Slashdot Mirror
Experts Warn About Security Flaws In Airline Boarding Passes
concealment writes in with a story about a newly found security issue with the bar codes on boarding passes. "Flight enthusiasts, however, recently discovered that the bar codes printed on all boarding passes — which travelers can obtain up to 24 hours before arriving at the airport — contain information on which security screening a passenger is set to receive.
Details about the vulnerability spread after John Butler, an aviation blogger, drew attention to it in a post late last week. Butler said he had discovered that information stored within the bar codes of boarding passes is unencrypted, and so can be read in advance by technically minded travelers.
Simply by using a smartphone or similar device to check the bar code, travelers could determine whether they would pass through full security screening, or the expedited process."
Has anyone seen a case where a passenger is waved through security? Each time I go through, everyone in line for screening goes through the same process (then again, I am completely average and might not have seen advanced/reduced security for anyone except pilots).
How possible would it be to do very subtle Photoshop (or the GIMP) changes to ensure someone goes through the expedited process? Heck, terrorism aside, I'D do it just to avoid the cancer machines.
http://puckinflight.wordpress.com/2012/10/19/security-flaws-in-the-tsa-pre-check-system-and-the-boarding-pass-check-system/
Wonder how long till John Butler gets arrested for sharing this info. National security and all that.
Be seeing you...
Indeed. It's pretty hard to say "random search" if the guy's badge code has a special section selecting him for "extra screening"
It could be determined randomly before people are able to print their boarding passes.
In fact that would probably be the best way to ensure a random search, since a person at the gate might be influenced by your appearance.
Plus, if you have legitimate reason to believe someone is higher than average risk, you could just specify what's needed on the boarding pass, and not have to rely on the staff to spot you based on a picture.
Sheesh, evil *and* a jerk. -- Jade
'Tis a jobs program, and nothing more. Even the congressmen who are against the idea of the TSA are busy spinning it as providing jobs to their constituents.
Which is funny on so many levels. We all know that the TSA was built on a lie, we all know that it is worthless, we all know that it is bleeding the taxpayers dry, and we all know that we'd be better off without it. And yet, they're going to keep it, because jobs. Jobs which provide no net income, jobs which cost three times more than they are worth, jobs with glass ceilings built in, jobs which do not help America to grow anywhere but the waistline, and yet, they are so desperate to protect them. The money they are earning in kickbacks must be tremendous.
I am John Hurt.
When people have tried to walk away from the airport upon discovering, they were selected for the extra microwaving (or groping), they were told, they can no longer leave and must go through the screening. The reason was given, that doing otherwise would allow terrorists to attempt to travel, but back away if they find themselves selected for more rigorous checks.
Well, if the level of checking is printed right there on one's boarding pass, the terrorists don't have to reveal themselves. When they find out -- ahead of time -- that they were picked for extra attention, they can simply leave all the bombs at home, fly away and back, and then try again until they draw a "lucky" boarding pass.
In Soviet Washington the swamp drains you.
Actually - for many years when I was traveling in the US, if (and only if) my boarding pass had SSSS printed on it, I would be subjected to extra screening. The SSSS would be printed in large clear letters on the document. I don't know what genius came up with that advance warning, but it sure as hell would tell a wannabe terrorist not to go through with his plan and try again some other time. The people managing these processes really need to think such things through a little bit better.
Meus subcriptio est nocens Latin quoniam bardus populus reputo is sanus callidus
Bingo. http://en.wikipedia.org/wiki/Secondary_Security_Screening_Selection
I got into an argument with a customer service representative (and flew standby -- not sure which was responsible) and received this.
Ah, for all values of random where random = any flag in a DHS database anywhere.
Just so thrilled that we have discrimination down to a science.
Profiling is awesome. It surpasses all other screening methods in efficiency and effectiveness.
Not only is it fast (it can be done entirely before the passenger even arrives at the airport), and those not flagged can be sent through with a minimum of screening (all this equals much less waiting), it is also efficient as it would have caught all the 9/11 hijackers as well as the 'shoe bomber' and the 'underwear bomber', while none of the scanners would have caught anything, and even the grope search is likely to have missed almost everything.
Another backside to the current scanner-fixated system is that it creates some awfully attractive long queues filled with people outside the secure area where even a small nail bomb easily could kill hundreds. If you are going to assemble a lot of people in a confined space at the airport it should be inside the secured areas where they are less of a target.
And of course there's plenty of other places with lots of people assembled and little or no security - like malls, concerts, amusement parks, train- and bus stations or so on. There's a lot of potential targets so the only efficient means to secure them it to take out any potential terrorists way before they can get near such places or even get their hands on bomb materials and explosives.
"For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --
this only applies to the TSA who actually scan and pass people around the security scanning solution based on the results of what is in the barcode. in europe, you always have to go through scanning process, regardless of what your 2D barcode has encoded within in. all the TSA is doing here, is opening up a chance for terrorists based on local soil to get through the security scanning process simpler. the challenge is that the USA has the most number of travelers through the airline system than anywhere else in the world; doing extensive security checks does choke the system - so, they need to try and filter out the more frequent/trusted flyers, the net result is they are wasting time screening some since they done screen everyone.
Not only could you photoshop the barcode, but hell, you could photoshop the name, the destination, the flight number, pretty much anything you wanted... The brainless goons at the security checkpoint wouldn't know the difference. (They don't scan tickets or anything).
In my experience (working for a contractor for a major US airline), you could even use a photoshopped (printed at home) boarding pass to get on the plane. When they scan it at the gate and the computer beeps saying "no such thing", generally the non-english-speaking gate agent will just scan it a few more times, give up, and let the person on the plane. When the passenger count from the computer later doesn't match up to the number of people on the plane, they'll just "go with what's on the plane" in the interest of getting the plane out on time. This happens on a DAILY BASIS. "Security" is a joke.
Hmm - funny that. I once got that too after complaining to an American Airlines check-in lady about a checked luggage fee. Qantas passengers are exempt from such fees, as I tried to point out to her, but she wanted to hit me with it anyway. After a long debate and a visit from her supervisor the fee was waived - but - surprise surprise - SSSS appeared on the boarding card. This was on one leg out of 10 flights around the US, so it could not have been on the basis of any kind of passenger profiling. Maybe some slashdotter in the airline industry can enlighten us here...
Meus subcriptio est nocens Latin quoniam bardus populus reputo is sanus callidus
Jobs which slow the economy by discouraging pleasure travel (and all of the nice tourist spending) and business travel (and the kinds of business deals and chance new acqaintances you only get in person). Travel is incredibly important to our economy, it is part of what makes a large country so strong. When people opt out of it, the ripple effects are amazing.
Besides that it's election time, you guys have high employment already so it's political suicide for either party to say "hey you couple hundred thousand (or however many work in TSA) low-educated workers, please go find another job as we're shutting you down".
Airline employees can manually mark any boarding pass as SSSS.
How do I know? When it was possible to fly by purposely refusing to present ID, I once flew on a ticket that was paid for by another family member. When I went to check in and check my bags, they asked for ID. I told nicely told them that I prefer not to be identified and will be flying as a selectee. Person at ticket counter gives me a dirty look and responds (expectedly) that the SSSS is required if you don't present ID, but everything flowed smoothly after that. It's a shame that you can't refuse to identify yourself anymore these days.
After that, I think I was flagged as all my boarding passes for the next couple years had SSSS on it.
including the inability to get non-stop flights for most routes, having to pay to park in a lot that is still a 10 minute ride to the terminal, having to arrive 2 hours early to ensure getting thru security on time to board, having small innocuous items in my pockets stolen by TSA, risking having large innocuous items in my bags stolen by TSA, getting severely overcharged for food at airport terminals, getting X-rayed by someone who is not my doctor or dentist, having to do mini-marathons thru airports to make connecting flights, getting my bags lost, etc. etc. have all combined to cause me to decide to drive everywhere I go. Eventually, the Alcan Highway is going to get photographed up the wazoo, by me, 'cuz I'll drive up and ferry back. But the X-rays were the last straw, that shall not stand. I quit. You can find me on I-10 to Tucson next year, I-74 from Indy to La Crosse, I-64 to St. Louis, etc. etc. Until the unconstitutional TSA activity is removed, I will not choose to fly anywhere I can drive, or boat, or travel by train.
we all know that it is bleeding the taxpayers dry
All your arguments except that one are valid. Some math will tell you why.
TSA budget: $8.1 billion
US federal budget: $3.7 trillion
So the TSA makes up approximately 0.2% of the federal budget. You could cut it to $0 and still make no significant dent in the deficit. The big ticket items are, and have been for decades: Social Security, Medicare, Medicaid, and Defense. After the crash in 2008, unemployment insurance, food stamps, WIC, and housing assistance jumped up because more people are unemployed, hungry, or homeless. But the TSA just isn't even remotely close to what's bleeding the taxpayers dry.
I am officially gone from
We could retrain these guys and up their salaries at the same time to be Air Marshalls.
Seriously? These are people that couldn't qualify for a position as a security guard at the local mall and you want to arm them and put them on a pressurized airplane? No thank you.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
Another backside to the current scanner-fixated system is that it creates some awfully attractive long queues filled with people outside the secure area where even a small nail bomb easily could kill hundreds. If you are going to assemble a lot of people in a confined space at the airport it should be inside the secured areas where they are less of a target.
The fact that nothing remotely like this has happened speaks volumes about the threat faced
In the free world the media isn't government run; the government is media run.
It means "even the Nazis were only half as thorough as us"....
Got them moderator blues I blieve I walk out the do', With these mod-points I been gettin', I 'most never post no mo'