Forest Global Training Partners

Cyber Risks · Krebs on Security

Why It’s Still A Bad Idea to Post or Trash Your Airline Boarding Pass

Summary: A talk at a Czech security conference by researcher Michal Špaček showed that a friend's British Airways boarding pass posted to Instagram let him log in to the passenger reservations page using the six-digit booking code and last name printed on the front, then cancel future flights and view or edit passport number, citizenship, expiration date and date of birth. Krebs notes a 2015 search of Instagram for "boarding pass" returned more than 91,000 results, and that United Airlines treats Mileage Plus numbers as secret access codes even though the full number is recoverable by decoding the barcode on any United boarding pass.

What's compelling: The six-digit PNR functions as a temporary password that airlines print on every luggage tag and inside every boarding pass barcode, and researcher Karsten Nohl showed some third-party travel sites let automated programs brute-force a targeted customer's PNR by submitting the same last name repeatedly. A single photo posted before or during a trip can expose future travel, passport data, and linked frequent flyer accounts at other airlines through code-sharing agreements.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related