Changing Other People's Flight Bookings Is Too Easy (computerworld.com) 75
"The security of online travel booking systems are stuck in the 1990s, according to security researchers," reports Computerworld. An anonymous reader quotes their article, which argues that the ancient systems are also "woefully insecure":
This allows attackers to easily modify other people's reservations, cancel their flights and even use the refunds to book tickets for themselves, according a team of researchers who analyzed this online ecosystem... They presented their findings Tuesday at the 33rd Chaos Communications Congress in Hamburg.
The three major Global Distribution Systems operators...store Passenger Name Records for hundreds of millions of travelers at any given time.
Any data added or modification made to a booking is stored in their systems and all that's required to access that information is typically a last name and a six-character booking code. There are multiple access points into these systems and this includes the websites operated by airlines and travel agencies, but also third-party websites like CheckMyTrip... The booking code itself is far from secret. It's printed on luggage tags that most people throw away after each flight -- even if their entire trip has not concluded yet -- and is also embedded in the QR codes printed on tickets that an alarmingly large number of travellers photograph and post on social media websites, the researchers said.
Any data added or modification made to a booking is stored in their systems and all that's required to access that information is typically a last name and a six-character booking code. There are multiple access points into these systems and this includes the websites operated by airlines and travel agencies, but also third-party websites like CheckMyTrip... The booking code itself is far from secret. It's printed on luggage tags that most people throw away after each flight -- even if their entire trip has not concluded yet -- and is also embedded in the QR codes printed on tickets that an alarmingly large number of travellers photograph and post on social media websites, the researchers said.
Take the bus (Score:2)
Take the bus? But that might be limiting.
Re:Take the bus (Score:5, Insightful)
Not to sound like a /. shill, but I've given up on flights that are to major cities less than 500 miles from where I live (Nashville). Greyhound or Superbus are much better deals for all three: money, time, and hassle. I can get a round trip bus ticket for less than 100$ to the furthest city I would want to go to (Cleveland), the bus takes ~10 hours from door-to-door. When you read that it sounds like a lot, but consider that the bus makes stops at places with food/restroom. And for their 'express(read new)' buses it has WiFi and power outlets for each seat now and enough let room for me (6ft) to _stretch_ my legs.
Also, I've book a round trip to Cleveland for a week less than 3 hours before the bus left for ... I think 89$.. (Emergency to help friend) and there would have been no way for me to book a flight on such short notice....
If you can't get a direct flight to where you are going or need to book it ASAP, the cost can easily be 4~5x that (if not more) and the total time invested (after you account for TSA Security Theatre + waiting for baggage, etc....) is about roughly the same. Direct flights can save time, but I still feel the cost+hassle savings is worth it.
I rode the bus a good 20 times and only had one issue where there was a guy who smelled. (and I've had that on airline flights too... so *shrugs*)
Re: (Score:2, Funny)
I rode the bus a good 20 times and only had one issue where there was a guy who smelled. (and I've had that on airline flights too... so *shrugs*)
One time my wife wanted to visit her father in Florida who just had an operation. I offered to drive her down from PA, and drive back then do it again a coupe weeks later, since I had some big meetings I couldn't get out of.
She said no, she would take the bus. I told her that was the last thing she wanted to do. I pleaded, I begged a cajoled. However, she is an alpha chick, and does not take telling. So the bus she took.
After coming back into town a couple weeks later, the bus was three hours late. I
Re:Take the bus (Score:5, Insightful)
I did throw a shitfit and told her that if she wanted to take another Greyhound bus trip, it would be as a single parent. She is quite headstrong, but if that was all the respect I'd get after having to worry about what I knew was going to happen, fuck it .
Wow man - what kind of ultimatum is that for your wife? /with/ her.
Cherish her, love her, support her. Dude, someday you'll wish you had these kinds of problems. Until then, enjoy life
Re: (Score:2)
Wow man - what kind of ultimatum is that for your wife? Cherish her, love her, support her. Dude, someday you'll wish you had these kinds of problems. Until then, enjoy life /with/ her.
The sort of ultimatum you give someone when if they haven't learned to listen to you when you know they are going to drive off a cliff, are determined to drive off the cliff, and nothing is going to stop them driving off that cliff, but you want to exercise your option to get out of the car before they drive off the cliff.
I don't know if you've been involved with an alpha chick or not, but a headstrong one can be remarkably stubborn. So you would suggest that I tell her that I support her right to be sexu
Re: (Score:2)
Re: (Score:1)
Way to be a complete dick to your wife after what sounds like a traumatic ride.
Maybe she'd be better off without you.
Oh and there is no such thing as "alpha" and "beta" people. Theres absolutely nothing in sociology or psychology that supports the idea,
Re: (Score:2)
Way to be a complete dick to your wife after what sounds like a traumatic ride.
We'll just ignore that part about her completely ignoring everything I told her, and her actually suffering less trauma than what I was expecting. I'm a big strong guy, and I wouldn't take a bus.
I gave her plenty of options, like flying, or delivering her to Florida myself, but she wouldn't accept either of them. For some reason or other, she was determined to take that stupid bus.
Maybe she'd be better off without you.
Maybe.
Or she could have just admitted I was right, which she did, and now swears off ever setting foot on a bus or in a bu
Re: (Score:2)
This sort of thing varies by the passenger's sex, age, and general body language...and the era at which you take the trip, since some of these problems have dropped simply because the bus is becoming more and more the choice of people who are not merely too poor to get a plane ticket.
My own preference--admittedly helped by the fact that there's actually a station near enough me for it to be feasible--is to take the train...when I can actually find a route that gets me where I want. With all the talk about
Re: (Score:3)
I rode the bus a good 20 times and only had one issue where there was a guy who smelled.
I rode the bus once. It smelled like a locker room, there was junk all over the floor. We were already packed in like sardines, and then they stopped to pick up more! There was a suitcase poking me in the ribs, and an elbow in my ear, and at one point I had a smelly old bum standing next to me who hadn't showered in a year. The window wouldn't open and the fan was broke, my face was turning blue. I don't think I'd been in a crowd like this since I went to see the Who.
Re: (Score:3)
Another one rides the bus.... And another comes on, and another comes on... another one rides the bus ehhh!
Re: (Score:3)
That being said, flying isn't bad either. Last time I went to Heathrow I was through check in and security faster that it took to get from the car park to the terminal (to be fair, the car park was 25 minutes
Re: (Score:1)
Re: (Score:2)
The remedy for USA airport travel interaction with the TSA/DHS/Local LEOs? Move to UK! Regrettably, that won't work for most Americans. I do prefer the UK airport security that I have actually experienced to the average/now normal USA airport Security Theatre. Personally I prefer British Airways to any USA airline I have ever flown.
If you think BA is a good airline, you should fly someone like Singapore.
Re: (Score:2)
Not to sound like a /. shill, but I've given up on flights that are to major cities less than 500 miles from where
My math goes something like this:
Min door-to-door flight time is usually 45 min to airport, 45 min from airport, 30 min+ for security & bag check, 1hr safety margin, 15-30 min taxiing, plus flight time.
That's 3-4 hours+ (~200 mile drive) just dealing with the hassles surrounding air travel. Add another 50 miles driven for every hour you spend in the air.
Then, I personally am willing to deal with another hour or two of driving (+100mi) because I don't have to worry about transportation once I get where I
Re: (Score:1)
Re: (Score:3)
If you altered someones reservations how lucrative would it be? What are the chances of getting caught? Is it worth the possibility of a long jail term for wire fraud?
Difficult to do for financial gain, but also quite difficult to get caught.
The security of GDSs (Global Distribution Systems) is archaic. To access my booking and make changes all you need to know is my six character booking number and surname. Realistically you can socially engineer the booking reference from the airline just by knowing my name.
Most airlines rely on two external methods to fix this. PCI, which is useless as I can pay with a different card and notifying the user which is the strongest
Re: (Score:2)
Take the bus? But that might be limiting.
How Bob that sounds great. Can you met up on the east coast today so we can close this contract and make millions before a competitor shows up?
A bus is too much too lose. Yes, that was one such crazy scenario, but in business traveling there is a reason CEO's love their corporate jets. Not just to show off but in business many things are deadline driven and very quick access can make you or break you in a complex world
Re: (Score:2)
Too slow. I wished we had fully working t(rans/ele)porters now. Cars, planes, etc. are too slow. I hate waiting and long commutes. :P I wished Concord was still around too.
Re:Fixing this is too expensive (Score:5, Informative)
The problem is too expensive to fix, but not for the reason you mentioned.
Many passengers struggle with flying, due to inexperience, carelessness, distractions, or fear of flying, or they lack the mental capacity to understand everything they need to do. These people need the simplest possible way to access their flight info. That means helping them as much as possible by printing the booking code on the luggage tags, flight coupons, boarding passes, everything.
So far, it's much cheaper to accept the risk of a few people messing with the flight info, rather than dealing with millions of scared, confused, and/or angry travelers stuck in an unplanned layover because they didn't have the ability to access their connecting flight information.
That could change if someone figures out how to monetize this hack safely, but that's very unlikely. The booking code isn't the only security measure in place. The hackers can change a flight, but a passenger complaining at a gate will win out over an online change; anyone attempting to cash in on the fraudulently changed ticket risks felony theft and fraud charges.
Re: (Score:2)
Re: (Score:3)
Well, the most straightforward way is to book a ticket for yourself; but that obviously leads back to you, which is probably why fixing this isn't a top priority.
That said, the ability to work malice and mischief has value to some. And in some cases that could have economic value (e.g. making sure key people from your competitors don't make it to a critical meeting).
Re: (Score:2)
Actually, as smartphones get more ubiquitous and even dumbphones gain more capabilities, the cost of fixing the problem should drop--we're already seeing a shift towards electronic ticketing, how much more effort would be needed to simply have it set up so you can have your phone self-update with the connecting flight information as you go, so it'll be up-to-date and you will know things like "Oh, hey, my connecting flight changed" as soon as possible.
Maybe (Score:2, Insightful)
Because for some strange reason, once we try doing something on the internet, possibly the most insecure and interference pronemethod of doing anything, we forget how millions of us use to fly all of the time, without these sort of problems.
Re: (Score:2)
Was it as easy as changing previously posted Slashdot headlines?
Re: Maybe (Score:1)
I don't know how people booked travel before the Internet, but let's speculate.
They used phones, perhaps? Also insecure, authentication was probably pretty much as bad as it is today. Went to speak with a travel agent in person? The travel agent could check ID, but did they? And then they would have to call or otherwise contact the airline on the traveler's behalf.
Only dealing directly with the airline, in person, could be considered secure, and that is if they always request ID.
The truth is, there's little
Re: (Score:2)
I don't know how people booked travel before the Internet, but let's speculate.
They used phones, perhaps? Also insecure, authentication was probably pretty much as bad as it is today. Went to speak with a travel agent in person? The travel agent could check ID, but did they? And then they would have to call or otherwise contact the airline on the traveler's behalf.
Sounds pretty damn hard. Yes, Either my staff assistant, or myself spoke to our travel agent, who knew us. When I'd travel for work, we had an authorization number so no changes happened without that number and a number that replaced it.
Only the "screwing with a person's travel plans" scenario seems likely to me, and that takes some pretty serious or specific motivation.
But still a good illustration of people forgetting how to do stuff once we take it to the intertoobz.
Re: (Score:2)
More secure, but an awful process.
Re: (Score:2)
No, the security was in the ticket stock. You needed an actual, magnetically coded ticket to board the plane. More secure, but an awful process.
Gotta say, I never gave it a thought about how awful it was. I enjoyed getting out of the office for a bit, and chatting with the people at the travel agency. The internet has changed us, and normal and easy things are now much too much trouble. If we can't just click clicky, it is a burden too far.
Well okay then. We have to have no effort on a system that is insecure by design. I guess we put up with what happens to us then, and quite willingly in fact.
Re: (Score:2)
Just maybe, we might just sorta think about how we could not even book flights until the intertoobz came along. All of those jets sitting on the runwaysnot in use because without the internet, there was absolutely no way to reserve a flight. Sarcasm much intended.
Because for some strange reason, once we try doing something on the internet, possibly the most insecure and interference pronemethod of doing anything, we forget how millions of us use to fly all of the time, without these sort of problems.
I also remember getting ripped off.
Travel agents are going the way of the VCR rental store and good riddance.
Re: (Score:2)
Just maybe, we might just sorta think about how we could not even book flights until the intertoobz came along. All of those jets sitting on the runwaysnot in use because without the internet, there was absolutely no way to reserve a flight. Sarcasm much intended.
Look at the history of airfare (chart [aei.org] or article [theatlantic.com]and before the internet, flying also cost twice as much (even after adding in the dreaded "fees" for shit that most people don't need) and was far less accessible to people of modest means. When people talk about how dignified air service was in the 70s, what they usually meant is that poor people weren't flying.
Of course the internet isn't responsible for the entire drop in prices. But the direct-booking (vs paying travel agents for working the system) and fa
Re: (Score:2)
(1) More room for your legs
(2) Fewer seats per plane
(3) Higher ticket prices
What do these three things have in common?
Re: (Score:2)
So the Int
Re: (Score:2)
Pretty much agreed.
To be fair though, from 1996 to the present, oil went up considerably (and then recently dropped back down) and so the decline in prices in the face of rising costs (gas is 30% of the total bill) is actually fairly impressive.
Also Southwest :-)
Easier when they are stupid... (Score:2)
I had someone use my email address to get the confirmation for the out and return flights for himself and his partner.
I have a gmail address, which I got back in the time when it was still invitation only, which I set up as my initial and last name @gmail.com. This person with the same initial (but different first name) and same last name decided that my email address must be his, so he used it when booking his tickets. Normally I just delete these emails, as this guy was the 4th person who has made the sam
Re: (Score:2)
That's when you hope that they are going to someplace that has the same name in places such as Sydney, Australia and Sydney, Nova Scotia, Canada. Then you just send them to one of them. For example, instead of Boston, Mass send them to Boston, Kentucky.
Re: (Score:2)
Since it never involves talking to a person, isn't it anti-social engineering?
Wonderful Security (Score:1)
Interesting .... but .... (Score:2)
Again, at least *some* of this strikes me as cases of, "Sure...the technology may let you do it, but you're still creating a trail to get caught!"
I mean, ok --- the relatively weak security might let me log in to a web portal and cancel a guy's flight. But if that's a flexible ticket (the most expensive kind) that lets me reschedule it under another name? Don't you think he might *notice* that happened? And when they investigate, it wouldn't be too tough to figure out who DID use that rescheduled flight.
I'
Sales/Corporate sabatage (Score:2)
I can assholes screwing competitors out of contracts and sales opportunities by making sure the other guy doesn't show up for the pitch.
Surprisingly I heard of crazy stuff including geeks taking down wifi hotspots when a competitor comes in for a sale on the road etc.