Why Are People Calling Patrick Star 'Subaru' On TikTok? The Viral 'SpongeBob' Memes Explained
What's Up With President Trump Defunding 'Transgender Mice' Research? The Origin Of The Viral Debate And Meme Explained
Why Was Content Creator Amouranth The Target Of A Home Invasion? The Attempted Crypto Robbery On The Streamer Explained
What Does 'GM' Mean On TikTok? The Viral 'Dating A GM' Meme Explained
What's The 'My Name Is Edwin' Meme? The 'FNAF Mimic Song' And The Silhouette Of Edwin Murray Explained

The TSA no fly list got leaked in the funniest possible way h-------- MR. BISHOP dandy @daxdives CAN CNN Republican lawmaker indicates Congress will investigate TSA no-fly list TSA Pre 个 ENTRANCE o Zoomly Fox Business TSA 'no fly' list leake being found on unse airline server note: this is a slightly more technical and comedic write up of the story covered by my friends over at dailydot, which you can read here step 1: boredom like so many other of my hacks this story starts with me being bored and browsing shodan (or well, technically zoomeye, chinese shodan), looking for exposed jenkins servers that may contain some interesting goods. at this point i've probably clicked through about 20 boring exposed servers with very little of any interest, when i suddenly start seeing some familar words. "ACARS", lots of mentions of "crew" and so on. lots of words i've heard before, most likely while binge watching Mentour Pilot YouTube videos, jackpot, an exposed jenkins server belonging to CommuteAir. 2030 rss feed birded site fedded verse sounded cloud last dot federated states of micronesia | gitted hub Igitted tea HOSTAS M 88 X 31 a ost zo SAM estmeline A.C.A.B. Carchinu 1:53 AM Jan 22, 2023 2.2M Views SARE WOVE This site is part of the lavender software webring! SAIME T

Share Pin Download More

maia arson crimew no fly list leak no fly list leak tsa no fly list switzerland swiss leaked

Origin Entry: Maia Arson Crimew's "No-Fly List" Leak

File type: png

Resolution: (1210px x 1204px)

File size: 1.02 MB

wath DE T hackers in movies hackers in real life

imgflip.com Leaking world government secrets as a lark uwu theme tumblr user with time to kill War thunder players p----- their fave vehicle is 5% too slow Manden 2012

View All 25 Images

More:

Maia Arson Crimew's "No Fly List" Leak Meme

Queenie @queer_queenie people will call themselves cyberpunk fans and then with no cognitive dissonance call a queer hacker furry who got the no fly list "cringe" 1:49 PM Jan 22, 2023 32.8K Views 581 Retweets 6 Quote Tweets 2,909 Likes ●●●

Pin

Maia Arson Crimew's "No Fly List" Leak Meme

Cloudy (estrogen angel) @oncloud_e after years of us being groped by the TSA for having t--- and a d---, i think it's pretty cool that a trans woman got to hack the no fly list out of them 4:03 PM Jan 22, 2023 · 204.3K Views ● 930 Retweets 10 Quote Tweets 12K Likes

Pin

Maia Arson Crimew's "No Fly List" Leak Meme

imgflip.com Leaking world government secrets as a lark uwu theme tumblr user with time to kill War thunder players p----- their fave vehicle is 5% too slow Manden 2012

Pin

Maia Arson Crimew's "No Fly List" Leak Meme

Lucas @Punished Link Someone leaking the entire no fly list on this f------ blog is the funniest thing I've ever seen maia arson crimew home blog | sample packs O results (0.60 seconds) 5 ⠀ how some exposed hello i am maia arson crimew (it/she) and i am gay, mostly for girls, a 11:27 AM Jan 21, 2023 5.2M Views i know lot's of things about cyber security, programming and far too still try to do all those things at once. if you like the things i do here can support me on ko-fi. links to the various things i do can be found looking for some more serious info about me, there is wikipedia for st data ed site | fedded verse sounded cloud | last dot federated states of micronesia | gitted hub versary A.B. archlinux A sleegy fr town HOYU ANARCHY Now! Zone radio DB The Daily Beast TSA's 'No Fly List' Data L Up for Grabs on Unprotec Server: Report 22 hours ago CBS News : How did no-fly list of suspected terrorists end u online? 3 hours ago More news →

Pin

Maia Arson Crimew's "No Fly List" Leak on Twitter

maia arson crimew @_nyancrimew this was one of the most fun stories i've worked on so far, thanks for the great collaboration once again Mikael and David Mikael Thalen @MikaelThalen • Jan 19 NEW: The federal No Fly List was exposed on an open server discovered by a security researcher last week. The list, which was being stored by the US airline CommuteAir, contained over 1.5 million rows of data including names, aliases, & birth dates. dailydot.com/debug/no-fly-l... Show this thread ●●● 4:51 PM Jan 19, 2023 79.7K Views www

Pin

Maia Arson Crimew No Fly List Leak Meme

Sarah Burssty @SarahBurssty so the person who ended up cracking the TSA no fly list is a trans person whose blog is bright pink and purple like its still the mid-2000s and took a pic of the no fly list with a sprigatito plushie, of which the domain for all of what i mentioned ends in .gay we stay winning 5:10 PM. Jan 19, 2023 144.1K Views ●

Pin

Maia Arson Crimew "holy shit, we actually have the nofly list. holy fucking bingle. what?! :3"

h--------, we actually have the nofly list. holy f------ bingle. what?! :3 commute Visual Studio Codle 11:41 T & 6 HUAWEI - / 7 Z H BA 1 ( 8 U N 9170 O 1 9 1 M O O ; . L ? P 6 O : Alt Gr ė A Ctrl al L 51 A

Pin

Maia Arson Crimew "This Aviation Shit Getting Serious"

this aviation s--- get serious Remote site: /ForNavtech/ACARS IN STY DUT PDF OUT ForNavtech ACARS IN AIMS IN FUELIN Filename A Filesize Filetype in-01012023-00... in-01012023-00... in-01012023-00... in-01012023-00... in-01012023-01.... in-01012023-01... in-01012023-01.. in-01012023-011... in-01012023-01 in-01012023-01... in01012023-01 in-01012023-01... in-01012023-01 in-01012023-01... in-01012023-01 01012023-01... in-01012023-0 125 RCV-file 126 RCV-file 129 RCV-file 133 RCV-nte 126 RCV-file 126 RCV-file 133 RCV-file 127 RCV-file 127 RCV-file. 127 RCV-file 129 RCV-file 127 RCV-file 127 RCV-file 127 RCV-file 127 RCV-ke 127 RCV-le 126 RCV-e 127 RCV nie 127 RCV-tie 127-BOY- 05012023-01 in-01012023-01 Last modified Permission Owner/Gro 658 500 658 500 658 500 658 500 658 500 658 500 658 500 658 500 658 500 658 500 01012023-01 01/06/2023. -rw-r 01/06/2023... ----- 01/06/2023... -rw-r---- 01/06/2023. -rw-r- 01/06/2023... -rw-r--- 01/06/2023... -rw-r--- 01/06/2023... -rw-t-- 01/06/2023 -rw-r--- 01/06/2023. -rw-r-- 01/06/2023 01/06/2023 01/06/2023. 01/06/2023 01/06/2023 01/06/2023 01/06/2023 QU06/2023 QU09/2023 01/06/2023 01/04/2023 28319 fos Total size 3.581552 bytes -ZW-7-7- -W-I--- -TW-1- 578 the 4-4- 658 500 658 500 558 500 658 500 658 500 658 500 658 500 658 500 458 900 658-500

Pin

Maia Arson Crimew "how to completely own an airline in 3 easy steps and grab the TSA nofly list along the way"

i also share with him how close we seemingly are to actually finding the TSA nofly list, which would obviously immediately make this an even bigger story than if it were "only" a super trivially ownable airline. i had even peeked at the nofly s3 bucket at this point which was seemingly empty. so we took one last look at the noflycomparison repositories to see if there is anything in there, and for the first time actually take a peek at the test data in the repository. and there it is. three csv files, employee_information.csv, NOFLY.Csv and SELECTEE.Csv. all commited to the repository in july 2022. the nofly csv is almost 80mb in size and contains over 1.56 million rows of data. this HAS to be the real deal (we later get confirmation that it is indeed a copy of the nofly list from 2019). h--------, we actually have the nofly list. holy f------ bingle. what?! :3 - comunale Visual Statio % 5 4 T 6 HUAWEI 12⁰ / Z 1 ST H ( 8 ប N O J 9 1 M 192.168.1.2 O O : L P 6 Alt Gr O é 0 Ctri at 51 A with the jackpot found and being looked into by my journalism friends i decided to dig a little further into aws. grabbing sample documents from various s3 buckets, going through flight plans and dumping some dynamodb tables. at this point i had found pretty much all PII imaginable for each of their crew members. full names, addresses, phone numbers, passport numbers, pilot's license numbers, when their next linecheck is due and much more. i had trip sheets for every flight, the potential to access every flight plan ever, a whole bunch of image attachments to bookings for reimbursement flights containing yet again more PII, airplane maintenance data, you name it.

Pin

Maia Arson Crimew "how to completely own an airline in 3 easy steps and grab the TSA nofly list along the way"

FE T & / Z H ( 1 8 U N O 1 1 M K Fo 0 O ; . siss L T P 6 : Alt Gr O FN A BULAN 9 1 à Ctrl Y -1 E 51 with the jackpot found and being looked into by my journalism friends i decided to dig a little further into aws. grabbing sample documents from various s3 buckets, going through flight plans and dumping some dynamodb tables. at this point i had found pretty much all PII imaginable for each of their crew members. full names, addresses, phone numbers, passport numbers, pilot's license numbers, when their next linecheck is due and much more. i had trip sheets for every flight, the potential to access every flight plan ever, a whole bunch of image attachments to bookings for reimbursement flights containing yet again more PII, airplane maintenance data, you name it. i had owned them completely in less than a day, with pretty much no skill required besides the patience to sift through hundreds of shodan/zoomeye results. so what happens next with the nofly data while the nature of this information is sensitive, i believe it is in the public interest for this list to be made available to journalists and human rights organizations. if you are a journalist, researcher, or other party with legitimate interest, please reach out at nofly@crimew.gay. i will only give this data to parties that i believe will do the right thing with it. alternatively the data is now also available for access (upon request) via DDoSecrets. note: if you email me there and i do not reply within a regular timeframe it is very likely my reply ended up in your spam folder or got lost. using email not hosted by google or msft is hell. feel free to dm me on twitter in that case. support me if you liked this or any of my other security research feel free to support me on my ko-fi. i am unemployed and in a rather precarious financial situation and do this research for free and for the fun of it, so anything goes a long way.

Pin

Maia Arson Crimew "how to completely own an airline in 3 easy steps and grab the TSA nofly list along the way"

here is a sample of a departure ACARS message: ~/bounty/commutair 20:41:44 $ cat in-01012023-003509-1136486_DEP. RCV 6 7 File: in-01012023-003509-1136486_DEP. RCV from here on i started trying to find journalists interested in a probably pretty broad breach of US aviation. which unfortunately got peoples hopes up in thinking i was behind the TSA problems and groundings a day earlier, but unfortunately im not quite that cool. so while i was waiting for someone to respond to my call for journalists i just kept digging, and oh the things i found. ^AQU CLEADC5 .DDLXCXA 010035 ABDEP FI C54253/AN N13161/DA KDEN/DS KSGF/OT 0035/FB 60/BF DT DDL DEN 010035 M93A AC as i kept looking at more and more config files in more and more of the projects, it dawned on me just how heavily i had already owned them within just half an hour or so. hardcoded credentials there would allow me access to navblue apis for refueling, cancelling and updating flights, swapping out crew members and so on (assuming i was willing to ever interact with a SOAP api in my life which i sure as hell am not). i however kept looking back at the two projects named noflycomparison and noflycomparisonv2, which seemingly take the TSA nofly list and check if any of commuteair's crew members have ended up there. there are hardcoded credentials and s3 bucket names, however i just cant find the actual list itself anywhere. probably partially because it seemingly always gets deleted immediately after processing it, most likely specifically because of nosy kittens like me. amazon.dynamodb.endpoint-dynamodb.us-east-1.amazonaws.com amazon.s3.endpoint-https://s3.us-east-1.amazonaws.com amazon.dynamodb.region=com.amazonaws.regions. Regions. US_EAST 1 #UAT SERVER #amazon.aws.accesskey=AKIA #amazon.aws.secretkey= #PROD SERVER amazon.aws.accesskey=AKIA amazonaws.secretkey= bucketName=uat-fltplan-outbound-pdf-store #UAT downloadFilePath=C: /C5_SERVICES_TEMP/ComplyService/ flight DetailsTable=C5_FlightDetails #PROD :8080/job/ComplyService/ws/ComplyServices/ #complyUploadUrl=https://commutair-test-api.comply365.net/api/SYS/v1/Files/UploadFile?uid= #categoryUid== complyUploadUrl=https://commutair-api.comply365.net/api/SYS/v1/Files/UploadFile?uid= categoryUid- toMailList-C

Pin

Maia Arson Crimew "how to completely own an airline in 3 easy steps and grab the TSA nofly list along the way"

fast forward a few hours and im now talking to Mikael Thalen, a staff writer at dailydot. i give him a quick rundown of what i have found so far and how in the meantime, just half an hour before we started talking, i have ended up finding AWS credentials. i now seemingly have access to pretty much their entire aws infrastructure via aws-cli. numerous s3 buckets, dozens of dynamodb tables, as well as various servers and much more. commute really loves aws. ~/bounty/commutair $aws s3 1s 2022-12-15 02:11:14 2022-12-15 02:16:46 2018-07-12 19:46:01 aws-logs-353966347147-us-east-1 2022-12-14 23:36:03 aws logsalb 969 43e 7 2020-12-07 18:52:16 2019-10-22 07:56:51 ca-dynamodb-bkp 2017-09-29 17:37:34 ca-ip-dev-s3 2017-11-27 06:44:57 ca-ip-prod-s3 2017-12-01 09:10:35 2022-10-29 17:13:14 2017-06-30 20:42:09 elasticbeanstalk-us-east-1-35396634714 17:34:17 aws-cloudtrail-logs-353966347147-2b88e aws-cloudtrail-logs-353966347147-75a13 c5-integration-builds 2020-10-23 21:57:45 flightrelease 2020-10-28 20:42:16 fligtrelease-backup 2021-06-09 09:06:40 prod-amos-archive-bucket 2021-09-14 17:19:55 prod-blankgendec-pdf 2021-06-09 09:06:4, 2021-06-09 09:06:4 2021-09-14 17:20:2 2021-09-17 07:32:2 2022-09-13 18:24:3 2022-06-27 20:15:5 2022-09-13 18:24:3 2022-10-17 06:10:2 2022-09-13 18:24:3 2022-11-11 20:54:2 2022-07-27 03:48:1 2021-06-09 09:06:4 2021-06-09 09:06:4 2021-09-23 21:25:4 ore 2021-06-09 09:06:40 prod-company-document-bucket 2021-06-09 09:06:40 prod-crew-archive-bucket 2022-01-14 06:54:44 cf-templates-111lipqerp78m-us-east-1 cf-templates-111lipqerp78m-us-east-2 2021-06-09 09:06:4 2021-05-31 13:52:4 2021-09-14 17:27:30 2022-11-10 16:27:00 prod-ecs-container-logs 2021-06-09 09:06:40 prod-flifo-archive-bucket 2021-09-14 16:40:07 prod-fltplan-outbound-eff-store 2021-09-14 16:40:07 prod-fltplan-outbound-pdf-store 2022-05-23 19:02:18 prod-formurl 2021-06-09 09:06:4 prod-daily-fa-reads-pdf-store prod-daily-pilot-reads-pdf-store ~/bounty/commutair17:12:46 $aws dynamodb list-tables "TableNames": [ "AlertHistoryTest", "AlertHistoryTest1", "AlertTest", "C5GlobalTest", "C5_Activities", "C5_AirportCode_TimeZone", "C5_CASS_KCM_Requests", "C5_CREW_00S", "C5_Calendar_V1", "C5_Crew_Vacation", "C5_FlightPlanStore", "C5_FlightScheduleDiff", "C5_Flights", "C5 51+PlanRecord"

Pin

0

Maia Arson Crimew's "No-Fly List" Leak - Maia Arson Crimew's "No Fly List" Leak Meme

PROTIP: Press the ← and → keys to navigate the gallery, 'g' to view the gallery, or 'r' to view a random image.

The TSA no fly list got leaked in the funniest possible way h-------- MR. BISHOP dandy @daxdives CAN CNN Republican lawmaker indicates Congress will investigate TSA no-fly list TSA Pre 个 ENTRANCE o Zoomly Fox Business TSA 'no fly' list leake being found on unse airline server note: this is a slightly more technical and comedic write up of the story covered by my friends over at dailydot, which you can read here step 1: boredom like so many other of my hacks this story starts with me being bored and browsing shodan (or well, technically zoomeye, chinese shodan), looking for exposed jenkins servers that may contain some interesting goods. at this point i've probably clicked through about 20 boring exposed servers with very little of any interest, when i suddenly start seeing some familar words. "ACARS", lots of mentions of "crew" and so on. lots of words i've heard before, most likely while binge watching Mentour Pilot YouTube videos, jackpot, an exposed jenkins server belonging to CommuteAir. 2030 rss feed birded site fedded verse sounded cloud last dot federated states of micronesia | gitted hub Igitted tea HOSTAS M 88 X 31 a ost zo SAM estmeline A.C.A.B. Carchinu 1:53 AM Jan 22, 2023 2.2M Views SARE WOVE This site is part of the lavender software webring! SAIME T

View Gallery Random Image

+ Add a Comment

Comments (0)

There are no comments currently available.

Display Comments

Image Details

1,861 views (15 from today)

Uploaded Jan 23, 2023 at 10:21AM EST

Origin Entry

Maia Arson Crimew's "No-Fly List" Leak

Source

Tags

Claim Authorship Edit History

About the Uploader

Owen

Federal Agent

Textile Embed

!https://i.kym-cdn.com/photos/images/newsfeed/002/518/618/280.png!

Today's Top Image Galleries

Spooky Pokemon trainer

Hex Maniac

JD Vance Babyface Edits meme examples.

J.D. Vance Babyface Edits

JD Vance Have You Said Thank You Once meme example.

"Have You Said Thank You Once?"

Woll Smoth