Slashdot Mirror
Changing Other People's Flight Bookings Is Too Easy (computerworld.com)
"The security of online travel booking systems are stuck in the 1990s, according to security researchers," reports Computerworld. An anonymous reader quotes their article, which argues that the ancient systems are also "woefully insecure":
This allows attackers to easily modify other people's reservations, cancel their flights and even use the refunds to book tickets for themselves, according a team of researchers who analyzed this online ecosystem... They presented their findings Tuesday at the 33rd Chaos Communications Congress in Hamburg.
The three major Global Distribution Systems operators...store Passenger Name Records for hundreds of millions of travelers at any given time.
Any data added or modification made to a booking is stored in their systems and all that's required to access that information is typically a last name and a six-character booking code. There are multiple access points into these systems and this includes the websites operated by airlines and travel agencies, but also third-party websites like CheckMyTrip... The booking code itself is far from secret. It's printed on luggage tags that most people throw away after each flight -- even if their entire trip has not concluded yet -- and is also embedded in the QR codes printed on tickets that an alarmingly large number of travellers photograph and post on social media websites, the researchers said.
Any data added or modification made to a booking is stored in their systems and all that's required to access that information is typically a last name and a six-character booking code. There are multiple access points into these systems and this includes the websites operated by airlines and travel agencies, but also third-party websites like CheckMyTrip... The booking code itself is far from secret. It's printed on luggage tags that most people throw away after each flight -- even if their entire trip has not concluded yet -- and is also embedded in the QR codes printed on tickets that an alarmingly large number of travellers photograph and post on social media websites, the researchers said.
Take the bus? But that might be limiting.
Because for some strange reason, once we try doing something on the internet, possibly the most insecure and interference pronemethod of doing anything, we forget how millions of us use to fly all of the time, without these sort of problems.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Comment is title.
There were 50 comments. Low traffic story. So........... post it again.
Changing other people's flight bookings is ALL TOO EASY like Vader being really good at RODEO!
Is this really a problem? It might be easy to maliciously change a booking, but unless this is actually happening regularly it seems like adding layers of security would just create obstacles for people making legitimate changes.
mod parent up
The problem is too expensive to fix, but not for the reason you mentioned.
Many passengers struggle with flying, due to inexperience, carelessness, distractions, or fear of flying, or they lack the mental capacity to understand everything they need to do. These people need the simplest possible way to access their flight info. That means helping them as much as possible by printing the booking code on the luggage tags, flight coupons, boarding passes, everything.
So far, it's much cheaper to accept the risk of a few people messing with the flight info, rather than dealing with millions of scared, confused, and/or angry travelers stuck in an unplanned layover because they didn't have the ability to access their connecting flight information.
That could change if someone figures out how to monetize this hack safely, but that's very unlikely. The booking code isn't the only security measure in place. The hackers can change a flight, but a passenger complaining at a gate will win out over an online change; anyone attempting to cash in on the fraudulently changed ticket risks felony theft and fraud charges.
John
We all know that it is totally insecure, but the flight company doesn't care, this is in the spec, so we must implement it like this, no matter what. Like I care, whatever.
Well done "superhackers" off CCC. You just found out that you need only a last name and booking reference to change your flight.
What serious accomplishment...
Remember also that people are traveling, so they can't read the post-it note on their monitor, or whatever they use to store their password.
The real "Libtards" are the Libertarians!
I had someone use my email address to get the confirmation for the out and return flights for himself and his partner.
I have a gmail address, which I got back in the time when it was still invitation only, which I set up as my initial and last name @gmail.com. This person with the same initial (but different first name) and same last name decided that my email address must be his, so he used it when booking his tickets. Normally I just delete these emails, as this guy was the 4th person who has made the same mistake, but as they were for flights, I decided to be kind and contacted him - he was easy to find, as I had the city where he lived.
I can't believe how stupid some people are.
For a short period of time, I was thinking of where I could send him, maybe change his return flight to Juneau Alaska and see if he noticed.
"The best part? I became an ordained minister while not wearing pants." -- CleverNickName
This is just social engineering.
Derp.
and is also embedded in the QR codes printed on tickets that an alarmingly large number of travellers photograph and post on social media websites, the researchers said.
Well, it wouldn't be alarming if there were some form of security implemented.
For when it was designed in the 1960's. Note that much of the system is still rooted in the original designs. I worked in that industry and it wasn't any kind of secret how terrible this 50 year old security was. A lot of the design decisions such as no support for a year (all dates are in the future with no year indicated, so limited to about 330 days out) and the PNR code itself, plus storing the data in the record (everything vanishes on the day the last leg of the flight is complete). No one in the industry wants to change anything since every part of the travel industry is dependent on nothing changing. Even if hacking becomes rampant nothing will change.
I still don't understand how they'd get the money from a change. Every time I've downgraded a refundable ticket to a restricted fare, the refund goes back to the original method of payment (a credit card). I can't use the ticket if I don't have the same name. The worst someone can do is DoS me – a minor inconvenience for me, and a felony for them. The cost/benefit isn't there for this sort of fraud IMO.
Well, the most straightforward way is to book a ticket for yourself; but that obviously leads back to you, which is probably why fixing this isn't a top priority.
That said, the ability to work malice and mischief has value to some. And in some cases that could have economic value (e.g. making sure key people from your competitors don't make it to a critical meeting).
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Actually, as smartphones get more ubiquitous and even dumbphones gain more capabilities, the cost of fixing the problem should drop--we're already seeing a shift towards electronic ticketing, how much more effort would be needed to simply have it set up so you can have your phone self-update with the connecting flight information as you go, so it'll be up-to-date and you will know things like "Oh, hey, my connecting flight changed" as soon as possible.
"even use the refunds to book tickets for themselves" yeah fat chance of that. I haven't heard of anybody being able to do that in that industry, and I have worked there for 20 years. What I heard of is agent doing fraudulent stuff (I even participated indirectly indicting one by setting up programs to catch whatever action that agent did). Fraud on the consumer side is much harder, as you can't easily refund (it has to be refunded to the original payment) , and doing refund-buy another leave trace, if only because you have to present yourself to fly that second ticket you fraudulently bought. For similar reason there is no security on check in stub and you can print yourself at home, the problem with fraud with a plane ticket is that at some point you have to be present in person.
Again, at least *some* of this strikes me as cases of, "Sure...the technology may let you do it, but you're still creating a trail to get caught!"
I mean, ok --- the relatively weak security might let me log in to a web portal and cancel a guy's flight. But if that's a flexible ticket (the most expensive kind) that lets me reschedule it under another name? Don't you think he might *notice* that happened? And when they investigate, it wouldn't be too tough to figure out who DID use that rescheduled flight.
I'd be more worried about the possibility of mischievous hackers screwing up people's booked flights for amusement and general rabble-rousing. But even something as simple as putting your own frequent flier ID in under someone else's flights to earn their miles means you can be tracked down and caught/punished for theft of them.
I can assholes screwing competitors out of contracts and sales opportunities by making sure the other guy doesn't show up for the pitch.
Surprisingly I heard of crazy stuff including geeks taking down wifi hotspots when a competitor comes in for a sale on the road etc.
http://saveie6.com/
This is the future. No more passwords, no more checkout steps, everything one-click, but that's OK because they already know everything about you from your browser cookies. Of course you won't be allowed to hide these from them or not be social enough on the network. And Trump in power.
I agree that if you plan to stay with a cheater don't try to find any information. However, in my case I needed it in my state in order to file for a divorce and come out of the relationship. You can't just say I think courts want proof or you end up spending a lot of time and money to fight it out! Finding out was hard, but I was relieved that I wasn't crazy and it's making my divorce go a lot smoother. He would never confess; therefore, I did the best thing for me...find out, no doubt, move on!!!contact hotcyberlord@gmail.com..he's a professional and will surely help you out,tell him from Ninah
FYI, stuck in the 60's is more like it. Some of those commercial airline ticket management systems have implementations of the NP-Complete Traveling Salesman Problem written in COBOL. Even those flashy MSIE front-ends you see on the airport kiosks are clients adapted to the legacy technology. Oracle Tuxedo adapts COBOL applications to J2EE.
Regards,
@decalresponds