Frontier Airlines Likely Breached

999900000999

Various users are reporting scam emails with full booking details. Stay safe guys.

CSSer

It seems early to speculate, but if this is related to the massive uptick in CVEs we've been seeing recently it feels like we're actively witnessing a corporate reckoning around security posture the likes of which has never occurred.

danieltk76

thankfully I already had frontier airlines marked as spam email, so this changes nothing for me.

phren0logy

Every interaction I've ever had with Frontier Airlines has been negative.

CreepyHunterX

If someone got that email - check the email headers and the 'Authentication-Results' field to verify SPF/DKIM/DMARC alignment. If a domain has a DMARC policy of 'p=none', a forged "From" field will not be rejected-it will land in the inbox and look completely genuine.

jukkan

Earlier this year, Frontier was one of the orgs that got their data leaked thanks to incorrectly configured security settings on their Microsoft Power Pages based website. While this is unlikely to be the source for current flight confirmation numbers, such data could sure help in phishing operations. https://venarix.com/blog/exfilsquad-targets-misconfigured-mi...

varenc

My guess is something related to looking up Frontier flight status was abused to enumerate all active flight itineraries. If Frontier had been completely breached and all data compromised, there's likely more lucrative things the attacker can do than just using the data to enhance their credit card stealing phishing attack.

dawnerd

Norwegian cruise line had a similar thing recently with emails going out with actual booking information. Basically identical to the frontier scam emails. I wonder if there’s some customer service software that’s being exploited that they both use. Edit: some info from the NcL one with screenshots that look similar https://www.reddit.com/r/NCL/comments/1x2q54e/warning_possib...

tosti

For anyone else who has never heard of it: Frontier Airlines is a budget airline company based in Colorado USA.

RetroTechie

Only 2 breaches/critical remote CVEs on HN frontpage today? Must be a slow news day lol!

touwer

Can't see it. Reddit has become really open web hostile on mobile. Sad