http://shaun.net/2011/05/whats-contained-in-a-boarding-pass-...
http://www.flickr.com/photos/kalleboo/6197243200/
[Update: iNate2000 says cell phone ones are signed. That would make modifying it much more difficult. It also implies printed ones are not signed, which makes that form the the attack vector.]
If you can read PDF417 (Zebra Crossing, the barcode reader for Android, can do it somewhat unreliably if you make your own build and have a good phone camera - otherwise, there are online services that can extract PDF417 from an image) you can see the info for yourself.
And, more importantly, if you can read PDF417, you can make your own!
To connect those machines to a database would both involve a lot of infrastructure build-out (imagine the chaos if that system went down nationwide!) and a lot of information sharing and standardization between airlines and the government. Signing the barcodes is smart, and is how "mobile boarding passes" work, but because paper passes were standardized so long ago, there's no security in place.
I also suspect the current TSA checkpoint barcode readers aren't smart enough to actually check the signature in a mobile boarding pass, but I don't want to find out myself.
But then again, they threw down millions per unit for those back-scatter machines, so all bets are off.....
I'm hoping that the airline industry implementing the smart way to do this (signed information in barcodes) for mobile barcodes means that the eventual rework of paper boarding passes will be intelligent as well, but as you say, all bets really are off...
That won't make a difference until they add the requirement to paper boarding passes (or phase out the paper boarding passes).
And this all begs the question of whether checking IDs does anything for security.