Live data from Hacker News

Hacking the largest airline and hotel rewards platform (2023)

samcurry.net

41–50 of 122 posts

Re: Hacking the largest airline and hotel rewards platform (2023)

#41
This is only tangentially related but it always blows my mind how insecure airline booking portals are. For many (most?) airlines all you need is the booking reference (PNR number) and surname to log in and see flight itinerary, contact details and, in some cases, change or cancel the booking. No password or MFA needed.

The kicker is that your PNR number and surname are encoded in the barcode on your boarding pass, easily scannable with a phone app. If you ever post a boarding pass online you're unintentionally doxxing yourself and potentially letting people screw with your flights.

I've seen celebrities do this, and during the Cloudstrike outage one tech CEO posted his handwritten boarding pass on Twitter with the PNR in full view.

https://krebsonsecurity.com/2017/08/why-its-still-a-bad-idea...

Re: Hacking the largest airline and hotel rewards platform (2023)

#43

This is only tangentially related but it always blows my mind how insecure airline booking portals are. For many (most?) airlines all you need is the booking reference (PNR number) and surname to log in and see flight itinerary, contact details and, in some cases, change or cancel the booking. No password or MFA needed. The kicker is that your PNR number and surname are encoded in the barcode on your boarding pass, e…

Maybe it was after boarding the flight? I still find it convenient . It's not that hard to keep the PNR number and surname. The reason it's so open is that there's an Identity check at the next stage where you can't use them if you're faking.

Re: Hacking the largest airline and hotel rewards platform (2023)

#44
post #6

> On May 2nd, 2023, we identified that the Flask session secret for the points.com global administration website used to manage all airline tenant and customer accounts was the word "secret". After discovering this vulnerability, we were able to resign our session cookies with full super administrator permissions. Seriously?

This is way more common than you'd like, here's a scenario where it can happen even without outright incompetence: Someone (or some AI) copies an example auth implementation from stackoverflow. Being sensible they realise they shouldn't put key material in source code either, so they leave "secret" in place, and pop a ticket in JIRA to update with the key material from the vault before it goes live. Employee falls il…

[deleted]

Re: Hacking the largest airline and hotel rewards platform (2023)

#46
post #38
post #3

I’m really impressed at the number of times they say their counterparts responded to their report in under an hour, immediately took the affected site offline, then resolved the issue quickly. That seems like an enviable operation.

It's a strange disconnect between the quality of the incident response and the extremely basic nature of many of the bugs reported. I mean SECRET_KEY='secret'?! Seriously straightforward stuff.

Why? One depends on development practices, the other on security-team practices. You can have a team of donkeys building a product and the sharpest hackers guarding it. Ideally best practices would trickle down, but that's not a given.

Re: Hacking the largest airline and hotel rewards platform (2023)

#47
post #6

> On May 2nd, 2023, we identified that the Flask session secret for the points.com global administration website used to manage all airline tenant and customer accounts was the word "secret". After discovering this vulnerability, we were able to resign our session cookies with full super administrator permissions. Seriously?

This is way more common than you'd like, here's a scenario where it can happen even without outright incompetence: Someone (or some AI) copies an example auth implementation from stackoverflow. Being sensible they realise they shouldn't put key material in source code either, so they leave "secret" in place, and pop a ticket in JIRA to update with the key material from the vault before it goes live. Employee falls il…

Then imagine how often this happens without the "sensible employee" and "pop a ticket in JIRA" parts.

Re: Hacking the largest airline and hotel rewards platform (2023)

#48
post #11
post #7

Earlier quoted context omitted.

Can you provide a link or two so one could read up on what you've mentioned in your post?

A lot of the knowledge is very arcane, and like, split over hundreds and thousands of flyertalk.com pages, and like... institutional knowledge of more clever travel agents. I think a lot of the "fun" that can potentially be had also requires a direct access to a GDS, which, AFAICT is on the order of ~$10k a year? And if your "tricks" are discovered, airlines have a direct way to demand payment for any shenanigans you…

I thought fuel dumping is a thing from the past?

I have been able to save USD 500 with a VPN (booked Aeroflot ticket advertised on Russian google with a Russian IP). I am able to read a little bit Cyrillic so I was able to go through the booking. Citibank then blocked my CC and called me. Did everything again and got the ticket for USD 1000 instead of USD 1500.

Good experience with switching languages on sites. I was able to buy tickets 80% discounted by switching from English to the native language.

Re: Hacking the largest airline and hotel rewards platform (2023)

#49

Earlier quoted context omitted.

This is way more common than you'd like, here's a scenario where it can happen even without outright incompetence: Someone (or some AI) copies an example auth implementation from stackoverflow. Being sensible they realise they shouldn't put key material in source code either, so they leave "secret" in place, and pop a ticket in JIRA to update with the key material from the vault before it goes live. Employee falls il…

Tragedy of the Commons often happens where there are too many developers and unclear functional or concerns ownership. Each concern needs a home, a checklist, a runbook, documentation, a support escalation path, and responsible tech or business owners.

You are redefining "tragedy of the commons" there... TOTC is about overusing shared resources (e.g. too many people helping themselves to a shared plate of food), not about confusing who should do what.

Re: Hacking the largest airline and hotel rewards platform (2023)

#50
post #11
post #7

Earlier quoted context omitted.

Can you provide a link or two so one could read up on what you've mentioned in your post?

A lot of the knowledge is very arcane, and like, split over hundreds and thousands of flyertalk.com pages, and like... institutional knowledge of more clever travel agents. I think a lot of the "fun" that can potentially be had also requires a direct access to a GDS, which, AFAICT is on the order of ~$10k a year? And if your "tricks" are discovered, airlines have a direct way to demand payment for any shenanigans you…

Correct, it's very arcane knowledge.

Revenue manager of any, every airline will catch up to you but some of them are nice. Many are not. :)

Direct access to an GDS can also come way of an OTA, which, may not sanitize input properly, or if you learn how bulk purchasing of tickets happen (e.g. if airline is sold out, but it still shows/bookable by an OTA they have access to bulk ticket fares and can sell - sometimes flights close out on the airline but are bookable to last minute on OTA as well.)

Flyertalk is a great resource, and also, surprisngly the reason why Whatsapp was created too! - But I wasn't being indicitive of that and knowing what a fare code/y/j/whatever class fare is - I meant that sabre/amadeus and the front end of the airline are really "broken", and you can do similar things to what the original article posted, even abusive things like "walk" for tickets to refund to an airline hosted "Wallet" (usually you can attach a PNR and reuse it and rebook a new PNR/Ticket) which can break the chain and require someone at revenue management to really pull the log for that coupon/PNR to see where the money went, or why someone else flew that segment.

You can also double refund - and of course the airline can clawback - if they find out in time. Though many airlines have special gateway relationships w/ banks (as noted by the point system tied to a credit card network) (But this comes down as general fraud.)

The fuel dumping community isn't the only one, the reason they are unfriendly to newcomers is because they think they got a neat trick and they do, and once it hits front page news, that fare/date is dead. But there are other communities similar too - there is the staff travel/non revenue community which flies for free*, buddy passes, companion passes or on Zed90 tickets which is standby travel on OAL, other airlines (though you need to be listed/included on someones benefits.) and travel industry IATA or something - and thats the thing, if you can get access to a GDS and encode fares you may be able to list yourself but these aren't normally commercial fares, but I've seen many times a GDS spit out wrong class, class mismatch, fare/class mismatch, etc that wouldn't be a mistake fare per se, but a misconfiguration or a unsantized input that did this :)

But also, some GDS's are also nto that locked up, you can find some on shodan if you know the right keywords and literally poll someones name to see if they have any active flights, etc. I'm not encouring anyone to go find them, but if you know what to look for, there are many insecure or generally not behind any login page that opens up to a general query and allows reservations and confirmed commercial fares - but that falls down to just poor IT security operations in general vs GDS flaw.

tl;dr All Airlines front end/ecomm site talks to it's own GDS which are cloud hosted but act like 90's shell programs, some/many ecomm front ends are really bad and you can do stuff you shouldn't. It all comes down to your identity and is all tracable which is why many of these flaws still exist, because it's enforcable the other way/tech debt to fix is too much.

And we haven't even got into SSR codes, OSI codes, etc

Post reply on HN