Mostly it's your record locator and frequent flier number, but with that, an attacker can access the ticket record, see your future flights, your email address, and the details of the emergency contacts you'd added to the reservation.
With that info, you can cancel future flights and also get a lot of the info needed to do a PIN or password reset and take control of your account with the airline. Some airlines -- like United -- treat your frequent flier number itself as a secret authentication token, and this data can be read out of the barcode on the boarding-card.
“Besides his name, frequent flyer number and other [personally identifiable information], I was able to get his record locator (a.k.a. “record key” for the Lufthansa flight he was taking that day,” Cory said. “I then proceeded to Lufthansa’s website and using his last name (which was encoded in the barcode) and the record locator was able to get access to his entire account. Not only could I see this one flight, but I could see ANY future flights that were booked to his frequent flyer number from the Star Alliance.”
The access granted by Lufthansa’s site also included his friend’s phone number, and the name of the person who booked the flight. More worrisome, Cory now had the ability to view all future flights tied to that frequent flyer account, change seats for the ticketed passengers, and even cancel any future flights.
What’s in a Boarding Pass Barcode? A Lot
[Brian Krebs/Krebs on Security]
Last week at Defcon, a security researcher named Smea presented their findings on vulnerabilities in the Lovesense Hush, an internet-of-things buttplug that has already been shown to have critical privacy vulnerabilities.
Few states have voting machines that are simultaneously more obviously defective and more ardently defended by the state government than Georgia, where 16-year-old touchscreen systems are prone to reporting ballots cast by 243% of the eligible voters and where gross irregularities in election administration sends voters to the wrong polling places or sends co-habitating husbands […]
Apple's Faceid -- a facial recognition tool that unlocks mobile devices -- has a countermeasure that is designed to prevent attackers from scanning an sleeping/unconscious (or dead) person's face to unlock their phone, by scanning the face for signs of consciousness.
The field of data analytics is growing as fast as the internet itself. Self-driving cars, airline pricing, and huge marketing campaigns are all driven by the insights that data scientists can distill out of vast sums of information. Even with the help of powerful software like Python, it’s a highly skilled position. But those skills […]
If you’re marketing on the web, your Google-fu needs to be strong – and up to date. Without a firm grasp on what drives traffic, you’ll never be able to take the wheel. That’s why even if you know where to put your keywords, a little extra effort goes a long way on any marketer’s […]
Want to keep the dentist away? A little tooth care at morning and night isn’t bad, but it won’t keep the stains from smoking or fried foods at bay for long. If you enjoy your food and want to avoid the consequences, an upgrade from that old analog toothbrush can make a huge difference. Among […]