It seems early to speculate, but if this is related to the massive uptick in CVEs we've been seeing recently it feels like we're actively witnessing a corporate reckoning around security posture the likes of which has never occurred.
> it feels like we're actively witnessing a corporate reckoning around security posture the likes of which has never occurred.
As a cyber person, I agree. The theater has met reality, and those who put in the work will have an easier time than those who just checked a box. Good luck to all actively responding.
Safety alignment feels like an absolute farce and the completely wrong approach too. These things are guns, or attack dogs. We've never succeeded at reigning in software with this approach in the past, besides maybe DRM, which is itself laughable under many circumstances. This has the unprecedented ability to entertain the base desires of most juvenile threat actors, which is to get a big payout with minimal effort (let alone the pre-existing sophisticated attackers, who are now basically gods). Now we have a turn-key tool that can leverage and chain the most minute vulnerabilities up the ladder to full compromise or discover zero days with unyielding dedication. It feels like it almost makes CVE level classification moot.
I'm not sure there will be corporate reckoning. Unless security breaches come with business impacting consequences, they will continue to ignore it and just pay out occasional class action lawsuit.
I’ve been increasingly going with Delta regardless of price because of their tech being at least somewhat usable. I might even be inclined to switch to another carrier if they were to make entirely api-based (personal) access available for flight management and searching/booking (probably via MCP given the current climate, but I’ll take what I can get).
The "All modern digital infrastructure" xkcd (https://xkcd.com/2347/) where they had a fragile tower of blocks needs an update where those blocks are now collapsed on the floor in a complete mess.
Engineers aren't a help if they have poor inuition and insight into security concerns themselves, which is true for almost all of them.
Filling departments with inexperienced people based on how well they can recall a classic algorithm on a whiteboard was never the set up for a secure software or IT ecosystem. Peers watching in shock and dismay as supply chain risk escalated year over year for the last decade, among other horrifying practices, have been crying over this all along.
They might be able to follow an AI lead better than someone even less technical, but it's unclear that doing without true expertise as an oversight and check would cut it.
Having walked ourselves into it long before AI appeared, We're set up for a dark time with few easy outs.
I have a more nuanced take on this, which is that many engineers may have decent intuition on security - but that's entirely besides the point here, because without the political capital to have a large organization (and their customers and counterparties!) change their workflows and security stances, they're tilting at windmills. Security is not one of those things that one can throw bodies at - it requires true attention and commitment from leadership, and time to percolate across every facet of a company. If such a mandate is in place, talent is far from the limiting factor.
As someone who has been working at a software supply chain security startup for the last 5 years of my life, watching it hemorrhage customers and watching our team get whittled down to essentially just me as our budget gets cut, while the rest of the company's token spend balloons past whatever we were paying the people we cut from my team... I think I'm done. I'm increasingly thinking I have to leave the computer industry in general or I'm going to off myself.
I did AppSec for a couple of years just for a change of pace. The friend who worked there said they wanted to strengthen their infosec program in general, which is why they wanted to hire an SWE for AppSec instead of using cyber boot camp grads like they had been. Turned out 90% of infosec is about creating all of the necessary paperwork to protect to company from liability if there's a breach. Actual security issues were ignored most of the time if there wasn't a compliance framework that addressed the vuln directly. We could have tripled the number of people in the department and it wouldn't have made any difference in terms of actual security. Maybe the compliance paperwork would have been submitted a bit sooner.
Someone found a vulnerability in the system of Hong Kong Airlines that let the user to see the details of another passenger by changing a few characters in the URL. He reported the issue to the airlines. Then he was prosecuted and found guilty for hacking.
Tells you a lot about the attitude of many cooperations about these vulnerabilities.
But such a thing should not be prosecutable in the first place. Opening an unlocked door isn't breaking and entering. If you walk inside and steal something, that's a different thing. But if you just close the door and alert the owner that their door is unlocked, what sane person would consider that a crime?
I noticed I could see a family member's blood test results when clicking their forwarded email when I was logged into _my_ account. Sent an email. No response, but IIRC they fixed it a few weeks later.
Just an anecdote to counterbalance the apathy the OP might instill in people. Do good, regardless of the system.
I can't edit, so as a general response: ya'll are a cynical lot, akin to parents who won't let their child walk to school because of the 0.0001% chance they'll be kidnapped. Y'all making the whole world all the worse for your cynicism. Sure, there's a remote chance you get in trouble for it. But there's also a chance you get hit by a car tomorrow morning. Yet you got out bed anyway.
Be the fucking change. At the very least, don't discourage others. Good grief.
I think that's a very privileged take. For most people, getting arrested and having the government try to press fraud and abuse charges is a life altering event, so it's natural that people would be more reticent.
If you think these two cases out of umpteen billion CVE/security incident reports are odds enough to hide your face and turn away because the risk is too much... I apologize for being crass, but frankly you're being a little bitch.
If these odds aren't good enough for you to live up to your values, what are?
you didn't have the guts to write me a response or to really acknowledge what the guy you're responding to here said. the things you say could be genuinely true , I'm not gonna absorb any of it since you're out here calling me a bitch while behaving like one yourself. was your goal to wave the finger or to inspire change in others? coz only one of those things happened today. by this point if you're an average human you'll have switched your brain off - on the off chance you're different, it's time to listen to the pot by tool
Ah yes the government was putting teacher SSNs on the html client-side. Someone inspected element and found them and reported it. The governor went on a personal vendetta and tried to get him charged with CFAA violations which are no joke.
Made me realize we need way more coders in congress that understand basic technology. Especially with AI becoming a big part of society.
This is not the answer to this problem. Instead vulnerability researchers should share their findings with potential victims so they can sue rather than reporting to Republican state governments that will simply sue them.
What can the potential victims sue for specifically? Like what is the legal theory there? Which law has the state government broken and how would the plaintiffs get around sovereign immunity? Please to provide citations for the relevant statutes and case law.
I don't think understanding is the issue. It doesn't take a lot of tech knowledge to understand "the SSNs were all being sent, they were just hidden poorly."
What we need is fewer vindictive, fragile people in positions of power. Unfortunately this is an unsolved problem.
The problem with the people in power is that they were the ones seeking to be in power. If, instead, the mechanism was by lottery, thrusting the reigns of power upon any random citizen, the system wouldn't select for people who were also vindictive and fragile as a consequence of being egotistical enough to seek power.
It’s easy to criticise large legacy orgs having bad security, but what should you actually do as a C suite leader to fix it in these orgs?
It’s easy to list the various code scanning and monitoring solutions, but what do you do if teams continue to fail to fix issues on time? And realistically there’s a shadow IT of shell scripts and macros you don’t have much visibility on.
You can’t fire everyone, so I think it’d be better to link compensation of engineers (especially leads/managers) to scan reports, incidents, and audits, even if these are imperfect. But even then you’ll have business complaints about taking away engineering capacity from feature delivery.
The obvious first step is to outsource all IT infrastructure to one of the large service providers. While it's possible that they'll be breached, at least they have the resources and expertise to stand a fighting chance against the new wave of advanced persistent threats. Smaller companies outside the tech sector will never be able to keep up and secure their own systems.
The corporate reckoning will only come if there's actual consequences for any of this. There haven't been any when this was happening to one big company a month, there won't be any when it starts happening to five big companies a day.
The stories about their lack of customer service empowerment following the man who was ingested by an engine while running across the runway validate this. It was truly maddening to read about how the company handled getting people’s luggage back to them.
Earlier this year, Frontier was one of the orgs that got their data leaked thanks to incorrectly configured security settings on their Microsoft Power Pages based website. While this is unlikely to be the source for current flight confirmation numbers, such data could sure help in phishing operations.
My guess is something related to looking up Frontier flight status was abused to enumerate all active flight itineraries.
If Frontier had been completely breached and all data compromised, there's likely more lucrative things the attacker can do than just using the data to enhance their credit card stealing phishing attack.
Norwegian cruise line had a similar thing recently with emails going out with actual booking information. Basically identical to the frontier scam emails. I wonder if there’s some customer service software that’s being exploited that they both use.
There was a post the other day that Amadeus (one of the major backend GDS systems) had been persistently exposing passenger information via a vulnerable endpoint since 2023
Came here to point that out. Several airlines, mostly from Asia, have sent notice of data breaches related to Amadeus software. Frontier appears to contract with Amadeus.
57 comments
[ 3.7 ms ] story [ 19.5 ms ] threadStay safe guys.
https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
> it feels like we're actively witnessing a corporate reckoning around security posture the likes of which has never occurred.
As a cyber person, I agree. The theater has met reality, and those who put in the work will have an easier time than those who just checked a box. Good luck to all actively responding.
https://en.wikipedia.org/wiki/Jaguar_Land_Rover_cyberattack
Of course they then blame "state sponsored" attackers.
https://www.techdigest.tv/2026/10/former-minister-confirms-j...
Filling departments with inexperienced people based on how well they can recall a classic algorithm on a whiteboard was never the set up for a secure software or IT ecosystem. Peers watching in shock and dismay as supply chain risk escalated year over year for the last decade, among other horrifying practices, have been crying over this all along.
They might be able to follow an AI lead better than someone even less technical, but it's unclear that doing without true expertise as an oversight and check would cut it.
Having walked ourselves into it long before AI appeared, We're set up for a dark time with few easy outs.
Keeping them, and having them around, to be responsible for cleaning up their mess, is the trick.
Modern (US) tech companies are spectacularly bad at keeping talent.
Really, really bad.
Tells you a lot about the attitude of many cooperations about these vulnerabilities.
Bring it up with China. Hong Kong is in no serious way sovereign.
Just an anecdote to counterbalance the apathy the OP might instill in people. Do good, regardless of the system.
Be the fucking change. At the very least, don't discourage others. Good grief.
I agree: having charges brought against you is a life-changing event. FWIW neither Chan Tsz-yan nor Josh Renaud were arrested, and in both cases the charges were dropped. https://pressfreedomtracker.us/all-incidents/missouri-govern... https://missouriindependent.com/2022/02/11/prosecutor-isnt-p...
The system sucks, and will always suck.
If you think these two cases out of umpteen billion CVE/security incident reports are odds enough to hide your face and turn away because the risk is too much... I apologize for being crass, but frankly you're being a little bitch.
If these odds aren't good enough for you to live up to your values, what are?
[1] https://www.npr.org/2021/10/14/1046124278/missouri-newspaper...
Made me realize we need way more coders in congress that understand basic technology. Especially with AI becoming a big part of society.
What we need is fewer vindictive, fragile people in positions of power. Unfortunately this is an unsolved problem.
It’s easy to list the various code scanning and monitoring solutions, but what do you do if teams continue to fail to fix issues on time? And realistically there’s a shadow IT of shell scripts and macros you don’t have much visibility on.
You can’t fire everyone, so I think it’d be better to link compensation of engineers (especially leads/managers) to scan reports, incidents, and audits, even if these are imperfect. But even then you’ll have business complaints about taking away engineering capacity from feature delivery.
"oh yeah that's wrong, sorry it looks like our website is broken but there's nothing I can do"
https://venarix.com/blog/exfilsquad-targets-misconfigured-mi...
If Frontier had been completely breached and all data compromised, there's likely more lucrative things the attacker can do than just using the data to enhance their credit card stealing phishing attack.
So that or similar other hacks
https://amadeus.com/en/newsroom/press-releases/frontier-airl...
[1] https://www.flyfrontier.com/deals/gowild-pass/?mobile=true
So yea, dead site.