Hacker Holds Key To Free Flights 144
mask.of.sanity writes: "A security researcher says he has developed a method to score free flights across Europe by generating fake boarding passes designed for Apple's Passbook app. The 18-year-old computer science undergrad didn't reveal the 'bypass' which gets the holder of the fraudulent ticket past the last scanner and onto the jetway; he's saving that for his talk at Hack in the Box in Amsterdam next month."
Okay, but... (Score:5, Insightful)
Re:Okay, but... (Score:4, Interesting)
"Oh, I'm sorry - I must have grabbed the wrong row."
"Oh, I'm sorry - they said my seat assignment was provisional because I arrived so late, I'll find another one"
Board near the end of the boarding time and take a free center seat near the back -unless then plane is 100% full, you're golden.
Re:Okay, but... (Score:5, Informative)
Board near the end of the boarding time and take a free center seat near the back -unless then plane is 100% full, you're golden.
Except for the annoying habbit flight attendants have of counting the number of passengers.
Re: (Score:2)
Re: (Score:3)
Go sit in the bathroom until after they count?
But don't close the door, else they count the occupied booth.
Re: (Score:2)
Don't they check bathrooms?
If they don't... maybe they should.
Re: (Score:2)
Re: (Score:2)
Re:Okay, but... (Score:4, Interesting)
Not in my last 6 flights they haven't, at least not without trying to be incredibly covert about it which I seriously doubt. All these flights were within Europe or SE Asia, I don't know if head counts are more common in other regions.
Within the US they definitely count the passengers. I flew between Canada and Asia last year and I don't remember if they counted or not, but on flights within the USA they definitely do count. There was a rather embarrassing incident where a minor without a ticket of any kind got on a plane in the US and nobody ever did anything to make sure he was in the right place or even had a ticket for the flight. I think now all the airlines want to make sure that kind of thing never happens again, because if a kid can do it, an adult with bad intentions may be able to do ti too.
Re:Okay, but... (Score:5, Funny)
Re: (Score:2)
Re: (Score:2)
Didn't they check that everyone had their seatbelts on, their seats in an upright position, their belongings stowed in the overhead locker and had switched off all electronic devices?
Re: (Score:2)
Re: (Score:2)
Know the capacity of the aircraft. Count number of empty seats, a much easier task. Passengers=total seats-empty seats. It sounds like you would flunk a flight attendant interview....
Re: (Score:2)
Count number of empty seats, a much easier task. Passengers=total seats-empty seats.
And you'd totally miss lap kids.
Re: (Score:2)
Its easy to be covert on nearly full flights, you just walk the plane and count empty seats, basic math gives you filled seats.
Re: (Score:2)
They count in Canada as well. Last time time I flew(dec last year), they deboarded the plane when I was in Calgary, and went through reboarding because there were more people on, than went though the entry kiosk.
Re: (Score:3)
...and it's not very hard to be covert when all you have to do is count the empty seats and subtract.
Re: (Score:2)
Re:Okay, but... (Score:5, Funny)
Pfft, that's the stupid way. You count the number of legs and divide by two!
Re: (Score:2)
Re: (Score:3)
Usually they go down the aisle with a "clicker" - usually not very covert. The plane doesn't take off before the numbers match.
On a flight I was on, the numbers didn't match up, so they went through the cabin with a list of all passengers, asking each of us to tell them their last name (which they crossed off from their list), in order to figure out who wasn't inside the plane.
Re: (Score:2)
An empty seat? What's that? I don't fly a lot, but whenever I do they're bumping people because the flight's been so horribly overbooked.
Re: (Score:2)
Quite common if you're not picking the most popular flights. Tickets are usually cheaper as well.
Got my own 3-seater many times that way, rise the armrests it's a quick flight to dreamland :)
Re: (Score:2)
Re: (Score:2)
Ah yes, the flight manifest [wikipedia.org].
Re:Okay, but... (Score:5, Informative)
They count the number of passengers who got on.
The number of passengers with tickets is usually higher.
They don't compare the count to the number of tickets. They compare it to the number of people known to be getting on the flight, presumably these days from the number who've been scanned through security (in my airside days it was the number that had checked in at the desk, since this was before online check-in).
Re:Okay, but... (Score:4, Interesting)
They count the number of passengers who got on.
The number of passengers with tickets is usually higher.
They don't compare the count to the number of tickets. They compare it to the number of people known to be getting on the flight, presumably these days from the number who've been scanned through security (in my airside days it was the number that had checked in at the desk, since this was before online check-in).
.. Which this device claims to be able to get through (the jetway is after the last ticket check). So the numbers may actually match up...
Re: (Score:2)
Spoiler alert: they don't do the count until everyone's sitting down.
Re: (Score:2, Funny)
"Oh, I'm sorry - I must have grabbed the wrong row."
"Sir, let me confirm your name with the flight manifest."
"Oh, I...um..."
(radios for security, man goes to prison under terrorism charges)
Re: (Score:2)
Terrorism, theft of services, impersonation of a law enforcement officer, impersonation of a federal official, I figure they can find a few more.
Re:Okay, but... (Score:5, Funny)
Re: (Score:2)
Do sky marshals actually carry guns onto planes, loaded, in the passenger compartment?
Re: (Score:2)
They would be fairly ineffective at stopping a hij (Score:2)
They are also well trained.
Re: (Score:2)
Highly trained or not, that sounds like a massive liability, both from the perspective of allowing people (who may or may not be thrustworthy) with weapons on planes, and the fact that firing a firearm inside a plane cabin is a pretty bad idea - a knife or similar would be at least as effective in a close-quarters situations such as a plane.
Finally, being a Sky Marshal sounds like the most boring job ever - I would imagine you'll end up with only people who failed at burger-flipping taking it + a few freak
Re: (Score:2)
Re: (Score:2)
Nah, I just didn't pay to much attention to it, and threw it in with the rest of the paranoia just after 9/11. Honestly, the debate here where more focused on Iraq - the right-wing governement we had at the time actually sent a few troops there (in addition to Afghanistan), and we might have been sucked into that conflict if they hadn't lost the election in '05.
But when you mention it, I do actually remember there was a ton of fuzz about allowing them to carry guns in the cabin of US-bound/-originated plane
Re: (Score:3)
Are you afraid of the whole "shoot out a window and Hollywood makes it seem as if the plane will empty itself via the hole" scenario? Mythbusters tested it. No, the plane doesn't explosively decompress, the passengers don't get sucked out the window. Basically, the results are "it's loud". Much more of a problem is that everyone's panicking and screaming because someone is shooting a gun.
Re: (Score:2)
No, not really, even if I don't think Mythbusters is the pinnacle of science & engineering. A few holes in the fuselage may even not be enough to decompress the plane, and a window would be unfortunate, but probably not too dangerous - given that the range of the plane while flying below normal altitude allows it to reach a runway. There might be some risk to wires for instrumentation etc., but I suspect the greatest risk here is to the passengers.
However, we do normally go to ridiculous lengths to ens
Re: (Score:2)
Adding a guy with a gun into the mix seems inconsistent and probably more of a risk than a benefit.
You obviously haven't seen Non-Stop, then.
Re: (Score:2)
I have not (never even heard of it - it hasn't been very much adverticed here (currently living/working in France/Switzerland), but a quick check of IMDB indicates that it's a even less reliable source of information than Mythbusters :)
Re:Okay, but... (Score:4, Funny)
(who may or may not be thrustworthy)
As a guy, I hope I never, ever, enter this categorization.
Re: (Score:2)
So, its really just another make-work program under the TSA? Couldn't they rather invest in a bit more effective immigration control? Last time I flew to the US, I spent ~2 hours in line for a 1 minute interview, which almost made me miss the connecting flight. Three-four guys for interviewing a few 747s takes forever (not everyone gets the 1-minute treatment - that comes with knowing the drill and being prepared for which questions they will ask + a pile of old US entry stamps in my passport).
Re: (Score:2)
And then she goes to tell the real sky marshal that there is someone back there claiming to be in posession of a gun, and suddenly you're looking down the barrel of a real gun. Don't make any sudden moves!
(All flight staff are introduced to the marshal in person prior to the flight.)
Re: (Score:2)
I wonder how the flight staff reacts when a passenger walks up to them and quietly tells that the guy sitting next to them is carrying a gun on the plane...
Hmmm... (Score:2)
Re: (Score:1)
That wouldn't be an issue on an airline like Southwest.
Re: (Score:2)
Wow! When did Southwest get ETOPS approval to fly over the Atlantic Ocean???
They didn't. They just get lost [cbsnews.com] occasionally.
Re: (Score:2)
get on the plane last...
Re: (Score:2)
Fly Southwest.
Re: (Score:2)
I don't think you're familiar with European budget airlines. You can choose your seat when booking if you're willing to pay extra. Maybe a dozen people per flight have reserved seats, and the rest work on the basis of first come, first served.
Re: (Score:2)
Usually you get a seat assigned when you check in. You can often ask for a specific seat (for no extra charge) then also - but of course you won't get first pick.
Re: (Score:2)
Interesting. Which airlines do you fly with? I mainly fly Ryanair or EasyJet, and they don't assign seats unless you pay. (I'm not sure, but I half suspect it's a ploy to make people get to the gate early so that they can be at the front of the queue). It's a while since I flew Air Nostrum, so I can't remember how they do it.
Re: (Score:2)
Most of the time it's Norwegian out of Oslo, but I also fly Lufthansa/SAS quite a bit, and occasionally KLM. The "premium" airlines are often actually cheaper than the "low cost" ones, you just have to spend 30 minutes comparing prices - expedia is great for this (but not neccessesarily book through them, the airlines are easier to deal with for changes etc. if you go through their system).
On the self-check-in machines for Norwegian, you can pick your seat, but of course you get 2nd pick after whoever paid
Re: (Score:2)
I don't think you're familiar with European budget airlines. You can choose your seat when booking if you're willing to pay extra. Maybe a dozen people per flight have reserved seats, and the rest work on the basis of first come, first served.
Sure, but they will always check if there's an extra passenger on board, because else they may run out of fuel.
Re: (Score:2)
An extra 150lbs won't make a difference. Besides, they always have extra fuel just in case the plane has to fly some extra time in case of traffic
Re: (Score:2)
Not all airlines assign specific seats to specific passengers. Some even charge for specific seats.
A more obvious question would be if the crews do a "head count" or not.
Wonder if the article the article should have said "Schengen Area" rather than EU.
Um... (Score:1)
Just don't fly out of Europe (Score:5, Insightful)
You might get lucky and get an empty seat. Hint - pick a center seat in the last few rows, these seats suck. However, if you fly into the US or many other countries, they will have received a passenger manifest electronically from the airline. You'll have fun when you get to customs and there's no record of you...
Re: (Score:2)
That's not how it works, or even remotely so.
Re: (Score:2)
Only problem is that the overhead bins on the few last rows are often filled with crew's stuff, PA system boxes, firefigthing equipment, portable oxygen containers and a ton of other stuff. So you might end up putting it under the seat in front of you (which sucks if you're tall).
Oh Crap (Score:1)
Another possible attack vector for terrorists. Unwittingly this guy is now going to make it a living nightmare for people flying around Europe for exposing this security flaw. Prepare for the requisite knee-jerk response from the EU and the US.
Re: (Score:2)
I'd be more concerned about lax security allowing travel using stolen passports.
e.g. the two Iranian passengers on the missing Malaysian aircraft, travelling on euro passports stolen a year earlier.
show up early, print dupe boarding pass as kiosk (Score:1)
You need to do this in two steps
1) Knowing the name of someone on the flight, get a copy of their boarding pass at one of the omnipresent selfcheckin kiosks in the terminal. This might be a bit tricky, perhaps shoulder surfing or social engineering? Even trash can rummaging (since people often get a new boarding pass when they check bags, etc.).
That gets you the seat assignment on the plane, and past the scanner.
2) Bogus boarding pass that matches your ID so you can get past the security checkpoint (the l
CSS? Does my seat come with extra padding? (Score:4, Funny)
Whoa, talk about floating yourself relative to your original position! If the flight is full can I just sit aligned in the center?
Re: (Score:2)
Mod parent up. Go on, you know you want to.
Or not... (Score:2)
He said the model used in all EU airports to check the validity of tickets was "malfunctioning" noting they lacked "direct access to the airliner database", but wouldn't be drawn on whether he tested his research by boarding a flight.
Re: (Score:2)
Shocking.
Free? I think not (Score:2)
Hacker Holds Key To Free Flights
Until you count the risk-weighted cost of getting arrested for fraud.
Picking a seat is easy (Score:3)
Seat maps are now available online realtime for most major airlines. So there is no need to guess - you can pick a right flight and an empty seat, do it right before the departure and it will likely remain empty.
On the other hand, my impression of gate check was that it checks boarding pass against database record of name/reservation/seat assignment. Certainly any other information maintained by gate agents is in the same remote database (such that any changes they perform at the gate become instantly visible online, for example standby and upgrade list status). So, no matter what the "local hack" is, it would only work if either:
- He can also hack remote passenger database (unlikely)
- Specific airline does not check passengers against the database and trusts properly constructed boarding pass (also unlikely, at least in US, as there needs to be positive match between passenger and loaded luggage that has to be performed based on that darn remote record).
There is also pesky passenger manifest with names, which again comes not from your boarding pass but from the remote system (though they need to reconcile with with reality).
Let's wait and see. Perhaps some of these conditions don't hold in Europe for whatever reason?
Re: (Score:3)
On the budget airlines there are no seat assignments, you can pay extra to get in the first queue. Once the gate opens its a dash for the 'best' seats
Re: (Score:2)
> Let's wait and see. Perhaps some of these conditions don't hold in Europe for whatever reason?
You mean like it is all a bunch of unnecessary hoopla that costs way more than its worth for the nearly non-existent problems it solves?
Re: (Score:2)
Which one? Knowing what passenger is in what seat? I dunno, airlines don't do much of anything if it costs extra. Remember the peanuts?
There is a downside (Score:2)
This might work fine, but if it didn't work you would probably get arrested, get put on a blacklist and, if it was really your day, get close attention from the likes of the French DGI. There is nothing like a week of interrogation to spice up your vacation.
Iron Man challenge (Score:2, Funny)
For hackers with balls, try that on Air Force One.
"Hey, Mr. President, this is my seat!"
what the hell? (Score:2)
Re: (Score:2)
You need to check in on-line, less than 24 hrs. before the flight and in return you get a mail with a QR code.
At the airport you just show your phone displaying the code, both at immigration, at security and at boarding.
Also realise there is no Immigration between the EU Schengen countries.
Re: (Score:2)
Who the hell would accept a digital image of a boarding pass?
Err, everyone, on every flight I've taken in the last few years (which admittedly isn't many). A QR code in an email sent to my phone is my boarding pass. A scanner reads it, presumably displays my details to the security guy, and he checks my ID.
I could make a fake one so easily and just imitate the app.
Off you go then.
It's not like someone scrawled "Boerd!ng Pars" on the back of an envelope with a crayon.
Re: (Score:2)
I've not taken a flight in the last couple of years, between a number of European countries, that I've not used a QR code on my phone as the boarding pass. Given that its a QR code even if you take a snapshot of someone else's how are you going know what details to swap out? The other information there is for the user only, its not used by the scanner.
Bullshit (Score:5, Informative)
The bottom line was that the secure (relatively) thing is not the boarding pass but the ticket. Now if you could free ticket i would be downright impressed. Free boarding pass have long been known to be insecure. They are not there to be secure but to count boarded pax on the system against real boarded on plane, to be able to remove the one which are No-Show and remove their baggage.
And confirmation of BS : (Score:4, Insightful)
To that I have to say only "yeah , right" as in very sarcastic. Some airline in europe have spearheaded the interline and ground handling electronic exchange between TKT and CKI systems (using edifact messages TKCREQ, TKCUAC, TKCRES) since.... 2001. Even the medium airline are using the itnerline access. only very very small airline are still using offline process like ETL list.
That "security" researcher never checked in real life its results.
Re: (Score:2)
Re: (Score:2)
Now if you could free ticket i would be downright impressed.
Free ticket is easy. Just buy a ticket online and use someone else's bank account data (which should work in most of Europe via SEPA direct debit). Bank account data is widely availabe on the web, as this is generally not thought to be highly sensitive information. If you do it shortly before the flight, the account holder will most likely not notice what's going on to have the ticket cancelled in time.
For bonus points, you can get the ticket issued under a pseudonym and alter the boarding pass to match you
Permanent DNF (Score:2, Insightful)
This kid is asking to be put on a permanent Do Not Fly list. Emperors don't like peons who point out their absence of clothes.
I Guess (Score:2)
next month if he's not in lockup by them (Score:2)
next month if he's not in lockup by them and even them he may make the no fly list.
Re: (Score:2)
First rule of Fight Club is..
You do not talk about FIGHT CLUB.
Second rule is..
You do not talk about FIGHT CLUB.
Re: (Score:2, Funny)
First rule of Flight Club is..
You do not talk about FLIGHT CLUB.
Second rule is..
You do not talk about FLIGHT CLUB.
Re: (Score:2)
Wrong.
The first rule of FLIGHT CLUB is...
You do not talk about how you got your tickets
Re: (Score:2)
The Third Rule that you do not talk about the Second Rule.
Re: (Score:2)
Where We're Going, We Don't Need Tickets
You need a ticket, but only a one-way.
Re: (Score:2)
Re: (Score:2)
To be fair, this is more of an airline issue than a TSA issue. As long as he has proper ID, passes security, and doesn't pose a threat, the TSA likely won't care one way or another. They never cared about fake tickets that could get you through security before in any case.
Of course, being able to get on a flight with this is new, so maybe they will suddenly start caring.
Re: (Score:2)
Uh, the TSA very much wants to know the identity of anybody boarding a plane. Any airline that allows somebody on a plane who wasn't on the manifest will get in really hot water, as will any passenger attempting something like this.
In the US a background check was run on you before you even arrive at the airport.
Re: (Score:2)
Of course there's also the non-rev standby category, but for that you need to fake an airline ID and uniform... and that's a lot more risky.
Non-rev standby doesn't work like that. You are thinking more of jump-seating for pilots and flight attendants, who must be in uniform and can just show up at a gate and get listed. Non-revs wear regular clothes and do not need to show ID at the gate, but when they check-in at the airport they need to have already made a reservation through their online company portal, or need to produce an airline ID to the ticket agent if they are booking the flight day of. But trying to fake either of those, especiall
Re:Checkin will not allow double seating (Score:5, Informative)
Lately, when I checkin for a flight, the software in the ticket scanner checks to see if the seat has already been scanned. If it has, it'll beep, if not then it marks it as now allocated.
The gate agents also have access to electronic versions of the passenger manifest, and newer systems even display the names of passengers that are not yet checked in/on board/awaiting seat assignment next to a seatmap of the aircraft so they can be literally dragged and dropped to assign seats. If the boarding pass fails to scan, the first thing the gate agent will notice, either by looking at the list or manually typing in the passengers name, is that no one with that name is booked on the flight, either as a paying passenger or on standby. The name would have to match up with a person assigned to the flight, otherwise they will not let you on.
Re: (Score:2)
At least he'll be taking the train there.
Re: (Score:2)
Yeah, wouldn't want a muslim flying for free.
Re: (Score:2)
Given that there are cameras everywhere these days, "Good luck with that."
While they're busily fixing it, an old problem was matching a low-resolution image of a face to an actual individual with enough certainty that you can't find a half-dozen other individuals that also match without much problem.
It's tough even with witnesses and books of known criminal gangs.