Changing Other People's Flight Bookings Is Just Too Easy

The travel booking systems used by millions of people every day are woefully insecure and lack modern authentication methods. 

This allows attackers to easily modify other people's reservations, cancel their flights and even use the refunds to book tickets for themselves, according a team of researchers who analyzed this online ecosystem.

Karsten Nohl and Nemanja Nikodijevic from Berlin-based consultancy Security Research Labs have spent months investigating the security employed by the Global Distribution Systems (GDSs) that are used by travel agencies, airlines, hotels and car rental companies. They presented their findings recently at the 33rd Chaos Communications Congress in Hamburg.

GDSs are databases that date back to the mainframe era and hold all information about travel bookings such as the traveler's name, travel dates, itinerary, ticket details, phone and email contacts, passport information, credit card numbers, seat numbers and baggage information. All of this data make up the so-called Passenger Name Records (PNRs).

The three major GDS operators in the world are Sabre, Travelport and Amadeus and together they store PNRs for hundreds of millions of travelers at any given time. Any data added or modification made to a booking is stored in their systems and all that's required to access that information is typically a last name and a six-character booking code.

There are multiple access points into these systems and this includes the websites operated by airlines and travel agencies, but also third-party websites like CheckMyTrip. Even if some of them request more information than others to authenticate users, like the first name in addition to the last name, the level of protection for a PNR is ultimately that of the weakest link in the chain.

For example, if a booking includes flights with different airlines, the booking can be accessed and modified through the websites of any of the airlines that operate the different legs of the trip. 

The booking code itself is far from secret. It's printed on luggage tags that most people throw away after each flight, even if their entire trip has not concluded yet, and is also embedded in the QR codes printed on tickets that an alarmingly large number of travellers photograph and post on social media websites, the researchers said.

Many airline and trip checking websites don't put limits on how many bad codes people can enter before they're blocked, which makes them vulnerable to brute force code-guessing attacks. The researchers showed they can find matching booking codes for popular last names within minutes by using automated methods.

GDSs further lower the number of possibilities for these booking codes by using only uppercase letters. One of them doesn't use 1s and 0s at all to avoid confusion with the letters I and O and two of them increase the codes sequentially which can give attacker an idea of what range of codes to search through for a given period of time.

The travel agencies have their own master logins into the GDSs and these accounts have very weak passwords. In one case the password was WS, which stands for web service, followed by the date when the login was created in DDMMYY format. This can easily be brute-force and unfortunately it was one of the most complex travel agency passwords the researchers observed.

In addition to the obvious privacy violation that results from accessing someone else's booking data, attackers can abuse such access for their own gain. For example, they could add their frequent flier number to other people's long-haul flights in order gain the reward miles for themselves. The researchers said that they know for a fact that this technique is already being used.

Attackers could also cancel a flight and if the ticket is flexible, they could use the credit given by the airline to book a different ticket for themselves, the researchers said.

Knowledge of a person's exact traveling plans can also facilitate powerful phishing attacks. Imagine receiving an email from the airline you recently booked your flight with saying that the payment failed and you need to rebook by entering your credit card details again. Most people would probably comply with that request without checking if the email is authentic.

To top it all, there is no logging being done in the GDS databases. And since there's no logging, there's no way to tell who accessed a given record and how much abuse exists in these systems, the researchers said.

The ideal case would be for these systems to start requiring proper passwords for accessing individual PNRs, but that's a very long term goal because all the players in the ecosystem, travel agencies, airlines, hotels, car rental companies, etc., would need to get on board with this change and move at the same pace, Nohl said.

"In the short term, at the very least we should expect websites that give access to travelers' personal information to have the bare minimum of web security, and this includes at the very least some rate limiting," the researcher said. 

"And until passwords and other security measures become common, I think we have a right to know who accesses our records and there must be some accountability, especially knowing how insecure these systems are today."

Computerworld:    Four Threats To Aviation Security & Four Responses:  

Airlines on Defence Amid Cyber Warfare: IATA:

 


 

« America’s Cyber Security Dilemma
Anti-Surveillance Clothing Thwarts Facial Recognition »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

BaseN

BaseN

BaseN is a full stack IoT Operator. We control the full value chain in order to provide ultimate scalability, fault tolerance and security to our customers.

CyberArrow

CyberArrow

CyberArrow (formerly EBDAA) is a consultancy company providing high quality consultancy services in Risk & Compliance and Awareness & Education.

Department of Energy - Cybersecurity, Energy Security, and Emergency Response (CESER)

Department of Energy - Cybersecurity, Energy Security, and Emergency Response (CESER)

The Office of Cybersecurity, Energy Security, and Emergency Response (CESER) addresses the emerging threats of tomorrow while protecting the reliable flow of energy to Americans today.

Grupo CFI

Grupo CFI

Grupo CFI is the largest Spanish network of data protection and cybersecurity professionals.

Tenzir

Tenzir

Tenzir's primary focus lies on network forensics: the systematic investigation of cyber attacks with big data analytics.

Mvine

Mvine

Mvine's primary business is authoring and selling Cyber-Secure Platforms for Collaboration Portals and for Identity Management as well as delivering cloud support services.

TalaTek

TalaTek

TalaTek is a full-service risk management firm providing expert services in risk management, cybersecurity, and compliance.

Edureka

Edureka

Edureka is an online technology training provider with the most effective learning system in the world. We help professionals learn trending technologies for career growth.

LogMeIn

LogMeIn

LogMeIn makes it possible for millions of people and businesses around the globe to do their best work simply and securely—on any device, from any location and at any time.

East Midlands Cyber Resilience Centre (EMCRC)

East Midlands Cyber Resilience Centre (EMCRC)

The East Midlands Cyber Resilience Centre is set up to support and help protect businesses across the region against cyber crime.

Imageware

Imageware

Imageware is a leader in biometric cybersecurity. Protect against costly, damaging ransomware hacks by employing biometric cybersecurity solutions.

SubCom

SubCom

How Much Do You Trust Your Endpoint? With our ‘Habituation Neural Fabric’ based endpoint security platform, you can observe and manage the Trust Score of your endpoints in real-time.

SideChannel

SideChannel

At SideChannel, we match companies with an expert virtual CISO (vCISO), so your organization can assess cyber risk and ensure cybersecurity compliance.

Atlas Cloud

Atlas Cloud

Atlas Cloud is a UK-wide provider of managed services based in Newcastle. Our ‘research-led’ approach to IT services helps leaders make better decisions about IT for their businesses.

Lighthouse IT

Lighthouse IT

At Lighthouse IT, we are focused on delivering seamless and reliable services to unlock the value of technology for your business.

TENEX

TENEX

TENEX is a cybersecurity company leveraging advanced artificial intelligence and human expertise to transform enterprise security.