just by scrolling through it, you will see that almost every name is Middle Eastern.”

Interestingly, the No Fly list is not considered a secret document due to the huge number of agencies and companies that need to have access to it. However, this is one of the first times this has become known to people outside the tourism industry and law enforcement. But it has also become even more controversial in recent times when airlines started adding names of customers who will not be wearing a mask during the pandemic.

business insider noted that the hacker is a “staunch self-proclaimed leftist and anti-capitalist” who had previously been “charged with conspiracy, wire fraud and aggravated identity theft related to a previous hack in 2021.” Case about the US security camera hack is still pending.

The Justice Department alleges that she and several associates “hacked into dozens of companies and government organizations and posted the personal data of the victims of more than 100 organizations online,” the insider added.

As it turns out, CommuteAir was also hacked in November. This fact prompted criminals to point out dryly that this second security breach might finally get the company to take its job seriously. cyber security.

“Even the fact that they had already been hacked before was apparently not enough for them to actually invest in it. And it really just shows where the priorities lie,” Crimew said, adding, “I just hope they learned their lesson the second time around.”

However, the question of whether the disclosed list of perpetrators was “outdated” or not is completely irrelevant. The real problem is the fact that the hacker was able to find such sensitive information and hotspots that would allow her to carry out further hacks. This shows that too many companies with access to government servers and information do not take their computer security seriously enough, leaving us all vulnerable to attack.