[deleted]
Tell HN: Alaska Airlines website exposes passenger data
11–20 of 47 posts
Re: Tell HN: Alaska Airlines website exposes passenger data
#12Earlier quoted context omitted.
Or perhaps a caching issue?
I'm going to go with caching issues + interactions with Sabre backend. Also, did you know that your confirmation code, aka record locator is not globally unique? They are 6-character sequences like KZVGX5, so as you might imagine with the number for passengers flying, it doesn't take long to exhaust the namespace.
A PNR is not supposed to be unique. It literally is a record, that is tied to the airline ticket stock code (first three digits of a ticket number) and booking system (Sabre/amadeus) until recently a gds was not able to query one or the other (and yeah there are more, even ticketless/couponless ones)
Thats why you are required to have two to verify, ticket number or last name but in old old systems you always used the ticket number as that had all the passenger information, coupon status, route, etc the PNR is just a shortcut to facilitate this.
Re: Tell HN: Alaska Airlines website exposes passenger data
#13They have a bug. Serious one, yes, but they listened and gave you points for reporting it. Seems to me at least the support staff are trying (even if they aren't quite able to get it fixed).
I don't think it's realistic to expect airline support staff to know how to properly classify and route web vulnerabilities. Giving someone points is just a way to get them to go away so the ticket can be closed.
Re: Tell HN: Alaska Airlines website exposes passenger data
#14Earlier quoted context omitted.
I'm going to go with caching issues + interactions with Sabre backend. Also, did you know that your confirmation code, aka record locator is not globally unique? They are 6-character sequences like KZVGX5, so as you might imagine with the number for passengers flying, it doesn't take long to exhaust the namespace.
Alaska uses 6 letters. 26^6 is a bit over 300 million codes. Each year there are about 5 billion air passenger boardings, so while the whole of aviation runs through that space every 3 weeks, any individual airline takes much longer.
Each record locator is unique not by airline but for gds, in this case Sabre. Each record locator reference a reservation which may include many flights and people that fligth together in a trip. And a reservation is done 1 year in advance. It’s not a easy math
Re: Tell HN: Alaska Airlines website exposes passenger data
#15Support won't know what to do. Have you tried their cybersec form? https://www.alaskaair.com/content/about-us/site-info/report-...
Thanks! Just did. I didn't think of it the first time given they escalated me to someone who then asked me to verify the information I had just told them over email. Maybe this will get their attention.
Cyber or the executive offices, corporate. More responsive and better perks for you.
Actually call if possible.
Re: Tell HN: Alaska Airlines website exposes passenger data
#16load balancer / caching issues
Re: Tell HN: Alaska Airlines website exposes passenger data
#17>I'll refrain from posting it here so it's not as easy to exploit.
I commend your ethics, but I'm going to be straight with you: Alaska isn't going to do anything until tangible harm and damage occurs. The cost to address the problem is higher than the cost to just ignore it. Alaska probably won't think this even is a problem yet, for that matter.
If you still want to be an unwarranted gentleman, I would report this again but put a firm deadline to disclosure and say "No" is not an answer. Also have a lawyer handy if you choose to make this a problem for them.
Re: Tell HN: Alaska Airlines website exposes passenger data
#18Earlier quoted context omitted.
Or perhaps a caching issue?
I'm going to go with caching issues + interactions with Sabre backend. Also, did you know that your confirmation code, aka record locator is not globally unique? They are 6-character sequences like KZVGX5, so as you might imagine with the number for passengers flying, it doesn't take long to exhaust the namespace.
Originally the PNR when the reservation systems where built in the 1960’s and 70’s the six / seven / eight digit reference was the hash of the physical location in memory of the booking. It would take very few cpu cycles to recall the booking.
Nowadays of course the booking reference is virtual.
Re: Tell HN: Alaska Airlines website exposes passenger data
#19>I'll refrain from posting it here so it's not as easy to exploit. I commend your ethics, but I'm going to be straight with you: Alaska isn't going to do anything until tangible harm and damage occurs. The cost to address the problem is higher than the cost to just ignore it. Alaska probably won't think this even is a problem yet, for that matter. If you still want to be an unwarranted gentleman, I would report this…
Do you have prior experience reporting to them, or why do you believe this to be the case?
(I'm not affiliated with them, just an occasional customer who's wondering if they have a bad reputation in this regard or something.)
Re: Tell HN: Alaska Airlines website exposes passenger data
#20They have a bug. Serious one, yes, but they listened and gave you points for reporting it. Seems to me at least the support staff are trying (even if they aren't quite able to get it fixed).
I don't think it's realistic to expect airline support staff to know how to properly classify and route web vulnerabilities. Giving someone points is just a way to get them to go away so the ticket can be closed.
I disagree. Even support staff should be able to say "oh wow, this is really bad, let me get my supervisor", who would then recursively escalate until they get to someone who can open the correct ticket.