A US No Fly list (a list of people who are barred from boarding aircraft within US airspace) has been publicly shared on a hacking forum. To protect its citizens, the United States government uses a terrorist screening database, which is managed by the FBI’s Terrorist Tracking Center. This database, also referred to as the No Fly list, contains identifying information on known or suspected terrorists and includes the no fly list – an important subset for national defense.
See also: Mimic ransomware: Uses Windows search tool Everything
BleepingComputer confirmed that the list is the same TSA No Fly list that was recently discovered on a compromised CommuteAir server.
This month, Maia Arson Crimew (formerly Tillie Kottmann), a Swiss hacker, found an AWS server containing the TSA No Fly list, which had been left incorrectly configured – an incident first noticed and reported by Daily Dot reporter Mikael Thalen.
See also: Google Play: Malicious reward apps have 20 million downloads
On January 26, the No Fly list of Ohio-based airline CommuteAir was discovered on a publicly available hacking forum, despite previous attempts to patch the server security breach.
Bleepingcomputer consulted with both Thalen and a separate source, verifying that the lists posted on the forum match the no-fly lists and select lists recently found on CommuteAir's server.
After examining the two CSV files, named “NOFLY” and “SELECTEE,” BleepingComputer discovered that the latter list likely contains some of the passengers who go through Secondary Security Screening Selection (SSSS) upon entering US airports.
See also: Researchers uncover a VMware vRealize Log RCE exploit
The no-fly spreadsheet posted on the forum contains 1,566,062 entries and includes duplicates/spelling variations of some names. The 'SELECTEE' list contains 251,169 entries. The presence of duplicates and aliases on the list suggests that the total number of names exposed is less than 1.5 million.
According to the hacker, these lists from 2019 contain a person's first name, last name, possible aliases, and date of birth.
According to the Daily Dot, the list of individuals includes notorious Russian arms dealer Viktor Bout and an additional 16 aliases that may be related to him.
The Terrorist Control Database, also known as the “No Fly list,” is a watchlist maintained by the FBI’s Terrorist Control Center (TSC) to facilitate unified information sharing among federal agencies for counterterrorism efforts.
Because of their critical role in maintaining national security and enforcing laws, these databases are closely guarded – even if they are not classified. Anyone suspected of terrorism or a danger to the nation is recommended by the government for inclusion on this secret watch list.
The No Fly list is usually confidential, but private airlines and many government agencies, such as the Department of State, the Department of Defense, the Transportation Security Administration (TSA), and Customs and Border Protection (CBP), use it to confirm whether a passenger can fly or not, as well as to judge the potential risk they face in terms of other activities.
Bob Diachenko and other researchers have made a name for themselves by exposing leaked terrorist watch lists online, which were fortunately taken down before they gained widespread attention. However, this is the first time such information has been shared openly on an accessible website – available for all to see.
Interestingly, Diachenko’s list published in 2021 was much more comprehensive than the one published this month on the forum. It included personal information such as names, gender, passport number along with country of issue, TSC ID, and watchlist ID.
Although the security breach originated from an exposed AWS server belonging to an airline, the US is investigating the matter.
Information source: bleepingcomputer.com
