1
Bypassing airport security via SQL injection
We discovered a serious vulnerability in the Known Crewmember (KCM) and Cockpit Access Security System (CASS) programs used by the Transportation Security Administration.
Ian Carroll
I'm the founder of Seats.aero, a site for discovering flights with points and miles. Outside of work, I do security research on bug bounties, transportation, and other interesting areas.
- Popular posts
- 5
- Total points
- 3,348
- HN comments
- 853
- Rank
- #416 personal
Visit ian.sh → On Hacker News Aug 2021 – Oct 2025
2
Accessing Max Verstappen's passport and PII through FIA bugs
We found vulnerabilities in the FIA's Driver Categorisation platform, allowing us to access PII and password hashes of any racing driver with a categorisation rating.
3
MarkMonitor left 60k domains for the taking
Thanks to Nagli and d0xing for helping figure out what was happening with this issue.
4
Security concerns with the e-Tugra certificate authority
Certificate authorities (CAs) are a critical backbone of internet security; when they are compromised, users lose the ability to securely connect to websites without fear of interception. Websites cannot insulate themselves against a fully-compromised CA, even if they normally use other CAs.
5
Would You Like an IDOR With That? Leaking 64m McDonald's Job Applications
When applying for a job at McDonald's, over 90% of franchises use "Olivia," an AI-powered chatbot. We discovered a vulnerability that could allow an attacker to access more than 64 million job applications. This data includes applicants' names, resumes, email addresses, phone numbers, and personality test results.