Flightaware security breach

NoHeat

NoHeat

Final Approach
Joined
Jul 27, 2009
Messages
5,021
Location
Iowa City, IA
Display Name
Display name:
17
Got this email from Flightaware:

On July 25, 2024, we discovered a configuration error that may have inadvertently exposed your personal information in your FlightAware account, including user ID, password, and email address. Depending on the information you provided, the information may also have included your full name, billing address, shipping address, IP address, social media accounts, telephone numbers, year of birth, last four digits of your credit card number, information about aircraft owned, industry, title, pilot status (yes/no), and your account activity (such as flights viewed and comments posted).​
What We Are Doing?​
FlightAware values your privacy and deeply regrets that this incident occurred. Once we discovered the exposure, we immediately remedied the configuration error. Out of an abundance of caution, we are also requiring all potentially impacted users to reset their password.​
 
How can they expose my password, I wonder? I thought that passwords are are normally encrypted on servers.
 
NoHeat said:
How can they expose my password, I wonder? I thought that passwords are are normally encrypted on servers.
Click to expand...
Yes, but if you can get ahold of the encrypted file, there is a good chance many could be cracked, depending on how strong an encryption algorithm was used in the first place
 
eman1200 said:
When I become president, $1 billion fine per person for any company that has a security breach of sensitive data. I’m sick of it.
Click to expand...
That would take us back to the Stone Age right quickly.
 
Passwords are "normally" encrypted as you say, but that doesn't mean that everyone does that. You have no way of knowing whether any particular website does or not. Hackers can also use rainbow tables where they have precomputed the encrypted version of millions/billions of common passwords and they can just search the password file to see if there are any matches. There are ways to mitigate that (such as salting the passwords) but, again, you don't know if the website is doing that.
 
NoHeat said:
How can they expose my password, I wonder? I thought that passwords are are normally encrypted on servers.
Click to expand...

If by "normally" you mean "usually" then yes. But "usually" doesn't mean "always". And they could be decryptable or crackable especially if they're not using industry best practices.
 
eman1200 said:
When I become president, $1 billion fine per person for any company that has a security breach of sensitive data. I’m sick of it.
Click to expand...
How about a simple $2000 to each affected person for the actions they now have to take to protect indentify and account information instead.
 
For those that did not receive the email, does that mean they are not affected?
Asking for a friend.
 
pdonahue said:
Passwords are "normally" encrypted as you say, but that doesn't mean that everyone does that. You have no way of knowing whether any particular website does or not. Hackers can also use rainbow tables where they have precomputed the encrypted version of millions/billions of common passwords and they can just search the password file to see if there are any matches. There are ways to mitigate that (such as salting the passwords) but, again, you don't know if the website is doing that.
Click to expand...
One-way hashed password and salted to avoid use of rainbow tables. Too easy to do and can't imagine any reasonably sophisticated company like Foreflight not doing this. Interesting. I never got the notification.

Sent from my SM-S918U using Tapatalk
 
eman1200 said:
When I become president, $1 billion fine per person for any company that has a security breach of sensitive data. I’m sick of it.
Click to expand...
Fine schmine. That’s like pocket change to some. Houzabout a real ‘deterent.’ Use your imagination
 
MountainDude said:
For those that did not receive the email, does that mean they are not affected?
Asking for a friend.
Click to expand...
I think they reset everyone’s password.

And kudos to them for not waiting months and months to do that.
 
MountainDude said:
For those that did not receive the email, does that mean they are not affected?
Asking for a friend.
Click to expand...
It means your friend's email was already hacked. The hackers intercepted the warning and deleted it so your friend would never know.
 
Salty said:
That would take us back to the Stone Age right quickly.
Click to expand...
On the plus side, we wouldn't have to worry about computer hacking any more then.
 
eman1200 said:
When I become president, $1 billion fine per person for any company that has a security breach of sensitive data. I’m sick of it.
Click to expand...
Nah, the hackers responsible should be held in stocks in the public square and then punished severely. Same for the spam call overlords.
 
GTO1969 said:
One-way hashed password and salted to avoid use of rainbow tables. Too easy to do and can't imagine any reasonably sophisticated company like Foreflight not doing this. Interesting. I never got the notification.

Sent from my SM-S918U using Tapatalk
Click to expand...
The original post references Flightaware.
 
I have a real love/hate relationship with tech. For context, I'm so old that my 600-page PhD thesis was produced on a typewriter (at least it was an electric typewriter, but my term papers in college were produced on a manual typewriter before electric typewriters became common--yes, I'm THAT old). And graphics didn't get to the point where they were helpful until I was well into my career.

On the one hand, tech does, in fact, make life a lot easier and more efficient....when it works like it's supposed to. But it sure has introduced a lot of negative things into our lives, too. I guess it's all relative. Those of you who grew up in a post-tech world (i.e., after personal computers became common) don't know any different.
 
eman1200 said:
When I become president, $1 billion fine per person for any company that has a security breach of sensitive data. I’m sick of it.
Click to expand...
If I were the president of this land, I'd declare total war on the hacker man.
hackerman.jpg
 
eman1200 said:
When I become president, $1 billion fine per person for any company that has a security breach of sensitive data. I’m sick of it.
Click to expand...
I'll back that if the law includes the death penalty for anyone committing these security breaches.
I seem to remember a Clancy novel (I think) where we bombed a building in China where a hacking group was based. I liked that concept.
 
I missed it - what is the risk of having our login to FlightAware compromised?
I don't believe their is anything of value there.
 
judypilot said:
On the one hand, tech does, in fact, make life a lot easier and more efficient....when it works like it's supposed to. But it sure has introduced a lot of negative things into our lives, too. I guess it's all relative. Those of you who grew up in a post-tech world (i.e., after personal computers became common) don't know any different.
Click to expand...
I've often thought computers and the "ease" of versioning just meant you spent the same amount of time on a project, but the number of options created/reviewed went up by a factor of 10. When, in fact, you knew the optimum solution was probably in one of the first 3 options you generated...
 
dans2992 said:
The only risk I can see is if you used the same password on multiple sites…
Click to expand...

Which is why one needs a three-part password (at minimum). One part that's standard across all passwords. One that can increment as each service requires its own update schedule. And one part that's unique to each site. If each of these parts is four characters long, you'll have a minimum password length of twelve.
 
dans2992 said:
The only risk I can see is if you used the same password on multiple sites…
Click to expand...

Dang. That means they can get into my POA account too.

Whoops, different username and email adrress for the two. I’ll mark myself safe from this breach.
 
It’s quite annoying, but you can control who has what data of yours. Do you need to always gives your full name address phone email etc. Something to think about, you cannot control their systems and the users who have access to them. All of the hotel chains also had data leaks too.
 
You must log in or register to reply here.
Back
Top