Researcher Describes Risks Posed by Posting Boarding Passes

guest · Sep 17, 2020

Researcher Describes Risks Posed by Posting Boarding Passes
Former Australian PM's Instagram Shot Led to Personal Data
September 17, 2020
https://www.inforisktoday.com/researcher-describes-risks-posed-by-posting-boarding-passes-a-15008

An Instagram post by one of Australia's former prime ministers led to a security researcher finding his passport and phone number due to a coding error in a widely used airline ticketing system.

On Wednesday, an Australian computer security researcher who goes by the name Alex posted a humorous yarn about how a friend pointed out that Tony Abbott had posted a photo online of his business-class boarding pass and baggage receipt for a Qantas flight from Tokyo to Sydney on March 21.
Click to expand...

Alex writes on his blog that his friend said: "Can you hack this, man?" Alex took the challenge.

"People post their boarding passes all the time because it's not clear that they're meant to be secret," Alex writes.
Inspecting Code
Experts have pointed out that bar codes and other data on a boarding pass can lead to information leaks and have advised against posting the data. But it still happens frequently, and as Alex notes, puts people at risk of identity theft schemes. [...]
Click to expand...

Qantas advised him that its "standard advice to customers is not to post pictures of the boarding pass, or to at least obscure the key personal information if they do, because of the detail it contains."
Still, Alex says he couldn't find any kind of advice like that on Qantas' website, and boarding passes don't have warnings not to post photos of the documents on social media.
Click to expand...

When you browse Instagram and find former Australian Prime Minister Tony Abbott's passport number

Wait no what the heck did I just read
Yeah look, reasonable.
tl; dr
Your boarding pass for a flight can sometimes be used to get your passport number. Don’t post your boarding pass or baggage receipt online, keep it as secret as your passport.
How it works
The Booking Reference on the boarding pass can be used to log in to the airline’s “Manage Booking” page, which sometimes contains the passport number, depending on the airline. I saw that Tony Abbott had posted a photo of his boarding pass on Instagram, and used it to get his passport details, phone number, and internal messages between Qantas flight staff about his flight booking.
Click to expand...

Log in or Sign up

Researcher Describes Risks Posed by Posting Boarding Passes

guest Guest

Log in or Sign up

Researcher Describes Risks Posed by Posting Boarding Passes

guest Guest

Useful Searches