[Fredslist] Fw: The next time you're thinking of throwing away a used boarding pass with a barcode on it, consider tossing the boarding pass into a document shredder instead.

[Jefferson Crowther]

Important information here.  Advise your friends.  Also, if you stay in a hotel with the plastic key, shred that as well as it too contains all your personal information.  Regards.  Jeff Crowther.

--- On Thu, 10/8/15, Stephen C. Kratovil <sckrat at gmail.com> wrote:

> From: Stephen C. Kratovil <sckrat at gmail.com>
> Subject: The next time you're thinking of throwing away a used boarding pass with a barcode on it, consider tossing the boarding pass into a document shredder instead.
> To: "Stephen C. Kratovil" <sckrat at gmail.com>
> Date: Thursday, October 8, 2015, 9:16 AM
> 06
> OCT 15What’s
> in a Boarding Pass Barcode? A Lot  The next time you’re thinking
> of throwing away a used boarding pass with a barcode on it,
> consider tossing the boarding pass into a document shredder
> instead. Two-dimensional barcodes and QR codes can hold a
> great deal of information, and the codes printed on airline
> boarding passes may allow someone to discover more about
> you, your future travel plans, and your frequent flyer
> account.Earlier this year, I heard from a
> longtime KrebsOnSecurity reader named Cory who said he began
> to get curious about the data stored inside a boarding pass
> barcode after a friend put a picture of his boarding pass up
> on Facebook. Cory took a screen shot of the boarding pass,
> enlarged it, and quickly found a site online that
> could read the data.An older Delta boarding pass with a
> bar code that does not include a frequent flyer number.
> Source: IATA.“I found a website that could decode the data and
> instantly had lots of info about his trip,” Cory said,
> showing this author step-by-step exactly how he was able to
> find this information. ‘“Besides his name, frequent
> flyer number and other [personally identifiable
> information], I was able to get his record locator (a.k.a.
> “record key” for the Lufthansa flight he was
> taking that day,” Cory said. “I then proceeded
> to Lufthansa’s website and using his last name (which
> was encoded in the barcode) and the record locator was able
> to get access to his entire account. Not only could I see
> this one flight, but I could see ANY future flights that
> were booked to his frequent flyer number from
> the Star
> Alliance.”The access granted by
> Lufthansa’s site also included his friend’s
> phone number, and the name of the person who booked the
> flight. More worrisome, Cory now had the ability to view all
> future flights tied to that frequent flyer account, change
> seats for the ticketed passengers, and even cancel any
> future flights.The information contained in the
> boarding pass could make it easier for an attacker to reset
> the PIN number used to secure his friend’s Star
> Alliance frequent flyer account. For example, that
> information gets you past the early process of resetting a
> Star Alliance account PIN at United
> Airline’s “forgot PIN” Web
> site.After that, the site asks for the
> answer to a pre-selected secret question. The question in
> the case of Corey’s friend was “What is your
> Mother’s maiden name?” That information can
> often be gleaned by merely perusing someone’s social
> networking pages (e.g., does your aunt or uncle on your
> mom’s side have your mother’s maiden name as
> their last name? If so, are they friends with you on
> Facebook?)The readout from the barcode on
> Cory’s friend’s boarding pass
> (redacted).United Airlines seems to treat its
> customers’ frequent flyer numbers as secret access
> codes. For example, if you’re looking for your United
> Mileage Plus number, and you don’t have the original
> document or member card they mailed to you, good luck
> finding this information in your email correspondence with
> the company. When United does include this code in
> correspondence, all but the last three characters are
> replaced with asterisks. The same is true with
> United’s boarding passes. However, the full Mileage
> Plus number is available if you take the time to
> decode the barcode on a boarding pass.Interested in learning what’s
> in your boarding pass barcode? Take a picture of the barcode
> with your phone, and upload it to this site. This blog on the same topic from several years
> back includes some helpful hints on how to decode the
> various information fields that get dumped by the barcode
> reader.Finally, the standards for the
> boarding pass barcodes are widely available and have been
> for years. Check out this
> document (PDF) from the International Air Transport
> Association (IATA) for more on how the barcode
> standards work and have been implemented in various
> forms.
>  
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.gif
Type: image/gif
Size: 70 bytes
Desc: not available
URL: <http://www.gothamnetworking.com/pipermail/fredslist/attachments/20151008/5ce5d225/attachment-0001.gif>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 179008 bytes
Desc: not available
URL: <http://www.gothamnetworking.com/pipermail/fredslist/attachments/20151008/5ce5d225/attachment-0002.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.png
Type: image/png
Size: 176571 bytes
Desc: not available
URL: <http://www.gothamnetworking.com/pipermail/fredslist/attachments/20151008/5ce5d225/attachment-0003.png>