Slashdot Mirror
Changing Other People's Flight Bookings Is Too Easy (computerworld.com)
"The security of online travel booking systems are stuck in the 1990s, according to security researchers," reports Computerworld. An anonymous reader quotes their article, which argues that the ancient systems are also "woefully insecure":
This allows attackers to easily modify other people's reservations, cancel their flights and even use the refunds to book tickets for themselves, according a team of researchers who analyzed this online ecosystem... They presented their findings Tuesday at the 33rd Chaos Communications Congress in Hamburg.
The three major Global Distribution Systems operators...store Passenger Name Records for hundreds of millions of travelers at any given time.
Any data added or modification made to a booking is stored in their systems and all that's required to access that information is typically a last name and a six-character booking code. There are multiple access points into these systems and this includes the websites operated by airlines and travel agencies, but also third-party websites like CheckMyTrip... The booking code itself is far from secret. It's printed on luggage tags that most people throw away after each flight -- even if their entire trip has not concluded yet -- and is also embedded in the QR codes printed on tickets that an alarmingly large number of travellers photograph and post on social media websites, the researchers said.
Any data added or modification made to a booking is stored in their systems and all that's required to access that information is typically a last name and a six-character booking code. There are multiple access points into these systems and this includes the websites operated by airlines and travel agencies, but also third-party websites like CheckMyTrip... The booking code itself is far from secret. It's printed on luggage tags that most people throw away after each flight -- even if their entire trip has not concluded yet -- and is also embedded in the QR codes printed on tickets that an alarmingly large number of travellers photograph and post on social media websites, the researchers said.
Take the bus? But that might be limiting.
Because for some strange reason, once we try doing something on the internet, possibly the most insecure and interference pronemethod of doing anything, we forget how millions of us use to fly all of the time, without these sort of problems.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
The problem is too expensive to fix, but not for the reason you mentioned.
Many passengers struggle with flying, due to inexperience, carelessness, distractions, or fear of flying, or they lack the mental capacity to understand everything they need to do. These people need the simplest possible way to access their flight info. That means helping them as much as possible by printing the booking code on the luggage tags, flight coupons, boarding passes, everything.
So far, it's much cheaper to accept the risk of a few people messing with the flight info, rather than dealing with millions of scared, confused, and/or angry travelers stuck in an unplanned layover because they didn't have the ability to access their connecting flight information.
That could change if someone figures out how to monetize this hack safely, but that's very unlikely. The booking code isn't the only security measure in place. The hackers can change a flight, but a passenger complaining at a gate will win out over an online change; anyone attempting to cash in on the fraudulently changed ticket risks felony theft and fraud charges.
John
Remember also that people are traveling, so they can't read the post-it note on their monitor, or whatever they use to store their password.
The real "Libtards" are the Libertarians!
I had someone use my email address to get the confirmation for the out and return flights for himself and his partner.
I have a gmail address, which I got back in the time when it was still invitation only, which I set up as my initial and last name @gmail.com. This person with the same initial (but different first name) and same last name decided that my email address must be his, so he used it when booking his tickets. Normally I just delete these emails, as this guy was the 4th person who has made the same mistake, but as they were for flights, I decided to be kind and contacted him - he was easy to find, as I had the city where he lived.
I can't believe how stupid some people are.
For a short period of time, I was thinking of where I could send him, maybe change his return flight to Juneau Alaska and see if he noticed.
"The best part? I became an ordained minister while not wearing pants." -- CleverNickName
For when it was designed in the 1960's. Note that much of the system is still rooted in the original designs. I worked in that industry and it wasn't any kind of secret how terrible this 50 year old security was. A lot of the design decisions such as no support for a year (all dates are in the future with no year indicated, so limited to about 330 days out) and the PNR code itself, plus storing the data in the record (everything vanishes on the day the last leg of the flight is complete). No one in the industry wants to change anything since every part of the travel industry is dependent on nothing changing. Even if hacking becomes rampant nothing will change.
Well, the most straightforward way is to book a ticket for yourself; but that obviously leads back to you, which is probably why fixing this isn't a top priority.
That said, the ability to work malice and mischief has value to some. And in some cases that could have economic value (e.g. making sure key people from your competitors don't make it to a critical meeting).
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Since it never involves talking to a person, isn't it anti-social engineering?
Actually, as smartphones get more ubiquitous and even dumbphones gain more capabilities, the cost of fixing the problem should drop--we're already seeing a shift towards electronic ticketing, how much more effort would be needed to simply have it set up so you can have your phone self-update with the connecting flight information as you go, so it'll be up-to-date and you will know things like "Oh, hey, my connecting flight changed" as soon as possible.
Again, at least *some* of this strikes me as cases of, "Sure...the technology may let you do it, but you're still creating a trail to get caught!"
I mean, ok --- the relatively weak security might let me log in to a web portal and cancel a guy's flight. But if that's a flexible ticket (the most expensive kind) that lets me reschedule it under another name? Don't you think he might *notice* that happened? And when they investigate, it wouldn't be too tough to figure out who DID use that rescheduled flight.
I'd be more worried about the possibility of mischievous hackers screwing up people's booked flights for amusement and general rabble-rousing. But even something as simple as putting your own frequent flier ID in under someone else's flights to earn their miles means you can be tracked down and caught/punished for theft of them.
I can assholes screwing competitors out of contracts and sales opportunities by making sure the other guy doesn't show up for the pitch.
Surprisingly I heard of crazy stuff including geeks taking down wifi hotspots when a competitor comes in for a sale on the road etc.
http://saveie6.com/