*33C3 preroll music*
Herald: So many of us traveled to this Congress.
Probably most of us. And we all took
trains, or planes, or… maybe somebody
drove by car. But most took trains and planes.
And have you guys ever wondered about the infrastructure
of those travel booking systems?
Even more interesting, have you ever
thought how secure those systems are?
Karsten Nohl and Nemanja Nikodijevic…
Karsten has a really nice record of security researches.
He had talks about GSM protocols
and last year he had his talk about payment system abuse
which was really interesting.
Together with Nemanja, he will show us his research on travel booking systems.
And probably we will find out how we can get home free.
Please give a really, really warm welcome to Karsten and Nemanja!
*applause*
Karsten Nohl: Thank you very much! Always feels great to be back!
I just today noticed that the first time I was speaking at this conference
is 10 years ago. So 10 years of…
*applause* .. thanks you.
10 years of looking at 10 different legacy systems and finding vulnerabilities
in all of them, so far. A lot of them were around RFIDs, or mobile protocols.
This time we’re looking at something completely different, travel booking
systems. And vulnerabilities in there.
Relative to some of the other talks we’ve been giving, this will have less ‘hacking’
in it. Not because we lost our interest in hacking but because much less hacking
was actually needed to exploit vulnerabilities here. *laughter*
So, sorry for that if you expected a lot of hacking. There’ll be a little bit,
that’s why Nemanja is here, but a little bit less than usual. So we’re
talking about travel systems. And there are 3 main players, or actors
in the commercial travel world. There are those people who provide travelling,
airlines and hotels. There’s those people who help you book them, Expedia,
websites like that or traditional travel agencies. And then there’s brokers
who make sure that whatever is available can be booked through those agents.
So those are really the backbone of travel systems but you don’t really think
about them much, or at least I didn’t before looking into this research.
The systems are very useful, as global systems. In fact, they’re called “global
distribution systems”. And that tells you how old they are. This is before
the internet was there. They go back to the 80ies and 70ies. So there was only
one system that deserved the name of a global distribution system of,
in this case, data. And this was travel system. So it makes sense
to have these systems because, of cause, one seat on an airplane shouldn’t be sold
multiple times, so there needs to be a global inventory somewhere.
Also all airlines should be using just a few systems so that they can do
'codeshare agreements', e.g. so that, again, the same seats on a flight
aren’t booked multiple times. And, consequently, these booking systems,
they maintain three types of information. The first one, you are probably most
aware of, are the prices. Airlines will put their price lists into these systems
for booking sites to fetch. They’re called ‘fares’ in the travel world.
The next important data item in there is ‘availability’. So not everything can be
booked that has a price. There needs to be a seat available at a certain booking class.
And, finally, when somebody does find an available seat to a fare that they want
to purchase that is then converted into a ‘reservation’. So this is after the seat
is taken. You may have seen some of this information before on travel web sites.
Let me just show you the one that I like to use the most. The ‘ita matrix’, has
been bought by Google a few years ago. So you can’t actually book through
here any more. But they maintain the interface for whatever reason. And so,
let’s say you search for a flight to San Francisco from here, at the end
of the year. This, like any other web site will give you plenty of options
from the different airlines. What’s different for this web site is that
they give you a lot more details, if you know where to click.
So the cheapest flight, really cheap actually, 325 bucks to go to San Francisco
for New Year’s, a one-way trip, and what I like on this web site is the rules.
So this is real data, that is kept in one of these GDS systems. And this already
looks like the 70ies, right? *laughter* This would usually be shown on a terminal,
maybe green font on black background, and somebody would read through here,
and I would say, okay, so you wanna book for a certain day, it’s okay, the dates
match, you wanna go on TAP (TP) – Portugal Airlines – so okay, that matches,
and you could also take a few other airlines, and then you have to meet
certain other restrictions, e.g. you can stop over here. So this flight goes
through Lisbon, you can stay in Lisbon for up to 84 hours before flying on
to the U.S. That’d be nice. And then it has all these other rules in here,
e.g. you can not cancel this ticket, right? It’s non-refundable. But you
can change it for a fee. And this goes on and on and on. For just a single fare,
and there’s, of course, tens of thousands of fares available. Now this, you may be
surprised to hear, is the only form in which these fares are available. There
isn’t an XML, there isn’t a web service, this is how the airlines publish them.
And then a web site like Expedia, they have to write a parser for it to be able
to present flight options to you. You may have noticed if you tried to change
or cancel flights they don’t allow that to web sites often. Expedia e.g. doesn’t,
you have to call them. And if you call them they say: “Give me a moment,
I have to read through the fare rules.” So in that case that just didn’t parse
all this information. That’s the first thing that’s kept in these… or maintained
in these large GDS, the booking systems: the fares. The other thing is
the availability. That’s a little bit harder to access through public web sites.
Expert Flyer is probably the best one to use. And availability is important.
If you actually wanted to fly to San Francisco now for New Year’s
we looked at the fare, well, this is Booking Class 'O', this is
always the first letter. And then, if you look at the availability for Booking Class
'O', unfortunately it says ‘C’ for ‘closed’. So they don’t accept any more bookings.
So just because there’s a price available doesn’t mean that anybody can actually
book this flight. And, again, somebody like Expedia would have to now combine all
of these different pieces of information to present a list of flight options for you.
So let’s assume they did that and you did book something. Then, the third data item
is created in one of these GDS. And that’s the 'passenger name record', PNR.
And that looks something like this. Again, you’ll notice the same 70..80ies style.
With lots of private information. Ed Hasbrouck - he is a
privacy advocate in the U.S., probably the loudest voice to ask for more
privacy around travel booking and he was kind enough to make
this available on his web site, for all to see what information is kept. So,
contact information, of course, things like e-mail. This one shows you again
how old these systems are. So they don’t have the ‘@’ character! This is
using a character set from punch cards! And in punch card you had 6 possible
punches per character. So everything here needs to be encoded with a 6-bit character
And there’s no space for ‘@’. So all ancient stuff. But still, a possible
privacy hazard, right? You wouldn’t want anybody to access this kind of information
about yourself. The three main players who run GDS’s – Amadeus, mostly in Europe,
Sabre, mostly in the US, and then there’s Galileo that merged with a few other
things into ‘Travelport’. And Galileo isn’t really so much used by airlines
but it’s more used by travel agencies. And then, often, multiple of these systems
they’re involved in the booking. So let’s say you go through Expedia and you book
an American Airlines flight, the PNR has to be kept in Amadeus as well as Sabre.
So there’s two copies here. Or let’s say you go through a travel agency that’s
connected to Galileo, and you book a flight that has both Lufthansa and
Aeroflot segments it would be kept in all three of them. So this is lots of
redundancy depending on where your flight segments and booking agents come from.
But sufficient to say there are three big companies, who apparently hold on to the
private information of all travelers. Hundreds of millions of records
for each of those systems. And we wanted to find out whether they can sufficiently
protect this information. And there’s, of course, reasons to believe that they can’t.
This is very old technology and it’s unclear whether they ever did any major
security upgrades. But at the same time there’s reasons to believe that they
are very well secured because this PNR data, this very information about travelers
that has been disputed between different governments for a long time, in particular
the U.S. Government, and asking for more and more information since 9/11 in
multiple waves, and the E.U. governments that say: “No, you can’t have more
information than you absolutely need. So they agree politically that, yes, the U.S.
can get information on those travelers going to the U.S. but only certain data
fields, and have to delete them after a few years. So this was years
of negotiation. And you’d imagine that the systems at the forefront of this dispute
they’d be secure enough that, let’s say, we couldn’t access those same information
that even the U.S. Government is supposed to not access. So we set out to answer
this simple question: do these GDS’s, do they have normal, basic security.
Do they constrain access, do they authenticate users well, do they protect
through rate limiting from web attacks, and do they log to be able to detect any
possible type of abuse. We’ll go through each of them to see where those systems
stand. Let’s start with access control. And this is just drawing
from public sources, so, again, Ed Hasbrouck, this privacy advocate
in California, he has been the loudest voice here, saying, there’s overreach by a
lot of players already accessing PNR information. So e.g. if you have a booking,
let’s say a flight booking, anybody who works at this airline can access
your information. But then, if you add, let’s say, a car reservation to the same
booking, anybody who works at the car rental company can also access
let’s say the flight information. And any agent at the booking agency
that you use can access all of this information. And if you keep adding
information all of these people still have access to it. That’s just how these
systems grew over time, but that’s a first indication to me that this certainly
wasn’t built with modern security in mind. Most concerningly
the people working at or for the GDS companies, they have access to everything,
absolutely everything. Including their support stuff, as far as I understand.
So these are external companies that help debug the system, and they
have access to hundreds of millions of people’s private information.
So way too many people have access to way too much information, e.g. if you
did an online booking your IP address is stored there, basically forever,
well, until the flight is over. But any of these people can now access your
IP address, your e-mail address, phone number and all of this.
So definitely that doesn’t seem to be fine-grained access control. But,
as I said earlier, this has been known for a long time and criticized a lot.
Not acted on, though, yet! How about authentication? The picture is actually
even worse for authentication. And I want to distinguish two different cases here.
I wanna distinguish professionals accessing records, so people working
at travel agencies and airlines. And, as a second case I wanna distinguish
travelers accessing their own records, like when you check-in online e.g.,
you access your own record. Professionals, the way they access it, typically, is that
their agency is connected to one of these GDS’s through basically one account.
So an entire agency system, or at least an entire location uses one account.
So years ago somebody typed in some user name and password, and then it’s long been
forgotten because locally they use a different access management.
A few travel agencies were kind enough to help us in this research, and their access
credentials, we saw them using, they’re just terrible. E.g. for one of the big
systems that I won’t name you need the agent ID, so that you can get pretty
easily. And then a password for the web service, so of the modern way of accessing,
this is WS for web service and the date on which the password was created.
So even if you have to brute-force 20 years, how many possible dates
does a single year have? Times 20. This is ridiculously low entropy for an account
that is supposed to protect information of millions of people, if not more.
This is the best authenticator that we found in these systems!
*laughter*
It gets worse with travelers accessing their own information. Because there
they just simply forgot to give you a password, not even a terrible password
like this; there just isn’t one. And what they use instead is the booking code,
‘PNR locator’ it is sometimes called. I call it booking code.
It’s a six-digit code. When you check-in online you need that code.
And you only need that code and your last name. So you’d imagine that,
if they treat it as a password equivalent then they would keep it secret
like a password. Only – they don’t, but rather print it on every piece
that you get from the airline, e.g. on every piece of luggage you have
your last name and a six-digit code. On your boarding pass –
it used to be there, and then it disappeared and then these barcodes
showed up. So it’s inside the barcode. If you decode the barcode there is
your PNR in there. I erased it here, this is still for a valid booking.
*laughter*
So, you have this six-digit codes printed everywhere and you can just find them
on pieces of scrap at the airport. Certainly these tags you find all over,
but also people throwing away their boarding passes when they’re done.
And this is supposed to be the only way of authenticating users. And we’ll
show you in a minute what kind of abuse is possible through that.
But let’s first think about where else you could be able to find these PNR codes.
Could it get any worse than somebody printing your password on a piece of paper
that you throw away at the end of your journey. Of course the internet can make
it worse! And what better technology to worsen the security problem than
Instagram? So on Instagram… *laughter and applause*
So you got all these bookings. And, in fact, there was one guy here, you see, he
actually erased the information. But for one who knows what’s up, everywhere,
there’s a hundred who don’t. And this is really all information you need.
I saw a Lufthansa one just now, where was that? – Here.
So here is a Lufthansa one. This is from today, posted by markycz at Frankfurt.
This is really all you need to get somebody’s…
*laughter and applause*
Let’s see if this works. Yeah, sure enough. So.
*laughter*
'Marky M.' on Instagram is apparently Marketa Mottlova
and this is her booking reference.
*laughter*
I was debating whether or not to show this but you guys are gonna do it anyway
when I’m done with this talk. *laughter*
*cheers and applause*
So a flight today from Munich to Frankfurt and then, on to Seattle.
Let me point out one thing here.
Where did I see the ticket number?
*off camera mumbling on stage*
Just use mine!
It’s AndroidAPKN Oops.
And then let me write down the password.
Okay. Alright.
So what I wanted to point out is that this isn’t even a Lufthansa ticket.
So she checked in with Lufthansa in Frankfurt. But if you look at the
ticket number, 016, that’s a United [Airlines] ticket. And it also includes
flights on Alaska Airlines e.g. So any of these airlines have
full access to this PNR. And many of them will just grant people access to it
if they know the PNR and the last name. As Nemanja will show in a minute,
even if they don’t know that yet. So...
To recap for the moment: airlines give you a six-digit password that they print
on all kinds of pieces of paper and that you will post on Instagram.
Why shouldn’t you, everybody else does, too, apparently. 75,000 people at least
over the last couple of weeks. So the authentication model here is
severely broken, too. And what kind of abuse arises from this?
Of course, you can now use this PNR, log in on Lufthansa as I have just done
or a more generic web site, like Checkmytrip and look up peoples’
contact information at the very least. So there’s always an email address
in there. There’s usually a phone number in there. If in Lufthansa you click on
“I wanna change my booking” probably they’ll ask you for your payment information
and pre-fill the postal address for that. So you get somebody’s postal address
that they used for the booking, passport information, visa information. If you
travel to the U.S. as she does there’s definitely passport information
in the PNR. All of this information is now readily accessible. Now so far
there was zero hacking involved. That’s why we have Nemanja here who will
show you some actual hacking to get even deeper into these systems.
Can we switch the screen?
Nemanja Nikodijevic: So when… *laughter*
When we started this research we needed to find lots of these boking numbers
to see if there is some relation between them. So luckily we didn’t have to
make any bookings that we had to pay because there are web sites like this one
where you can just make a booking and pay it later but you get
the booking reference number at the time. So let’s make some very normal
German name… *laughter* ..looking for someone from Germany.
Actually they check the phone number, so it has to follow the certain form.
Let’s find Germany… from Berlin,
1234567. *laughter*
And then ‘hans@sandiego.com’.
As you can see I tried quite some… *laughter*
So for this one we already got our booking reference number
which is Y56HOY. And this one, in a minute.
Okay, we have to wait a bit. Y5LCF4. So if you notice
they are very close to each other, so they both start with Y5 which means
that they were booked on the same day. Probably because one is on Lufthansa,
the other one is on Air Berlin, there is slight difference. They are not exactly
sequential. But we can say that they are concentrated in a certain range
for a certain day. What we can do now is
we can go to one of our servers. At first
we have to check if checkmytrip works
because I had some issues with the network.
That’s… ooh! *laughter*
This is a bit unexpected. We will have to skip this part
where we actually look for Carmen Sandiego in one of our bookings.
But…
Karsten: Well, this is a side effect of responsible disclosure. So you tell
a company that on this day you’ll do that thing to that web site, and they just
either block the IP ranges here or just took down the web site which they
have done a few times before. What you can do is… – say it again!!
From audience: Can you test the hot spot?
Karsten: Actually, I think the whole web site is turned off.
Nemanja: What we can demonstrate, I think, is that if we go with this booking number,
to Air Berlin web site, and then type last name, “Mueller”.
And actually, because it’s six-bit encoding it has to be “UE”, no Umlauts
allowed. So, “Select all the food!” *laughter and applause*
Let’s see if we can find this flight.
Karsten: The part of the demo that you didn’t show is just brute-forcing
these ranges. If you know which ranges are used in a day you can try them all.
Or at least we did many times. That would then, in theory, give you access
to all of this. And not just in theory, in practice, unless they take down their
entire web site which they knew we were gonna use for this demo.
Nemanja: But on this, for example, if we caught that flight that we wanted to catch…
Karsten: We’ll show it later. But at least the first win for privacy: no information
is leaked through this web site for the rest of this talk, at least!
*laughter and applause*
Can we switch back to the other screen? *ongoing applause*
One thing that you would have noticed had this not just been a flight reservation
but an actual ticket: it would have given you options to rebook it,
to add a frequent flyer number, all of that good stuff. So what’s the abuse potential
here? So far we’ve only talked about privacy intrusion. And privacy intrusion
is bad enough. Imagine somebody is snapping a picture of your luggage,
that person has your email address and your phone number, right there, right then.
But the abuse potential goes much beyond that. For instance, you can fly for free!
You can fly for free using different methods. You can find somebody else’s
booking and just change the date. The ticket… in fact, we can show it
a little bit later. We had prepared for this demo that we are going to find
through a little bit of brute-force that’s a flexible ticket. So you can just change
the date, and change the email address. You just take that flight yourself.
And as the airline checks… compares the ticket and your passport – oftentimes
they do it visually. What they’ll do is they’ll send you a PDF, you change
the name, you take it anyway. But at least in Schengen, in the EU, people don’t even
do that. Let’s say you wanted to take it in your name. You can,
depending on the airline, call them up or even use their web sites to cancel
the ticket, and the issue a refund to you inside the PNR, and then use the money
that’s freed up there to book a new ticket. Some airlines also give you
MCOs – miscellaneous charges orders. Americans will know this very well,
every time you get bumped from a flight they give you an MCO, “sorry, we can’t
fly you home today, you’ll have to go tomorrow, but here is $1,000 towards
a new ticket”. It’s real airline cash. And those same MCOs you can issue
based on flight cancellation. So you cancel somebody else’s ticket and you get
airline money to book your own ticket. And, again, there are no passwords
involved. The only authenticator is this six-digit sequence that people post
on Instagram, print on their boarding passes and that Nemanja should be able
to brute-force on their web sites. What else can you do, once you have somebody’s
PNR? You can change or add a mile number. And some tickets are really attractive
for mile collection. Take a round trip to Australia in 1st class, get 60,000 miles
right there, for one round trip, for one PNR. And that will get you a sweet, free
flight to somewhere nice, or even some voucher for online and offline shopping.
One website that I wish was still working is, of course, this one.
*laughter*
But they shut down business, apparently. Unrelated to this talk.
*laughter and single claps*
So you have access to somebody’s PNR, you can not just stalk them but change
their flights or – which may trigger some curiosity – that flight can be taken twice.
But you can very stealthily add your mile number everywhere, well, a new mile number
matching that name to collect those sweet miles. Now, are all airlines affected
by that? The demo that we didn’t get to show brute-forced for one last name,
Sandiego, all the PNRs for a day. And it quickly found, in fact, a bunch of records.
There’s not just one Sandiego flying that day. But in some airlines they’re
a little bit smarter. For instance American Airlines, the largest airline in the world,
they don’t just want the last name but also the first name. And if you’re
interested in one specific person, let’s say ‘Carmen Sandiego’, you would still
find that person. But if you want to conduct fraud that becomes a little bit
more tricky. A fraudster would just pick a random, very popular last name and
brute-force PNRs there. And that becomes more difficult if also you have to guess
a first name. However, even American Airlines, those records can be accessed
through other web sites. For istance Viewtrip, this is another generic web site like this
infamous Checkmytrip that just went offline. And Viewtrip allows you
to brute-force by just last name and PNR, again. So there’s multiple ways to access
the same information. Some of which are more secured than others. And, of course,
only the weakest link mattered. So Viewtrip, what they would say is
they found the record and they can’t give you access to the information but then
TripCase will which, again, takes only last name and reservation number.
And they will tell you the first name also that then you can type in to
the American Airlines web site again *laughter*
to change the booking, let’s say. So there’s all these different ways to access
a person’s information here. And everybody is slightly different. So let’s look at the
entire universe of travel web sites, starting with just three big travel providers.
Each of them uses six-digit booking codes. But they use these six-digits rather
differently. Sabre e.g. they don’t use any numbers which of course severely impacts
the entropy. But then others, e.g. Amadeus, they don’t use 1 and 0, because that could
be confused with i and o, and then Galileo drops a few other characters. So
at the end of the day none of them really used the entropy of even a six-digit
pass code. All of them are in entropy lower than a randomly chosen 5-digit
password. And we will never recommend anybody to use a 5-digit password, right?
So this is strictly worse. And what makes it even worse, at least for
privacy-intruding attacks, is the sequential nature of these bookings.
You saw the two that Nemanja just now generated. Both of them were from
the same, very small sub set. So if you just wanted to know all the bookings
that a person did today, you can brute-force this in 10 minutes
with a few computers running in parallel. It’s not so easy on Sabre because
they seem to be chosen more randomly. However, Sabre has the lowest entropy,
so if you just randomly want to find bookings for popular last names Sabre is
your system of choice. They’re all weak, but the weaknesses differ in shades of grey
for this privacy intruding and for the financial fraud-type attacks.
As one example, though, of how easy it is to find these booking codes, if you
look up 1,000 just randomly chosen booking codes in Sabre for the last name ‘Smith’
five will come back with current bookings. So half a percent of the entire name space
is filled with current bookings for people called ‘Smith’! Now, add in all the other
last names, their name space must be pretty damn full. And it’s only 300 mio.
records if you calculate the entropy. So it looks like almost every record
is used up and they’re running out of space. So they’ll have to fix this anyway
at some point. But that, of course, makes it all the easier to randomly find and
abuse other people’s bookings. Each of those providers runs a website
that allows you to access all the PNRs in their system if you know the PNR and
the last name. And one German reporter writing about this, he calls the
websites that you didn’t know existed, that you have no use for but that, anyway,
put your privacy at risk. So there doesn’t seem to be any up side to these web sites.
I certainly don’t need to use them but they’re there, and they’re bad.
Because when we did the research none of them had any protection from brute-forcing
meaning we could try 100,000, even millions of different combinations
– PNR and last name – and those websites wouldn’t complain even a bit.
We did expose Amadeus to way more queries that the others and at some point
they did notice, maybe also because some reporters just asked them for comments
on the research. They have tried to improve. So the classic checkmytrip.com
website that was just killed a few days ago – R.I.P., thank you, it’s gone,
50% of the problem solved. But the other website, that was still around up until
literally half an hour ago. What they did over the last couple of days was,
they added a captcha. But the captcha gave you a cookie. And the cookie you could
again use for indefinite number of queries. *laughter*
It’s a company that just hasn’t done web security before. But then they also
limited the number of requests per IP address. Now, we do this from Amazon,
so it’s not so difficult to spawn new IP addresses, but still… it severely
slows us down. About 1.000 requests per IP address. Even if they now took down
checkmytrip for good, of course, this is not the only pass to a reservation.
As we’ve seen before you can just use the provider’s web site directly. And the
popular ones in Germany, they differed in security quite a bit when we checked
a few weeks ago. So Lufthansa itself differed on their different properties.
The standard website asked for a captcha, not the first time, but I think starting
from three requests, so a really good compromise. They make it comfortable
to use for really anybody who just wants to look up their own records. But then
they make it a little bit more painful for somebody who tries to look up
too many. But then the mobile version e.g. didn’t have that captcha. And again,
weakest link principle applies. Air Berlin, they had some rough IP filter,
again, 1.000 requests per IP, that’s a little bit too much, they introduced
a captcha today! So, again, in response to this. This is already showing
some effect. Thank you to checkmytrip and Air Berlin for working on this
over the holidays, much appreciated. Maybe, if you know anybody, thank you!
*applause*
On the other GDS’s the situation is much worse still. They’re still as bruteforceable
as they ever were, as are the web sites. Except for the little bit of first-name
extra complication on American Airlines, every web site we have tried is not protected
from brute-forcing. And this is surprising to me. In my consulting work I have
never seen a web site where not the first pentester ever looking at it would say:
“Oh, you didn’t have rate limiting in it, please add it!” and then, two days later
they had. So for most of this industry that is yet to happen. So no cookie here,
either. Let’s talk about one more abuse scenario that’s… I can say they’re very
relevant but that’s maybe because in my consulting life I’ve been dealing with
human security for the last couple of years, appreciating that technology
is mostly not the weakest link but the the gullibility of people working
in the company. And the same probably goes for travelers. Imagine the scenario where
you made a booking, just a few minutes ago. And now that airline, or at least
it looks like that airline, sends you an e-mail saying “Thank you for making
this reservation, here is all your booking stuff, summarized for you, please update
your credit card information, though. The booking didn’t go through.
I would click on that. I expect them to e-mail me, I know that sometimes
credit cards are fuzzy, I would click on it and enter my credit card information
again. And how is this possible? Of course we can stay ahead of the current pointer
in this sequences and find bookings that were made in the last, let’s say,
half an hour, for popular last names again. And each of those bookings will
point us to an e-mail address, and give us all the context we need to include in this
very, very targeted phishing. If nothing else, I think this should convince
the airline industry to close these loop holes because the evilness of the internet
will not ignore this forever. Phishers are always looking for new targets, and
this will be a very juicy one. So we looked at the three big GDS’s now.
There’s a few other players, e.g. SITA. It looks like on the way out but these two
very big airlines, they still use it. So they’re certainly still relevant. They are
even worse. They use, instead of a six-digit booking code they use five digits.
And one digit is fixed per airline. So if you know you’re looking for Air India
you don’t even have to brute-force that leaving just four digits to go through,
and to brute-force. Now we don’t have a demo for this because we found three
other more fun ones to demo. So… *laughter*
Nemanja will now show you RyanAir, Oman Air and Pakistan International Airlines.
Note that all of these are connected to big GDS systems. So it’s now the web sites
that make it even worse than we already discussed before. And can we switch over
to the other computer again? Thanks.
Nemanja: Yeah, I guess, many people fly with Ryan Air here.
They use Navitaire which is now owned by Amadeus.
So they don’t share the same address space. But on the Ryanair web site you can
either search for the reservation with the e-mail address and the reservation number
or the last four digits of the credit card that you used for booking.
*laughter*
Karsten: Again, great authenticator, right? Ten thousand options.
Nemanja: As they don’t have captcha we can have a look for…
So we know that the last four digits of
Carmen Sandiego’s card are these.
Karsten: And if not we can just try all ten thousand.
Nemanja: We can just try, yeah. We can do the other way around. So this way
we know that… and that it starts with these characters. And let’s try
to brute-force it. In the meantime let’s have a look at the Oman Air.
They ask for the booking reference and for the departure airport. But
departure airport doesn’t have to be just the departure airport but it can also be
any airport that is within the reservation. So for Oman Air we think that it’s
Muscat which is the capital. So usually… most of these slides
go through there. Let’s see if we can find someone who is…
Karsten: And he’s now just trying random booking codes that are valid within
that name space. So, again, they don’t really use the full entropy. So that makes
the search a little bit quicker but other than that it’s just a pure brute-force.
Nemanja: And as there is no captcha as you can see we can go on to the next one.
So this one is the winner!
*laughter*
They trust you that it’s yours! *strong applause*
And let’s see … so we already have one for the Oman Air. Okay. This is the one…
this is where…
Karsten: That was RyanAir, huh?
Nemanja: This is the RyanAir, yeah.
So we didn’t bring these two characters.
But… because we wanted to hide it. If we accidentally hit some booking with that
card number we don’t want to show the booking reference number of someone else.
So it might be even some of the people here. We can try…
Even got one from the Pakistan. Carmen Sandiego is flying from SXF to TSR.
And here we can just enter the… what was the, I think… if I’m right…
Let’s see if this will work. Yeah, okay.
Hello Carmen Sandiego.
Karsten: So now we know where Carmen Sandiego is, finally. The point is,
we made, you can brute-force these web sites rather easily and you don’t really
trigger any alerts there, apparently. Which, again, coming from
an IT security background I find pretty shocking. Can we switch back to
the other screen? Let’s look at the last security feature that we would expect
any IT system to have, these days. Especially knowing that it has been
criticized for lack of IT security for a long time. And that, of course,
is accountability, logging. At least track who’s legitimately or illegitimately
accessing these records. It turns out that it has been asked for a long time
by different people, again most notably Ed Hasbrouck, this privacy advocate,
but also other reporters and other advocates have come across this
for years, saying “there’s rumors that, let’s say, the Department of Homeland
Security in the U.S., they have root access in these GDS’s. Where are the records,
whether they are accessing it or not. Where are the records for abuse by
support stuff in these GDS companies. Where are any records?
The GDS companies have always said, “oh, we can’t keep any records, it’s
not technologically possible.” I call BS on that. They are logging… in the tiniest
minutia, any change to a reservation there’s a log for. And then access log
does not exist? And it’s not technologically possible? I think there’s
a completely different reason behind here. If, in fact, these companies gave access,
unlawful access, or at least in violation of privacy laws in, let’s say,
the E.U. or Canada, if, in fact, they gave that access to other governments
the last thing you want is a trail of evidence showing that people have
access to records. So this has nothing to do with technological restrictions, this is
purely – those companies don’t wanna be in the middle of a debate where probably
some sealed order in the U.S. makes them disclose all this information but laws
in Europe make them not disclose the information. They just don’t wanna have
evidence either way. But that leaves us in a very peculiar position where now
we know that these systems are insecure, use very bad authenticators, expose this
over web sites that can be brute-forced and don’t keep any record of if that
actually happens. So it’s completely unknown how much abuse may be
happening here. I think we can be pretty certain that the flight changes for people
to fly for free, that they are not happening very frequently because that’s
the only one of these attack methods that would leave very clear evidence, somebody
actually complaining, saying “I wanted to take my flight but apparently somebody
else already took it before me, or canceled it and took off with the money.
But the other cases we have no idea whether or not they’re happening.
They’re technologically possible, and nobody seems to be looking for these
abuse patterns. In summary, there’s just three big global databases, two in the U.S.,
one in Europe. They keep all the information on all the travelers.
This information includes your personal contact information, payment information,
your IP address. So lots of stuff that in a lot of other systems we consider
sensitive, private even. And it should be protected with a good password. We would
advise people to use an 8-character or longer password, with special character.
None of that exists here. The passwords here are six-digits. They are less than
five digits at worth of entropy. They’re printed on scraps of paper that you
throw away. They are found on Instagram an they’re brute-forcable through numerous
web sites by the GDS companies and through the travel providers. So this is very,
very far away from even weak internet security. This really predates the internet
in stupidity and insecurity. And while there’s multiple scenarios in which
either privacy of users is at risk or even fraud could happen none of this is even
logged, and nobody knows or has any way of knowing the magnitude to which
these systems are already abused. So what do we need here?
We clearly need more limitations on who can access what. This is not just my ask.
This has been asked for 10 .. 20 years. But more on the technical level,
in a long term, we need passwords for every traveler. You should be able
to post a picture of your boarding pass on Instagram without having to worry
about somebody abusing it. This is a piece of paper that you will throw away.
There should be nothing secret about it. If you wanna share it – feel free to.
Somebody else needs to add a password to make that safe again.
But that’s a very long-term goal. These travel companies, they’re so interwoven,
as we saw today, that all of them really have to move at the same time.
The GDS’s have to do their share. But then each of interconnected airlines has to do
their share. We saw this one random ticket from Instagram, so this was a Lufthansa
ticket with some Alaska Air components issued by United. So at least those three
companies have to work together. And how many more different airlines today have
code-share agreements. So we’re talking about hundreds of companies who have
to come together and decide “we wanna introduce pass codes, passwords”,
whatever you wanna call them, “for each booking”. So that is a long-term goal.
In the short term, though, at the very least we can expect, is for all these
web sites that do give access to travelers’ private information to do the bare minimum
of web security. At the very least some rate limiting. Don’t allow us
to throw millions of requests at your properties, and give us back honest
answers. That is unheard of anywhere else in the “cloud”. But for travel systems
who claim for themselves to be the first cloud ever this seems to be very standard.
And then, finally, until all of this can be guaranteed, until there’s passwords
and until there is good rate limiting I think we have a right to know
who accesses our records, and there must be some accountability. Especially,
knowing how insecure these systems are today. This is a long way, and I can only
hope that we are starting a journey by annoying large companies like Amadeus.
They have done their little bit of fixing over the weekend now, so hopefully
some others will follow suit and we will have better systems. Until then,
of course, I can only encourage all of you to look at more of these travel systems
because there’s plenty more to find. We’re only scratching the surface here.
And, more generally, to look at more legacy systems. I think we’re spending
way too much time making some already really good crypto just a tiny bit better
or finding a really good mobile operating system the next little jailbreak
that will be fixed two days later anyhow ignoring all these huge security issues
that have been there for many, many years in systems that are a little bit less sexy
and riddled with bug bounties than something else that we do spend a lot
of time on. So I hope I could encourage you to do that. I wanna just hand out
a few thankyous to members of our team without whom this research wouldn’t
have been possible, and to a few industry experts who were kind enough to
read over these slides and provide feedback, and help us hopefully
not have any major gaps on our information. And then, to you for
showing up in such great numbers, thank you very much!
*applause*
Herald: Wow, great talk. Thank you very much! We have five minutes
for Q&A. So please line up on the microphones, and we’ll take
some questions. First one!
Question: Do you have any indication of how secure the systems are on the other
end, that the airlines supply their fares into the entire systems?
Is there any indication that those systems might be more secure than
on the customer side? Or would it be easy to inject a cheap fare, e.g.
by impersonating the airline with weak passwords?
Karsten: Honestly, we don’t know. It was definitely on our list to research
but we don’t have time for everything so we focus more on the customer privacy.
But one thing that I really would want to test if I had any way of doing it:
imagine the parsers for these strings. Imagine injecting some special characters
in that. I don’t know who creates these strings and maybe I don’t wanna know.
But if anybody does and you could play with some SQL commands I think a lot of
web sites would wake up understanding that on that front they don’t do enough
security either.
Herald: Okay, question from the Signal Angel?
Signal Angel: A question from IRC. Recently, U.S. Customs And Border Patrols
started collecting social media identifiers for foreign citizens trying to enter
the U.S. on a Visitor Visa. Could that information be accessible through PNR’s?
Karsten: That’s a good question. I don’t think you would be.
From Audience: They are!
Karsten: So, I…
From Audience: Yes, they are!
Karsten: They are in the PNR?
From Audience: Yes!
Karsten: Okay.
*laughter*
I would have imagined that it’s more a case like this journalist,
Cyrus Favia. He requested through FOIA disclosure all the records that
the U.S. Government kept on his travelling. And he found a lot more stuff
than just in the PNR. They had notes in there like “he’s a journalist”, “we had
to search him extra for that”, stuff like that. So they don’t wanna write that
into the PNR. But the Government keeps separate records that may be indexed
by PNR, I don’t know.
Herald: Okay, microphone here!
Question: Can you say something about how long information will be stored
in those travel systems, and whether users have a right to get them deleted?
Karsten: That’s a good question. I think that differs by system. So in Amadeus
records are removed pretty quickly. Days, or at most, weeks after the last flight is
finally done. But in Sabre I had the impression that much older records was
still in there. Which may explain why their data set is so dense. If you keep
accumulating all the information. By the end of the day this is all going back
to mainframe technology. So I don’t think anybody understands these algorithms
any more. They just kind of work.
Question: The deletion?
Karsten: The deletion, yeah. I don’t think you can request anything to be deleted.
I don’t think they consider you a person that they wanna talk to.
You’re not the customer!
Question: Thanks!
Herald: Okay, the microphone there, in the…
Question: It seems that the immediate way to abuse these systems is, like you said,
with abusing money, and the mileage etc. It seems that those paths are actually
somehow monitored by airlines, so if I’m collecting miles and take it not under
my name that would raise some flags. You think that’s not the case?
Karsten: Yes, I should have been more explicit how this attack works,
the mile diversion. So, of course, you have to have an account in the same name
as the person flying. So had his demo worked, he would have a PNR for
a lady Carmen Sandiego. You can just go to miles&more and create an account
under that name. A lot of airlines, though, they also allow you to change your name.
So you just change it whenever you found a round trip Australia ticket,
you change the name to whatever that target name is. And I know for a fact
that people are doing that right now, not you guys, before even. Based on Instagram
photos. So people are diverting miles by creating new accounts or by keeping
changing the names of the accounts. And yes, airlines do sometimes notice this
but only when it becomes excessive. And sure, that’s their money. I just hope
that it will become so excessive that it’s such a big problem that it can’t be
ignored any more. And then the privacy issues get fixed on the same token
where privacy is never enough to convince a big company. But if you throw in
a little bit of fraud it may be enough.
*applause*
Herald: Okay, one last question. Microphone here!
Question: Hi Karsten! When people use like GDS’s they have these really archaic…
there are not even… there are like actual terminals, not even pseudo-terminals.
And then they expose like these EPI’s for the sake of writing your code in like Java
or whatever. I’m wondering if there’s research to be done at that level?
Or did you just not look at that, or that’s just an area of further research?
Karsten: We did, quite a bit. But we found no way of making that public in any way
that wouldn’t require a login from a travel agency and all of that good stuff.
So I think the most I wanna say about that is the logins that travel agencies have,
they’re terribly secured. But, of course, I can’t encourage anybody to go out
and hack them. But if you did and you had access you’d be logging in to something
that looks like a terminal. And you’d be typing some commands. And the next thing
you know it throws a Java stack trace at you. So these just look like terminals.
They have moved well beyond that while still maintaining this look and feel
of a mainframe. And they’re terribly insecure. So these stack traces, they just
come left and right even if you try to do the right thing!
*laughter*
Question: Thanks! Herald: Okay we have one question
from the internet!
Signal Angel: Somebody wants to know, how do you avoid DDoS’ing those services
when you just brute-force the booking numbers?
Karsten: A good question. Of course we don’t wanna hurt anybody, so we tried to
keep the rates low. And it turns out if you throw 20 Amazon instances at them
they don’t go down yet. And…
*laughter*
Herald: Okay. Thank you very much, Karsten and Nemanja!
*applause*
*postroll music*
subtitles created by c3subtitles.de in the year 2020. Join and help us!