What’s in a Boarding Pass Barcode? | Hacker News Reader

What’s in a Boarding Pass Barcode?

krebsonsecurity.com

151 pointssnowy56 comments

  Interested in learning what’s in your boarding pass barcode? 
  Take a picture of the barcode with your phone, and upload it to this site.

Woah! We are talking about private information being easily accessed from our boarding passes and there is a passage on uploading it to some site online. Wouldn't that be ill-advised.

I was just about to say the same thing. I'm surprised at this coming from Krebs.

I basically read this as "Worried someone has your credit card information? Enter your credit card number to find out!"

Someone has sorta done that http://ismycreditcardstolen.com/

(Try to submit bogus data to see the results :) )

Krebs has some pretty awesome stuff, but i came here to say this as well. inlitedataresearch.com doesn't seem like the place to do this and while he probably assumes you understand the risks/used a google image instead, it did not flow well.

The barcode is PDF417 and there are phone apps that scan and convert it to text (http://www.pdf417.mobi/) - in case you do not want to send this to some website. I played with it, decoding my own boarding passes, but did not find anything that was not already printed on the pass. Granted there was a lot of abbreviated gibberish which may have been something sensitive.

How exactly is using a random app any safer than using a random website? Or, what other benefit could it have? Both an app and a website are somebody else's code running on your local machine and (often) communicating with a remote server. A random app could just as easily grab your info from the barcode.

Using an app can be safer than a website.

1. If the app doesn't have permissions to use the internet (possibly Android only, although the Android 6 discussion seems to suggest that there's ways round this).

2. If you use the app while disconnected from the internet and ensure that it isn't running when you reconnect.

Neither of those is possible when you upload the image to be parsed online.

Those are both hypothetical that are very far from typical ways that people use apps on their phones.

An app might upload the image to a remote server. A website might parse it locally through JS - maybe disabling your connection, submitting your image, parsing it, then wiping your cached website data would be just as "safe".

The problem is the knee-jerk reaction that "some random website" is dangerous while some random app is not. You have to assume both are equally risky in this situation.

This barcode is normally used as input to ACP (IBM Airline Control Program, also called TPF or z/TPF) in plaintext to a TCP/IP TN3270-based terminal emulator running under Windows (with or without any SSH encryption). But the barcode text is visible to anyone facing the terminal. At least it's how it happened in all my latest flights.

> IBM Airline Control Program, or ACP, was an operating system developed by IBM beginning about 1965.

> TPF evolved from the Airlines Control Program (ACP), a free package developed in the mid-1960s by IBM in association with major North American and European airlines. In 1979, IBM introduced TPF as a replacement for ACP — and as a priced software product.

Holy fuck. I don't want to be the poor guy maintaining code that is likely to be older than himself...

The job security + paycheck might be justified though. Almost guaranteed small team too.

Yeah, I know someone who had a consulting job for some obscure IBM mainframe "thing" and she basically got to do whatever she wanted with an amazing salary because she was one of 3 people in the world who knew anything about it.

That is really "niche", but I wonder how transferable her skills are? in case those IBM mainframes becomes obsolete :-)

They're already very obsolete. Doesn't mean the support contracts will go away though!

There's very good money in being one the very few people in the world whom are really good at "obsolete" things.

TPF, if you're one of the 3-4k people worldwide who still know it, pays very well. Yes, they will be small teams, but in the largest travel companies.

Disclaimer: I could be wrong about the number above, but afaik its in the ballpark.

IBM IMS (Information Management System, predating DB2) failed for some large banks in Australia over the weekend. http://www.smh.com.au/it-pro/business-it/st-george-bank-of-m...

"IBM designed the IMS with Rockwell and Caterpillar starting in 1966 for the Apollo program" "Vern Watts was IMS's chief architect for many years. Watts joined IBM in 1956 and worked at IBM's Silicon Valley development labs until his death on April 4, 2009. He had continuously worked on IMS since the 1960s." https://en.wikipedia.org/wiki/IBM_Information_Management_Sys...

> "IBM designed the IMS with Rockwell and Caterpillar starting in 1966 for the Apollo program"

I've come across IMS before, and I absolutely love this line. This is a database built for the Apollo program by a tractor company. That's a kind of old-school solidity we don't see much anymore (mostly for the better, but still).

Vern Watts was the first IBM Distinguished Engineer, and was responsible for some of the technologies that went into DB2 and other SQL databases. Some info about his career at [1] and [2].

[1] http://www.scaledb.com/vern.php

[2] http://vcwatts.org/

Sadly, that's the reality of most of the travel tech. Lots of legacy software using proprietary protocols running on IBM mainframes.

Some of this old software is indeed very creaky. Look at all the problems associated with merging the Continental and United systems. (Which, from my understanding, still aren't 100% resolved.) However, this old software also needs to touch a huge number of other systems. You're not going to rewrite it in Go using a microservices architecture over a few months.

True, that's why standardization in this area is very important. I'm very optimistic about IATA standards like NDC currently being adopted.

I worked with ACP/TPF in the distant past. All programs were written in S/370 macro assembler. My department tested C, but it was dismissed as too slow, generating code that was too inefficient. But if you are maintaining this software now, you're definitely not poor. Also, I probably wouldn't mind doing that now, it certainly wasn't the worst code I ever encountered, by far.

Makes me wonder what'd happen by fuzzing it. It's probably all fixed length, but the data is probably assumed safe and not escaped. Though I suppose getting access to a system to figure this out would be the hard step.

If it's truly handled as fixed-length then there won't be any need for escaping; that's only a concern when values are embedded into other delimited strings, like SQL.

A lot of these systems definitely predate SQL. Even with SQL, using parameters is the usual way to operate on large amounts of data with fixed queries, and it avoids escaping issues entirely.

I mean escaping as in "the scanned data's FF number is then sent to a shell shell script for crediting the flight". And since it's expected that the data is just 8 alphanumeric chars, it doesn't handle anything else well.

You're right there's ways to do this properly, of course. But in practise, with huge systems, people end up hooking in things here and there and forget at some point eh?

It's worth noting that everything mentioned in the article except the full frequent flyer number is also printed in ASCII on the boarding pass.

Sure, but the frequent flyer number is apparently not well protected:

"Not only could I see this one flight, but I could see ANY future flights that were booked to his frequent flyer number from the Star Alliance.”"

The frequent flyer number seems to be the piece that gives away the keys to the kingdom.

Even if the FF number were not printed on the boarding pass, the booking reference/PNR and surname are generally enough to log in and retrieve the FF number from the booking.

Depends on the airline.

US-based airlines tend to require an actual password to access the account and see future flights, spend miles on redemptions, and so on (I have accounts, currently, with four different US-based carriers, and all of them require a password for account access).

The confirmation code and passenger name are enough to make changes to that reservation, though; if you know someone's code + name you can cancel the return segment of their journey, for example.

I'm wondering if the person being quoted was confused by seeing the return segments of a multi-segment trip (which are part of a single reservation, and would come up with just the information on the boarding pass), and thought it was actually full account access.

  I'm wondering if the person being quoted was confused by seeing the return segments of a multi-segment trip

I wondered that too. I'm a Miles & More member via Swiss (which is part of the Lufthansa group) and you definitely need a password / pin to access your FF account.

Accessing a specific booking via booking code / surname is a whole different issue.

My regular airline is Qantas, which prints the full frequent flyer number on the boarding pass, but not the PNR/booking reference.

Qantas assigns FF numbers sequentially -- mine was in the first million so it's six digits. So any number is associated with someone's account.

Other schemes seem to assign only a tiny fraction of possible codes, which is why my Starwood number is twelve digits long.

I don't see any reason why they should do that.

They've changed - new QFF accounts are something like 10 or 12 digits long. (I'm 7 digits myself.)

Which is not usually the case. At least for Start Alliance members I see my FFN printed on tickets.

But from a social/human perspective: some semi-data-conscious people have been known to upload pictures with only the human readable print redacted, but with the barcode left intact.

Also oome people might tear the boarding pass into many pieces so that name, flight,... can't be associated. But the barcode is relatively small. It might still be readable in one piece.

Virgin Australia prints the PNR and frequent flyer number in plaintext.

I scanned a recent VA boarding pass with a PDF417 scanner, and amongst all the other stuff is 16 characters without an obvious meaning. The boarding pass in the article had a similar region, and another longer one. It would have been interesting for the article to have pulled those apart.

Virgin's security is a joke. Their Flying Club (frequent flyer points) website stores passwords in plaintext! Not to mention the ridiculous restrictions they put on the username / password fields in the first place.

I had tried that before using Mathematica instead of a website and I was also surprised to see the data in the barcode is not really signed in any way. IIRC it was a European low cost like Ryan air, and I thought it was scary that I could have generated the same exact bar code just by knowing my name and the flight.

Of course there is an extra step of validation, because the airline has the passenger list, so you can't just add yourself to a flight.

Cynical me wonders if it's like this on purpose for the benefit of law enforcement. But then again, Hanlon's razor...

In what way would it benefit them?

I think the only purpose that code bar serves is so that the person at the gate doesn't have to strike a line on a printed list.

The boarding pass format spec linked in the article [1] shows the support for signing (page 49, fields 25 onwards)

The boarding pass data is still plaintext as explained, but a signature is appended to validate that the content has not been tempered with, and who generated it.

I think boarding pass signing is mandatory on all U.S. airlines at least but I have no source for that

[1] http://www.iata.org/whatwedo/stb/documents/bcbp_implementati...

Thats like googling your social security number to see if any website is using it. I've done this with range-search however.

Tried it, it was also a isbn number of some book :)

Since the article doesn't actually say - the barcode is PDF417.

Is this the reason why you need to scan your boarding-card if you buy something in the airport? Is it regulation or are these companies data-mining?

Edit: Apparently it has something to do with VAT: http://www.telegraph.co.uk/travel/travelnews/11794109/The-re...

It's probably not VAT-specific and not necessarily done for the advantage of the retailers. At least, I understand the concept of duty-free stores to be that the retailer doesn't have to collect tax, so they can make the customer's overall price lower, and the customer can dodge import tax by either consuming in the airport or being below tax-free value thresholds. On the other hand, in this article one retailer claims it's a "practical impossibility" to have duty-free prices, so maybe they're all gaming the customer.

And even if they have a tax reason to collect boarding passes, I wonder if they are prohibited from doing their own analytics on it. Apparently merchants can with credit card numbers: https://www.quora.com/Can-businesses-use-credit-card-data-fo...

This just reinforced why I use smartphone boarding passes.

From my own testing on the matter I have found that digital boarding passes just encode the same data in a different barcode format.

I think the concern here is what happens if someone finds your paper boarding pass and scans it.

That's less likely to happen with a boarding pass on your phone.

(though in general, the problem of airlines requiring very little information -- all of which is on the boarding pass -- to be able to access an itinerary and make changes or cancel it is somewhat well-known among frequent flyers)

Fair enough, that makes sense. Thanks for the clarification.

So upon the actual boarding process, is the actual flight reservation checked with the name or is it susceptible to fraud?

I can see how fraud can be prevented with this schema, but I wonder if it's implemented.

That's a little irresponsible on the part of airlines.

Reply on news.ycombinator.com