One of the comforts the internet has brought us is the fact that we can book flights anywhere and anytime and even choose where we want to sit on that flight. But like every online process, even your flight bookings could be subject to hacking.
Researchers Karstein Nohl and Nemanja Nikodejevic from German security firm Security Research Labs published just how easy it is to break into travel booking systems. The report noted that the three largest Global Distributed Systems (GDS) handling such reservations are vulnerable. “Today’s GDSs go back to the 70s and 80s, built around mainframe computers and leased lines. The systems have since been interwoven with web services, but still lack several web security best practices.” Amadeus, Sabre, and Travelport according to the report handle over 90 percent of global flight reservations and their set up dates back to the 70s.
Codes such as the one circled above can be used by hackers to get your personal data
So here’s the challenge. Each time you book a flight you are given a unique six digit code which is also knows as a PNR (Passenger Name Record) which is printed on your boarding pass. It’s so public that just about anyone can get a snapshot and if it’s a hacker, they can access all of your personal information including your home address and bank card number, frequent flyer number and IP address used in booking the ticket among others.
With respect to authentication, the researchers said the GDS and airline websites don’t even limit the number of times you can check codes and this means hackers don’t even need to employ brute force to run through the database in order to dig out valid codes. “While the rest of the Internet is debating which second and third factors to use, GDSs do not offer a first authentication factor. Instead, the booking code (aka PNR Locator, a 6-digit alphanumeric string such as 8EI29V) is used to access and change travelers’ information.”
Perhaps the worst part of this it is that these unique codes are serially assigned thereby making it much easier for hackers to locate just about anyone’s information they wish.
To protect yourself, the best shot you’ve got is to not reveal the PNR on your tickets to anyone. The other thing GDS can do is upgrade their entire system to meet modern day threats and probably do away with the six digit codes they currently give. If you think this is not a big deal, then maybe imagine a scenario where you get to the airport only to find out that that your flight booking has just been canceled.
Paul Balo is the founder of TechBooky and a highly skilled wireless communications professional with a strong background in cloud computing, offering extensive experience in designing, implementing, and managing wireless communication systems.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behaviour or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
