Ian Carroll (software developer)

Ian Carroll
Born	(2000-03-16) March 16, 2000 (age 25)
Nationality	United States
Occupation(s)	Ethical hacker, security researcher, entrepreneur
Website	ian.sh

Ian Carroll (born March 16, 2000) is an American ethical hacker, bug bounty hunter, and security researcher. He is the founder of the award-flight search engine Seats.aero and is known for uncovering critical cybersecurity vulnerabilities in the aviation, automotive, and hospitality industries. ^{[1] [2] [3]}

Biography

Carroll began reporting security flaws as a teenager and later held engineering roles at Dropbox and Robinhood, where he led portions of the companies’ vulnerability disclosure and bug bounty initiatives. ^[4]

Seats.aero (2022–present)

Carroll launched Seats.aero in June 2022 as a tool for finding real-time award-flight availability across dozens of loyalty programs. Within a year the site surpassed one million monthly page views and was hailed by AwardWallet as “one of the best new points-and-miles utilities.” ^[5] In October 2023, Air Canada sued Carroll and Seats.aero under the Computer Fraud and Abuse Act over automated scraping of award-fare data; a U.S. judge denied the airline's request for a preliminary injunction in March 2024, allowing the site to continue operating while litigation proceeds. ^[6]

Notable security research

• Points.com loyalty platform (2023). Carroll, with Sam Curry and others, identified API flaws that could let attackers commandeer airline and hotel loyalty accounts or mint unlimited miles before the vendor deployed fixes. ^[1]
• Automotive APIs (2022). As part of a research group, Carroll helped reveal remote control and tracking vulnerabilities affecting more than a dozen car brands, including BMW, Ford, and Porsche. ^[7]
• “Unsaflok” hotel locks (2024). Together with Belgian researcher Lennert Wouters, Carroll disclosed weaknesses in Dormakaba Saflok RFID door locks—installed on over three million hotel doors—allowing near-instant unauthorized entry. ^[2] Full technical details were presented at DEF CON 32. ^[8]
• TSA Known Crewmember/CASS SQL injection (2024). Carroll documented an injection flaw in the FlyCASS portal that could grant unauthorized “crew” status, potentially bypassing airport security. ^[9]
• McDonald's hiring bot breach (2025). Carroll and Sam Curry found that Paradox.ai's McHire platform was protected by the username “admin” and password “123456,” exposing tens of millions of applicant records. ^[3]

Talks

• DEF CON 32 (Las Vegas, 2024) – “Unsaflok: Hacking millions of hotel locks” (with Lennert Wouters). ^[8]

Publications

• “Bypassing airport security via SQL injection,” *ian.sh*, 2024. ^[9]
• Lily Newman, "Hackers Could Have Scored Unlimited Airline Miles by Targeting One Platform," *Wired*, 2023. ^[1]
• Andy Greenberg, “Hackers Found a Way to Open Any of 3 Million Hotel Keycard Locks in Seconds,” *Wired*, 2024. ^[2]
• Andy Greenberg, “McDonald’s AI Hiring Bot Exposed Millions of Applicants’ Data to Hackers Who Tried the Password ‘123456’,” *Wired*, 2025. ^[3]

References

1. Newman, Lily (3 August 2023). "Hackers Could Have Scored Unlimited Airline Miles by Targeting One Platform". Wired. Condé Nast. Retrieved 14 July 2025.
2. Greenberg, Andy (21 March 2024). "Hackers Found a Way to Open Any of 3 Million Hotel Keycard Locks in Seconds". Wired. Condé Nast. Retrieved 14 July 2025.
3. Greenberg, Andy (9 July 2025). "McDonald's AI Hiring Bot Exposed Millions of Applicants' Data to Hackers Who Tried the Password '123456'". Wired. Condé Nast. Retrieved 14 July 2025.
4. "Ian Carroll – Profile". LinkedIn. LinkedIn. Retrieved 14 July 2025. ^{[self-published]}
5. "Seats.aero Review – The New Award Search Tool You Need". AwardWallet. AwardWallet. 4 September 2023. Retrieved 14 July 2025.
6. "Air Canada Sues Award-Search Start-Up Over Data Scraping". Bloomberg Law. Bloomberg L.P. 27 October 2023. Retrieved 14 July 2025.
7. "Research Team Finds Flaws in 16 Auto Manufacturers' APIs". The Hacker News. THN. 2 December 2022. Retrieved 14 July 2025.
8. "DEF CON 32 – Unsaflok: Hacking Millions of Hotel Locks". DEF CON. DEF CON Communications. Retrieved 14 July 2025.
9. Carroll, Ian (29 August 2024). "Bypassing airport security via SQL injection". ian.sh. Retrieved 14 July 2025.