Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
seat31B.com DEVELOPED_BY TProphet
TProphet writes and maintains the travel blog seat31B.com.
Explicit Confidence 99% · Jack Rhysider EP 84 Details
“He’s a regular contributor to the 2600 Magazine, The Hacker Quarterly. But he also likes writing a travel blog called [00:35:00] seat31B.com.”
mango.pdf.zone DEVELOPED_BY Alex
Alex has and maintains the blog mango.pdf.zone, where they document things they have hacked.
Explicit Confidence 99% · Jack Rhysider EP 84 Details
“Alex has a blog. It’s called mango.pdf.zone where they document different things they’ve hacked.”
passport number exposure INITIAL_ACCESS_VIA boarding pass
The exposure began when Tony Abbott publicly posted a photograph of his boarding pass, which supplied information used to access the booking.
Explicit Direction flagged Confidence 99% · Jack Rhysider EP 84 Details
“By posting your boarding pass, someone can use that information to log into the airline’s website”
passport number exposure INVOLVES HTML
The exposed passport and phone information was present in the HTML source of the booking page.
Explicit Confidence 98% · Jack Rhysider EP 84 Details
“someone can use that information to log into the airline’s website and click View Source and see your birth date, passport number”
passport number exposure INVOLVES Special Service Request
The incident involved airline Special Service Request data containing a phone number associated with the passenger.
Explicit Confidence 98% · Jack Rhysider EP 84 Details
“It turned out that Alex had found a section of the code called SSR for Special Service Request.”
passport number exposure INVOLVES Alex
Alex investigated the boarding pass, accessed the booking page, found the exposed information, and reported it.
Explicit Confidence 99% · Jack Rhysider EP 84 Details
“Alex took on the challenge of hacking the former PM Tony Abbott’s boarding pass”
passport number exposure INVOLVES Tony Abbott
The incident concerned Tony Abbott’s boarding pass and exposed personal information associated with him.
Explicit Confidence 99% · Alex EP 84 Details
“I think I have the former prime minister’s passport number.”
passport number exposure INVOLVES Qantas
The incident involved access to Tony Abbott’s Qantas Manage Booking page and exposure of information in that page.
Explicit Confidence 99% · Jack Rhysider EP 84 Details
“Alex was now logged into Qantas Airline’s [00:10:00] website as the former Australian Prime Minister Tony Abbott”
passport number exposure INVOLVES JSON
The page source contained a large section of JSON data that included the exposed booking information.
Explicit Confidence 98% · Alex EP 84 Details
“there was this big section of JSON, this big section of data just in the page”
passport number exposure INVOLVES Australian Signals Directorate
The incident was reported to the Australian Signals Directorate, which requested more information and said it would take over handling the matter.
Explicit Confidence 99% · Alex EP 84 Details
“Here’s this e-mail address where you can report this to ASD.”
passport number exposure INVOLVES CTCM
The incident involved a CTCM note in the airline data that contained the passenger’s phone number.
Explicit Confidence 98% · Jack Rhysider EP 84 Details
“one of the notes started with the code CTCM”
Jack Rhysider MENTIONS United Airlines bug bounty program
Jack mentions United Airlines’ bug bounty program as a legal way to find vulnerabilities in exchange for rewards points.
Explicit Confidence 99% · Jack Rhysider EP 84 Details
“United Airlines has a bug bounty program where they pay rewards for anyone who can find vulnerabilities in their systems.”
Jack Rhysider REFERENCES The Hitchhiker’s Guide to the Galaxy
Jack references a quote from The Hitchhiker’s Guide to the Galaxy about buttons.
Explicit Confidence 99% · Jack Rhysider EP 84 Details
“which always reminds me of this quote from The Hitchhiker’s Guide to the Galaxy”
Alex used Google to research what information on the boarding pass was sensitive and how it could be used.
Explicit Confidence 96% · Jack Rhysider EP 84 Details
“After some Googling, Alex found out that their first target should be the bar code”
Alex used Photoshop to adjust the boarding-pass image in an attempt to scan its barcode.
Explicit Confidence 99% · Alex EP 84 Details
“I went into Photoshop and tried to turn up the contrast”
Alex USES responsible disclosure
Alex says the activity was done for research and responsible disclosure, including notifying ASD and Qantas.
Explicit Confidence 99% · Jack Rhysider EP 84 Details
“This was done for research and to do responsible disclosure”
Alex USES View Source
Alex used the browser’s Inspect/View Source function to examine the airline page’s HTML.
Explicit Confidence 99% · Alex EP 84 Details
“I used the only hacker tool I know which is to right click on a page and then click Inspect or Inspect Element.”
Alex USES Google Chrome
Alex used Google Chrome to begin researching the boarding pass.
Explicit Confidence 99% · Alex EP 84 Details
“I opened up Google Chrome and just started typing in the bar at the top”
TProphet uses the Qantas website to find Cathay Pacific award-flight availability, while booking with Alaska points.
Explicit Confidence 97% · TProphet EP 84 Details
“the one that I use the most for finding Cathay flights is Qantas”
Kilobit DISCOVERED_BY Secret Service
The Secret Service had been submitting reports about the Kilobit alias while trying to identify who was behind it.
Explicit Confidence 98% · Jack Rhysider EP 85 Details
“The Secret Service in Las Vegas had been submitting reports about the alias, trying to figure out who was behind the name.”
Carder.su bust INVOLVES Carder.su
The Carder.su bust involved the seizure and examination of a server snapshot containing the site’s user database.
Explicit Confidence 98% · Jack Rhysider EP 85 Details
“The feds were able to go through the user database”
Cameron Harrison MEMBER_OF Kilobit
The episode presents Cameron as the operator behind the Kilobit identity and as a participant in the associated carding operation.
Derived Confidence 86% · Cameron Harrison EP 85 Details
“They know exactly who I was.”
“Cam had named his computer Kilobit and this was the same name he used on the Carder.su forums.”
Counterfeit Library RELATED_TO ShadowCrew
Cam described Counterfeit Library as a precursor to ShadowCrew.
Explicit Confidence 98% · Cameron Harrison EP 85 Details
“Counterfeit Library was like a precursor to ShadowCrew”
Counterfeit Library RELATED_TO CarderPlanet
Cam described Counterfeit Library as a precursor to CarderPlanet.
Explicit Confidence 98% · Cameron Harrison EP 85 Details
“Counterfeit Library was like a precursor to ShadowCrew or CarderPlanet”
Cameron Harrison SAME_AS Kilobit
Cameron Harrison used Kilobit as his online alias and named his computer Kilobit; the episode presents the alias as belonging to him.
Explicit Confidence 98% · Jack Rhysider EP 85 Details
“Cam had been careful on Carder.su. He registered as the user Kilobit”
“Cam had named his computer Kilobit and this was the same name he used on the Carder.su forums.”