Slashdot Mirror
Experts Warn About Security Flaws In Airline Boarding Passes
concealment writes in with a story about a newly found security issue with the bar codes on boarding passes. "Flight enthusiasts, however, recently discovered that the bar codes printed on all boarding passes — which travelers can obtain up to 24 hours before arriving at the airport — contain information on which security screening a passenger is set to receive.
Details about the vulnerability spread after John Butler, an aviation blogger, drew attention to it in a post late last week. Butler said he had discovered that information stored within the bar codes of boarding passes is unencrypted, and so can be read in advance by technically minded travelers.
Simply by using a smartphone or similar device to check the bar code, travelers could determine whether they would pass through full security screening, or the expedited process."
Has anyone seen a case where a passenger is waved through security? Each time I go through, everyone in line for screening goes through the same process (then again, I am completely average and might not have seen advanced/reduced security for anyone except pilots).
How possible would it be to do very subtle Photoshop (or the GIMP) changes to ensure someone goes through the expedited process? Heck, terrorism aside, I'D do it just to avoid the cancer machines.
Yup, sounds like proof that certain people will get discriminated against if their info keeps coming up 'heavy screening'
http://puckinflight.wordpress.com/2012/10/19/security-flaws-in-the-tsa-pre-check-system-and-the-boarding-pass-check-system/
This will be buried.... people will forget... and the TSA security theater will continue or even get stepped up to counter this little mishap.
What flaw are we talking about?
Obviously it is a feature for "technically minded travelers". Ist'n it?
--whacky
Indeed. It's pretty hard to say "random search" if the guy's badge code has a special section selecting him for "extra screening"
This sounds more like a special code that exempts people from a full search, but I wonder what other codes there might be.
Which one will John Butler will be receiving...
Wonder how long till John Butler gets arrested for sharing this info. National security and all that.
Be seeing you...
This is not a security flaw but rather makes for some interesting question re the "random selection" process. But this will probably be yet another "nothing to see here, move along" type revelation.
When the copyright term is "forever minus a day", live every day like it's the last.
TSA = Thespians of Security Appearances
I think Smart Phones are too dangerous to be allowed on a plane unless they are kept in a clear 3'' plastic bag, may be that is also bad idea. may be only if there is also water in that plastic bag. Pardon me, but I am not that bright. Hopefully, some one brighter than me at TSA will come with a better "solution".
Terrorist Scam Artists.
Had to be said.
I don't know about 'hidden codes' - a few years ago I took my family on an around the world trip, traveling west from Australia via Dubai and London. All our US boarding passes were stamped with big red 'SSS' letters, except for my wife, who has a British passport.
At every security gate my three kids and I got the full treatment of pat-downs and extra screening, even being pulled out of the normal line and taken aside in some cases.
The reason, I supposed, was because we came to the US from Dubai arriving on the east coast of the US, we clearly posed a 'high risk' in the view of US border protection. My wife, being on a British passport, posed no such risk, coming that way from London.
The ever alert US border security did prevent my 8yo son bringing a pair of paper scissors into the country.
Writing an Android app to display the unencrypted data would be trivial.
this only applies to the TSA who actually scan and pass people around the security scanning solution based on the results of what is in the barcode. in europe, you always have to go through scanning process, regardless of what your 2D barcode has encoded within in. all the TSA is doing here, is opening up a chance for terrorists based on local soil to get through the security scanning process simpler. the challenge is that the USA has the most number of travelers through the airline system than anywhere else in the world; doing extensive security checks does choke the system - so, they need to try and filter out the more frequent/trusted flyers, the net result is they are wasting time screening some since they done screen everyone.
Not only could you photoshop the barcode, but hell, you could photoshop the name, the destination, the flight number, pretty much anything you wanted... The brainless goons at the security checkpoint wouldn't know the difference. (They don't scan tickets or anything).
In my experience (working for a contractor for a major US airline), you could even use a photoshopped (printed at home) boarding pass to get on the plane. When they scan it at the gate and the computer beeps saying "no such thing", generally the non-english-speaking gate agent will just scan it a few more times, give up, and let the person on the plane. When the passenger count from the computer later doesn't match up to the number of people on the plane, they'll just "go with what's on the plane" in the interest of getting the plane out on time. This happens on a DAILY BASIS. "Security" is a joke.
Where did I see this before...
Ah that's right, this year's underhanded C contest.
BP data is not meant to be a security things. If they saved CAPS 2 data on it, well *shrug*. Anyway the rule at check in on how to set whether there will be a screening are known. If I recall correctely the code, if you paid with CC, are business traveler or better, have a return ticket, and a miles and more or similar card, given baggage, you have next to no chance beyond random chance, whether if you paid cash, one way, with carry on, belong to the monkey class (M - Eco) , no FT cards, you are bound to be checked 100% of the time. At least it used to be that way, now the rule might be a bit more elaborate but I doubt it changed. Also it used to be you had anyway a 10-20% chance of being selected anyway at the security point, independentely of what the BP said. IMHO it is a non story.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
TSA = Thugs Standing Around
The muzzies can find out if the white convert will be waived through security and give him the weapons if he is
including the inability to get non-stop flights for most routes, having to pay to park in a lot that is still a 10 minute ride to the terminal, having to arrive 2 hours early to ensure getting thru security on time to board, having small innocuous items in my pockets stolen by TSA, risking having large innocuous items in my bags stolen by TSA, getting severely overcharged for food at airport terminals, getting X-rayed by someone who is not my doctor or dentist, having to do mini-marathons thru airports to make connecting flights, getting my bags lost, etc. etc. have all combined to cause me to decide to drive everywhere I go. Eventually, the Alcan Highway is going to get photographed up the wazoo, by me, 'cuz I'll drive up and ferry back. But the X-rays were the last straw, that shall not stand. I quit. You can find me on I-10 to Tucson next year, I-74 from Indy to La Crosse, I-64 to St. Louis, etc. etc. Until the unconstitutional TSA activity is removed, I will not choose to fly anywhere I can drive, or boat, or travel by train.
This risky barcode is only impacting passengers who have enrolled in Pre-Check. Pre-Check is an optional program that people can pay to join and try to expedite security screening. When enrolling in the program, background checks are completed which give the security goons some level of comfort that you are not a subversive, anti-American terrorist who's going to try to carry a 4oz bottle of liquid on the plane (http://www.tsa.gov/tsa-pre%E2%9C%93%E2%84%A2).
For the rest of us (e.g. the majority), our barcodes are used strictly by the airlines to board the plane. We are subjected to the "rigorous", non-barcode, security review of visually checking the printed information on our boarding pass like name, date, flight number, and gate accompanied by a trip through the privacy rights inhibitor machine. So while the barcodes could be modified, as the blogger pointed out, it would only be a potential risk to people who have already had a deeper dive on their background and history.
IMHO, the bigger risk seems to be the HTML delivery of a boarding pass that is printed at home. With limited HTML knowledge (or a simple web search), someone could modify the data points that security is visually checking prior to printing the boarding pass. Buy a ticket with one name. Pass through security with another.
..."It's completely random, you're not being singled out..."
YAH, RIGHT!
I will stick to ground-based travel. Until they decide to put portable microwave ovens in front of the boarding gates for my CYCLE!
Operation Guillotine is in effect.
Airtravel sucks, it is uncomfortable as hell but it gets you fast to distant locations. There are real nuisances and perhaps even illegal activities that we should not want but throw them in a rant list like this and you sound like a fool and make anyone with genuine complaints sound like a fool as well.
Martin Luther King's speech would have been a lot less impressive if it had been 1 minute in a ten minute rant about how the weather man never gives nice weather anymore.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Isn't this an opt in system? I would have assumed you would need something other than the ticket, to indicate you are in the prescreening program.
Isn't this like stamping the ticket "first class" or "mvp flyer?"
Of course if you did away with the TSA and security screening, this wouldn't be a problem.
Being both island nations with no notion of land borders, the UK name makes some more sense...
What does it mean? "Go through the SS twice"?
Profiling is the absolute last thing you need when dealing with terrorists. Profiling leads to discrimination based on social, -racial, religious or other demographics, and it marginalises the group that the terrorists draw their support from.
If you marginalise them, you risk radicalising them. Popular support for ETA in the Basque country reached its highest when the Frankist regime suppressed the use of Basque language and the expression of Basque culture. Support for the IRA was at its highest when being Irish in London meant being constantly harrassed by the police.
This is one of the basic tenets of terrorist philosophy: if you can provoke the authorities into suppressing your demographic, you gain popular support. Profiling means the terrorists win.
Got them moderator blues I blieve I walk out the do', With these mod-points I been gettin', I 'most never post no mo'
All you have to do is have proper locks and PROPERLY CHECK A FIREARM.
as of that moment your luggage is considered a sealed container and can not be legally opened without you being present. ...)
(please note this does not have to be a working firearm and details may vary with each airline but
Any person using FTFY or editing my postings agrees to a US$50.00 charge
TSA = Terrorists Suppressing Americans
Time to offend someone
Good thing you didn't get marked BCS instead. If I see that one on my ticket, then I'll be really worried.
I was on that list for 10 years. Not fun. From my perspective security screenings got more lax after 9/11 because I was seemingly dropped from that list on my 9/14 flights. I never knew why I was on the list, just that I always got the 4 S's on my boarding pass. Anyway I don't see how this barcode is a problem, it is much better to know ahead of time that you will be delayed by unreasonable searches, then at least you can leave for the airport early. I don't think anyone with a brain thinks these airport "security" screenings have anything to do with security. They exist solely to make stupid kettles feel safe and give pedophiles a place to get their kicks.
"Using a web site I decoded my boarding pass for my upcoming trip"
Which website? Just a standard barcode decode?
A blog I run for the wealth
This only has to do the the PreCheck program. If you sign-up for pre-check you actually don't know when you will be allowed to use the expedited security line. You only find out after you get to the airport and scan your boarding pass before you even get in line for security. My colleagues that have it actually complain that they hardly ever get the go-ahead for expedited security. Even if the odds of getting the go-ahead were better, if there is still a chance you won't get the go-ahead, you can't take advantage of the time savings that the program allows. If I get to the airport 30 minutes before my flight and then get denied expedited security, I'm going to miss my flight. That means you have to get to the airport extra early no matter what. If I do get expedited security, I still end up just sitting in the terminal for the for the same amount of time I would have otherwise spent in line for security. Granted, I could get food/drinks, read, do some work, etc. in the terminal while I couldn't while in line for security.
Now if I could know in advance whether I get PreCheck or not, then I could take advantage of the time savings more effectively. Get an extra 30 min. of sleep, squeeze an extra meeting in at the end of the day, schedule an earlier flight so I get home and see my family sooner.
The danger here, though, is if someone can create a counterfeit bar-code. Then those who have not been through the up front screening required of the PreCheck program (and there is a lot of it. I won't do it just for the privacy concerns) can falsify PreCheck qualifications and better hide contraband.
But you know what, even as a very frequent air traveler, I find the whole PreCheck (at least right now) to be awfully inefficient. Hardly anyone has it and even fewer qualify the day of, so that is one extra x-ray machine with 2-3 extra TSA agents sitting idle, while the rest of the lines are backed up even further. The only way this becomes worthwhile for the airport is if there is enough PreCheck passengers to keep a constant flow of people through the PreCheck line. However, with the Orwellian sign-up process and the fact that you can't rely on whether you will get to use it (see points above), it is really hard to say if it will take-off. They tried doing this several years ago with Clear (run by a private company) but that was a bust (I think there were many additional factors there, though).
"It's not whether you win or lose, it's how drunk you get." -- H. J. Simpson