Major Security Breach Discovered Affecting Nearly Half of All Airline Travelers Worldwide

guest · Jan 15, 2019

Major Security Breach Discovered Affecting Nearly Half of All Airline Travelers Worldwide
January 15, 2019
https://www.safetydetective.com/blo...arly-half-of-all-airline-travelers-worldwide/

While booking a flight with Israeli national carrier ELAL, he came across a significant security breach that allows anyone to access and change private information on flight bookings.
The same breach was then discovered to include 44% of the international carriers market, potentially affecting tens of millions of travelers.

According to ELAL, the bug stems from their supplier Amadeus’ online booking system [...]
While booking a flight with ELAL, we received the following link to check our PNR: https://fly.elal.co.il/LOTS-OF-NUMBERS-HERE.

Though the security breach requires knowledge of the PNR code, ELAL sends these codes via unencrypted email, and many people even share them on Facebook or Instagram. But that’s just the tip of the iceberg.
After running a small and non-threatening script to check for any brute-force protections, none of which were found, we were able to find PNRs of random customers, which included all of their personal information.
Click to expand...

When contacted about the breach, Amadeus provided the following statement:

“At Amadeus, we give security the highest priority and are constantly monitoring and updating our systems. Our technical teams took immediate action and we can now confirm that the issue is solved. To further strengthen security, we have added a Recovery PTR to prevent a malicious user from accessing travelers’ personal information. We regret any inconvenience this situation might have caused.”
Click to expand...

hawki · Jan 15, 2019

mood said: ↑

Major Security Breach Discovered Affecting Nearly Half of All Airline Travelers Worldwide

"At Amadeus, we give security the highest priority and are constantly monitoring and updating our systems. Our technical teams took immediate action and we can now confirm that the issue is solved. To further strengthen security, we have added a Recovery PTR to prevent a malicious user from accessing travelers’ personal information. We regret any inconvenience this situation might have caused.”
Click to expand...

= oOps

Log in or Sign up

Major Security Breach Discovered Affecting Nearly Half of All Airline Travelers Worldwide

guest Guest

hawki Registered Member

Log in or Sign up

Major Security Breach Discovered Affecting Nearly Half of All Airline Travelers Worldwide

guest Guest

hawki Registered Member

Useful Searches