Frequent Flyer Points Put at Risk By Website Flaws (bbc.com) 19
Airline booking systems lack basic security checks that would stop attackers changing flight details or stealing rewards, warn experts. From a report on BBC: The problems emerge because the six-digit codes booking systems use to identify travellers are easy to guess. Two researchers demonstrated the weaknesses by changing a flight booking and seat assignment for a reporter. The security investigators presented their findings at the Chaos Communications Congress in Germany. In a blog detailing their work Karsten Nohl and Nemanja Nikodijevic of Security Research Labs (SRL) said the computer systems behind the airlines' travel bookings system dated from the 1970s and 1980s. Though these have been updated with web services they lack security systems that would prevent abuse, they said. In particular, they added, the systems have no way to check, or authenticate, who is querying the system for flight details.
now even /. puts out this overblown story (Score:2, Informative)
Yes, it is easy to get access to flexible tickets. In many cases, figuring out last name plus eight digit booking code is enough.
This allows a hacker to rebook the flight (presumably, to an earlier date) free of charge. However, this leaves the issue of changing the name on the passenger name record. Even with the most expensive flex tickets, changing of the name is subject to fees. The airlines will require a payment and presumably apply the same security checks as it would with the purchase of a brand-new
Re: (Score:2)
Re: (Score:3)
Assigning all the frequent flier rewards to yourself is as good as stealing tickets if you can do it frequently enough.
Who cares? (Score:1)
Go ahead, try to steal my points (Score:3)
Re: (Score:2)
I "lost" over 100,000 miles at one time when I thought there was no expiration, and the policy was changed so they expired after 18 months with no activity. I called customer service, and got them back for a limited time. I then bought a $40 item on the "Sky Mall" extending the miles for another 18 months.
They sent me a letter at one point telling me that my miles were going to expire and listing a few things I could do to prevent them that would only cost me some time (online surveys and similar crap). I did some of them, and my miles still expired. In my current situation though I fly about as much as a penguin so it didn't really matter that much. It was frustrating that after having flown quite a bit for several years, accruing a fair number of (admittedly worthless) miles, they all just went away.
Re: (Score:2)
All my points disappeared without notice a while back when I went over a year without flying. Thanks a lot, United Airlines.
The MilagePlus website shows the expiration date for accrued miles. Mine is sometime in 2018, currently.
For those who don't use United, they used to have a four digit PIN code to go with the MileagePlus identifier. It was published how easy it was to break in using that system, so United went to a system with a user selectable password. In addition, they now alert whenever a user accesses through an unrecognized device, prompting a two or three security question test before allowing access.
I don't know wh