Why Its Still A Bad Idea to Post or Trash Your Airline Boarding Pass Krebs on Security. An October 2. 01. One reason may be that the advice remains timely and relevant A talk recently given at a Czech security conference advances that research and offers several reminders of how being careless with your boarding pass could jeopardize your privacy or even cause trip disruptions down the road. In Whats In a Boarding Pass Barcode A Lot, Krebs. On. Security told the story of a reader whose friend posted a picture of a boarding pass on Facebook. The reader was able to use the airlines Web site combined with data printed on the boarding pass to discover additional information about his friend. That data included details of future travel, the ability to alter or cancel upcoming flights, and a key component need to access the travelers frequent flyer account. A search on Instagram for boarding pass returned 9. Radiofrequency identification RFID uses electromagnetic fields to automatically identify and track tags attached to objects. The tags contain electronically stored. The United States Postal Service awarded Advanced Facer CancellerRemote Computer Reader system upgrade Lockheed Martin Corporation, Owego, New York. JetBlue responded first, but merely pointed me to their baggage policies listed on their website. Turns out they have specific rules for everything. RFID Canada. With 25 plus years of industry knowledge and understanding the development of specialized solutions for Read More. Security Products Manufacturers Source for Security Products Manufacturers Suppliers Choose Verified Security Products Suppliers. Footnotes Ann II Annex IV Annex III Annex II Annex Ia Ib 1 Directive 200418EC except for rail transport services covered by Category 18 of CPC prov. Barcode Reader Software For Baggage Tags For AirlinesBar Code Primer Introduction to Barcoding from Worth Data Understand bar codes so that you can better plan for your bar coding applications. CAVC/image/2016/05/16x9/640x360/Hand_held_scanner.574e097890548.jpg' alt='Barcode Reader Software For Baggage Tags Template' title='Barcode Reader Software For Baggage Tags Template' />More recently, security researcher Michal paek gave a talk at a conference in the Czech Republic in which he explained how a few details gleaned from a picture of a friends boarding pass posted online give him the ability to view passport information on his friend via the airlines Web site, and to change the password for another friends United Airlines frequent flyer account. Working from a British Airways boarding pass that a friend posted to Instagram, paek found he could log in to the airlines passenger reservations page using the six digit booking code a. PNR or passenger name record and the last name of the passenger both are displayed on the front of the BA boarding pass. Fighter Plane Game Free Download Full Version. Once inside his friends account, paek saw he could cancel future flights, and view or edit his friends passport number, citizenship, expiration date and date of birth. In my 2. 01. 5 story, I showed how this exact technique permitted access to the same information on Lufthansa customers this still appears to be the case. QR codes online, noting there are several barcode scanning apps and Web sites that can extract text data stored in bar codes and QR codes. Boarding pass bar codes and QR codes usually contain all of the data shown on the front of a boarding pass, and some boarding pass barcodes actually conceal even more personal information than whats printed on the boarding pass. As I noted back in 2. United Airlines treats its customers frequent flyer numbers as secret access codes. For example, if youre looking for your United Mileage Plus number, and you dont have the original document or member card they mailed to you, good luck finding this information in your email correspondence with the company. When United does include this code in correspondence, all but the last three characters are replaced with asterisks. The same is true with Uniteds boarding passes. However, the customers full Mileage Plus number is available if you take the time to decode the barcode on any United boarding pass. Until very recently, if you knew the Mileage Plus number and last name of a United customer, you would have been able to reset their frequent flyer account password simply by guessing the multiple choice answer to two secret questions about the customer. However, United has since added a third step requiring the customer to click a link in an email that gets generated when someone successfully guesses the multiple choice answers to the two secret questions. Its crazy how many people post pictures of their boarding pass on various social networking sites, often before andor during their existing trip. A search on Instagram for the term boarding pass, for example, returned more than 9. Not all of those images include the full barcode or boarding record locator, but plenty enough do and thats just one social network. For anyone interested in how much of todays airline industry still relies on security by obscurity, check out this excellent talk from last years Chaos Communication Congress CCC in Berlin by security researchers Karsten Nohl and Nemanja Nikodijevic. Nohl notes that the six digit booking code or PNR is essentially a temporary password issued by airlines that is then summarily printed on all luggage tags and inside all boarding pass barcodes. You would imagine that if they treat it as a password equivalent then they would keep it secret like a password, Nohl said. Only, they dont, but rather print it on everything you get from the airline. For instance, on every piece of luggage you have your last name and the six digit PNR code. In his talk, Nohl showed how these PNRs are used in code sharing agreements between and among airlines, meaning that gaining access to someone elses frequent flyer account may reveal information associated with that customers accounts at other airlines. Nohl and his co presenter also demonstrated how some third party travel sites do little to prevent automated programs from rapidly submitting the same last name and changing the PNR, essentially letting an attacker brute force a targeted customers PNR. My advice Avoid the temptation to brag online about that upcoming trip or vacation. Thieves looking to rob someone in your area will be delighted to see this kind of information posted online. Dont post online pictures of your boarding pass or anything else with a barcode in it e. Instagram for concert tickets. Finally, avoid leaving your boarding pass in the trash at the airport or tucked into that seat back pocket in front of you before deplaning. Instead, bring it home and shred it. Better still, dont get a paper boarding pass at all use a mobile. Tags boarding pass barcode, boarding pass hacking, British Airways, Lufthansa, Michal paek, United Airlines. This entry was posted on Thursday, August 2. Other. You can follow any comments to this entry through the RSS 2. Both comments and pings are currently closed.