Forgot your password?
typodupeerror
Security Transportation Your Rights Online

Experts Warn About Security Flaws In Airline Boarding Passes 199

Posted by samzenpus
from the to-screen-or-not-to-screen dept.
concealment writes in with a story about a newly found security issue with the bar codes on boarding passes. "Flight enthusiasts, however, recently discovered that the bar codes printed on all boarding passes — which travelers can obtain up to 24 hours before arriving at the airport — contain information on which security screening a passenger is set to receive. Details about the vulnerability spread after John Butler, an aviation blogger, drew attention to it in a post late last week. Butler said he had discovered that information stored within the bar codes of boarding passes is unencrypted, and so can be read in advance by technically minded travelers. Simply by using a smartphone or similar device to check the bar code, travelers could determine whether they would pass through full security screening, or the expedited process."
This discussion has been archived. No new comments can be posted.

Experts Warn About Security Flaws In Airline Boarding Passes

Comments Filter:
  • by Kwyj1b0 (2757125) on Thursday October 25, 2012 @12:31AM (#41761125)
    Has anyone seen a case where a passenger is waved through security? Each time I go through, everyone in line for screening goes through the same process (then again, I am completely average and might not have seen advanced/reduced security for anyone except pilots).
    • Re: (Score:2, Insightful)

      by Anonymous Coward

      When I entered Australia as a U.S. citizen studying abroad I was waved through security. I'm still not sure why, but I don't think it had anything do with my boarding pass showing me as definitely not a terrorist.

      • Re: (Score:2, Interesting)

        by Anonymous Coward
        Possibly because we don't (yet!) have the same level of Security Theatre as our US counterparts?
      • Re: (Score:3, Interesting)

        by Anonymous Coward

        Most countries don't check entering the country other than customs. I suspect the TSA does it for more funding. It is a department with the largest scope creep I have ever seen.

        • by fustakrakich (1673220) on Thursday October 25, 2012 @04:50AM (#41762025) Journal

          It is a department with the largest scope creep I have ever seen.

          You mean aside from the CIA, NSA, IRS, DOD, FBI, the executive branch of the government, the entire government itself? It's pretty hard to quantify 'scope creep' when everybody is guilty.

          • Re: (Score:2, Interesting)

            by Anonymous Coward

            You mean aside from the CIA, NSA, IRS, DOD, FBI, the executive branch of the government, the entire government itself?

            Oh, no no, assuming scope creep is computed as "total size/useful size", TSA can leave everyone in the dust. With CIA/NSA/IRS/DOD/FBI, there is some fraction (we can argue how big) that provides useful service. With TSA there is no such thing.

            To my knowledge, TSA hasn't actually caught any terrorists in 11 years of its existence. Every time some other organization (or fellow passengers) apprehend a terrorist wanna be (rare, but it happens), TSA expands it's funding. So by my definition "total size/usefu

          • by camperdave (969942) on Thursday October 25, 2012 @08:28AM (#41762927) Journal

            It is a department with the largest scope creep I have ever seen.

            You mean aside from the CIA, NSA, IRS, DOD, FBI, the executive branch of the government, the entire government itself? It's pretty hard to quantify 'scope creep' when everybody is guilty.

            You misunderstand. Sure, all those agencies have creeps at the scope; but the TSA has the biggest creeps.

      • by GumphMaster (772693) on Thursday October 25, 2012 @01:14AM (#41761293)

        Once you pass passport checks the 'security' on entering Australia [daff.gov.au] is to do with biological security. A US national entering from a US flight is low risk for carrying biological hazards like viable seeds, eggs, infested timber products etc. Had you entered on a flight you joined in Africa or Asia, or been a Chinese national (think suitcase full of traditional remedies), they would likely have X-rayed everything for biological matter. We have stiff penalties for failing to declare prohibited biological items.

        Security on leaving Australia bound for the US is largely dictated by US policy.

        • by jamesh (87723)

          Once you pass passport checks the 'security' on entering Australia [daff.gov.au] is to do with biological security. A US national entering from a US flight is low risk for carrying biological hazards like viable seeds, eggs, infested timber products etc. Had you entered on a flight you joined in Africa or Asia, or been a Chinese national (think suitcase full of traditional remedies), they would likely have X-rayed everything for biological matter. We have stiff penalties for failing to declare prohibited biological items.

          We even have a TV show about customs and the crap people try to smuggle in. At least I think it's ours... I see ads for it all the time but have never actually watched it. It could be like the Highway Patrol show that comes from NZ.

          • by thempstead (30898)

            The Australian programme I believe is Nothing to Declare. There is also a NZ equivalent called Passport Patrol.

            One of the lesser digital channels in the UK broadcasts both shows (normally multiple times a day)

            • by jamesh (87723)

              The Australian programme I believe is Nothing to Declare. There is also a NZ equivalent called Passport Patrol.

              One of the lesser digital channels in the UK broadcasts both shows (normally multiple times a day)

              The NZ one is Border Patrol. Not sure why they rename it Passport Patrol for the UK audience...

      • by Joce640k (829181) on Thursday October 25, 2012 @05:42AM (#41762171) Homepage

        When I entered Australia as a U.S. citizen studying abroad I was waved through security. I'm still not sure why, but I don't think it had anything do with my boarding pass showing me as definitely not a terrorist.

        You mean you were treated like a human being? In the rest of the world that's what we call "normal".

    • by ryanov (193048)

      You've not received the SSSS security scan (I've gotten it twice). Forget the barcode, it's written on your boarding pass!

      http://en.wikipedia.org/wiki/Secondary_Security_Screening_Selection [wikipedia.org]

  • Photoshop? (Score:5, Interesting)

    by x_IamSpartacus_x (1232932) on Thursday October 25, 2012 @12:31AM (#41761127)
    How possible would it be to do very subtle Photoshop (or the GIMP) changes to ensure someone goes through the expedited process? Heck, terrorism aside, I'D do it just to avoid the cancer machines.
    • Re: (Score:3, Informative)

      by DecimalMan (2705599)

      Probably not a good idea. From TFA: "it is illegal to tamper with a boarding card under U.S. law."

      • Re:Photoshop? (Score:5, Insightful)

        by Swampash (1131503) on Thursday October 25, 2012 @12:55AM (#41761219)

        Printing an entirely new one with your own bar code doesn't tamper with the existing card at all.

        • Re:Photoshop? (Score:5, Insightful)

          by zazzel (98233) on Thursday October 25, 2012 @02:59AM (#41761653)

          It's not tampering, it's forgery. How much of a tech/nerd guy do you have to be to NOT immediately see this?

        • Re:Photoshop? (Score:4, Interesting)

          by AmiMoJo (196126) <mojoNO@SPAMworld3.net> on Thursday October 25, 2012 @03:36AM (#41761767) Homepage

          I usually print my own boarding pass these days. Check-in online and print a web page with barcode image on it. Altering that barcode before printing would be trivial.

          Fortunately I don't really need to because last time I travelled it appeared that the nude scanners and shoe removal queue had all gone and just the metal detector was left.

          You can still get cheap thrills by putting on a metal belt buckle if you are into that sort of thing. I noticed that a lot of guys wait until they can see how is doing the checks, and if she looks hot they keep their belt on, otherwise it comes off and goes in the tray.

        • Printing an entirely new one with your own bar code doesn't tamper with the existing card at all.

          Holy crap, you're right! Can't believe that nobody has spotted that loophole! Go ahead and try it - be sure to check back in and let us know how that worked for you.

      • Re:Photoshop? (Score:4, Insightful)

        by whoever57 (658626) on Thursday October 25, 2012 @01:15AM (#41761295) Journal

        Probably not a good idea. From TFA: "it is illegal to tamper with a boarding card under U.S. law."

        As already pointed out, if you are a terrorist cell, you don't need to alter the boarding passes, just buy enough and see which ones have the minimum screening. Heck, the people selected for maximum screening could make the proccess longer (carry some items that are not allowed but are common and largely innocuous, such as scissors, bottles of water, etc..), thus reducing the likelyhood of the minimum screening catching anyone because of the distraction.

        • Re:Photoshop? (Score:5, Insightful)

          by PerformanceDude (1798324) on Thursday October 25, 2012 @01:56AM (#41761459)
          On the other hand, if you are a terrorist cell, you are probably not terribly concerned about U.S. law...
          • Re: (Score:3, Insightful)

            by kasperd (592156)

            On the other hand, if you are a terrorist cell, you are probably not terribly concerned about U.S. law...

            And from that you get a corollary saying that anybody who isn't terribly concerned about U.S. law is a terrorist. Of course deriving a corollary that way isn't logically sound, but the people who make up corollaries of the form "anybody who ... is a terrorist" aren't terribly concerned about logic.

            • by wvmarle (1070040)

              Since 11 Sept, all people caught trying to set off bombs on board planes, boarded those planes outside the US. So they didn't have much to do with US security regulations ('law' is the wrong word for this, GP most likely mean 'regulations' or so).

              • by kasperd (592156)

                Since 11 Sept, all people caught trying to set off bombs on board planes, boarded those planes outside the US. So they didn't have much to do with US security regulations

                Last time I travelled to the US, I had to go through an extra round of security checks before and after the normal security checks. So it seems the US has succeeded in imposing some version of their regulations on airports in other countries.

    • by ryanov (193048)

      I'm almost certain you're already receiving the minimum scan. There are higher levels that you can and probably have not yet gotten.

    • Re:Photoshop? (Score:5, Interesting)

      by gutnor (872759) on Thursday October 25, 2012 @04:34AM (#41761963)

      That is the scary thing about all that. There is no real screening on site or behaviour analysis, or you know, normal police work. No the level of scrutiny you get is dictated in advance by some random algorithm and independent of what you do there.

      Security theater indeed !

      • Re:Photoshop? (Score:5, Interesting)

        by 1u3hr (530656) on Thursday October 25, 2012 @05:02AM (#41762057)

        the level of scrutiny you get is dictated in advance by some random algorithm and independent of what you do there.

        Which is actually the safest method, short of checking 100% of passengers. It's easy to game any system that predictably targets specific groups, you just makes sure your agents aren't in those groups and you're safe. If the chances of being searched are random, you can't reduce the risk of getting caught.

        Of course, you'd ideally also want to have some smart guys to do additional searches based on observation. But they seem in short supply.

        The real security theatre is the immense effort devoted to imaginary threats, liquids and shoes, for instance, which were never a real threat to begin with.

        • by Talderas (1212466)

          However if it is random and the indicators for a random search can be known, it's still security theater. Get a boarding pass, scan it for the random search indicators. If the boarding pass has them, then the agent just aborts and gets a new boarding pass under a new ID.

    • Re:Photoshop? (Score:5, Informative)

      by dkleinsc (563838) on Thursday October 25, 2012 @06:47AM (#41762379) Homepage

      quite possible [schneier.com], as Bruce Schneier explains in detail.

    • by wienerschnizzel (1409447) on Thursday October 25, 2012 @06:58AM (#41762423)

      Or perhaps to do a good ol' "DROP TABLE flights;"?

  • by CimmerianX (2478270) on Thursday October 25, 2012 @12:38AM (#41761165)
    This will be buried.... people will forget... and the TSA security theater will continue or even get stepped up to counter this little mishap.
    • Re:The truth... (Score:5, Insightful)

      by lightknight (213164) on Thursday October 25, 2012 @01:32AM (#41761363) Homepage

      'Tis a jobs program, and nothing more. Even the congressmen who are against the idea of the TSA are busy spinning it as providing jobs to their constituents.

      Which is funny on so many levels. We all know that the TSA was built on a lie, we all know that it is worthless, we all know that it is bleeding the taxpayers dry, and we all know that we'd be better off without it. And yet, they're going to keep it, because jobs. Jobs which provide no net income, jobs which cost three times more than they are worth, jobs with glass ceilings built in, jobs which do not help America to grow anywhere but the waistline, and yet, they are so desperate to protect them. The money they are earning in kickbacks must be tremendous.

      • by spatley (191233)
        amen brother
      • by dkf (304284)

        'Tis a jobs program, and nothing more. Even the congressmen who are against the idea of the TSA are busy spinning it as providing jobs to their constituents.

        You could privatize the vast majority of the TSA without any ill-effects, keeping just a small rump whose job would be to test whether the privatized parts are still doing their security checks correctly. This is pretty much how airport security is handled in most of Europe; the security staff are employed by the airport (or, more usually, a specialist contractor) and there's just central validation that the checks being performed are adequate with respect to the threat.

      • Re:The truth... (Score:5, Insightful)

        by OrigamiMarie (1501451) on Thursday October 25, 2012 @04:17AM (#41761905)
        Jobs which slow the economy by discouraging pleasure travel (and all of the nice tourist spending) and business travel (and the kinds of business deals and chance new acqaintances you only get in person). Travel is incredibly important to our economy, it is part of what makes a large country so strong. When people opt out of it, the ripple effects are amazing.
        • There is only one thing that is responsible for declining pleasure travel, and that is the condition of peoples' personal economy. The complaints are coming from an insignificant minority. All things considered, business is pretty good.

          • by bkr1_2k (237627)

            Wrong. I know of at least 10 people personally who have stopped traveling for pleasure because of the TSA. They do "stay cations" (I hate that f'in word) now. If I know this many people (who used to fly as families of 3-5 people at least once every year) then there are a whole lot more who've also chosen this option.

      • Re:The truth... (Score:4, Insightful)

        by wvmarle (1070040) on Thursday October 25, 2012 @05:08AM (#41762085)

        Besides that it's election time, you guys have high employment already so it's political suicide for either party to say "hey you couple hundred thousand (or however many work in TSA) low-educated workers, please go find another job as we're shutting you down".

      • by Mashiki (184564)

        'Tis a jobs program, and nothing more. Even the congressmen who are against the idea of the TSA are busy spinning it as providing jobs to their constituents.

        It would be better to train those people in construction or trades, but I keep remembering that large swaths of the population have this thing against hard manual and physical labor.

      • Re:The truth... (Score:4, Informative)

        by dkleinsc (563838) on Thursday October 25, 2012 @07:38AM (#41762605) Homepage

        we all know that it is bleeding the taxpayers dry

        All your arguments except that one are valid. Some math will tell you why.
        TSA budget: $8.1 billion
        US federal budget: $3.7 trillion

        So the TSA makes up approximately 0.2% of the federal budget. You could cut it to $0 and still make no significant dent in the deficit. The big ticket items are, and have been for decades: Social Security, Medicare, Medicaid, and Defense. After the crash in 2008, unemployment insurance, food stamps, WIC, and housing assistance jumped up because more people are unemployed, hungry, or homeless. But the TSA just isn't even remotely close to what's bleeding the taxpayers dry.

    • I think that America has a fundamental learning issue, which leads to these kinds of flaws. They can't even get a three letter acronym right. Unless they are taking a leaf out of the French book, by calling it Theatre Security America.

  • What flaw are we talking about?
    Obviously it is a feature for "technically minded travelers". Ist'n it?

    • Re: (Score:3, Insightful)

      by mi (197448)

      When people have tried to walk away from the airport upon discovering, they were selected for the extra microwaving (or groping), they were told, they can no longer leave and must go through the screening. The reason was given [go.com], that doing otherwise would allow terrorists to attempt to travel, but back away if they find themselves selected for more rigorous checks.

      Well, if the level of checking is printed right there on one's boarding pass, the terrorists don't have to reveal themselves. When they find out

  • Which one will John Butler will be receiving...

  • by Nyder (754090) on Thursday October 25, 2012 @12:49AM (#41761207) Journal

    Wonder how long till John Butler gets arrested for sharing this info. National security and all that.

    • by fatphil (181876) on Thursday October 25, 2012 @05:33AM (#41762153) Homepage
      Not likely to be long at all. Here's wikipedia's take on Chris Soghoian's tale:

      On October 26, 2006, Soghoian created a website that allowed visitors to generate fake boarding passes for Northwest Airlines. While users could change the boarding document to have any name, flight number or city that they wished, the generator defaulted to creating a document for Osama Bin Laden.

      Soghoian claimed that his motivation for the website was to focus national attention on the ease with which a passenger could evade the no-fly lists.[3] Information describing the security vulnerabilities associated with boarding pass modification had been widely publicized by others before, including Senator Charles Schumer (D-NY)[4][5] and security expert Bruce Schneier.[6] Soghoian received media attention for posting a program on his website to enable the automatic production of modified boarding passes. Democrat Edward Markey, House of Representatives committee (telecommunications and the internet) stated Soghoian should be arrested.[2]

      At 2 AM on October 28, 2006, his home was raided by agents of the FBI to seize computers and other materials.[7] Soghoian's Internet Service Provider voluntarily shut down the website, after it received a letter from the FBI claiming that the site posed a national security threat.[8] The FBI closed the criminal investigation in November 2006 without filing any charges.[9] The TSA also initiated a civil investigation in December 2006,[10][11] which was closed without any charges being filed in June 2007.[12][13]
  • I don't know about 'hidden codes' - a few years ago I took my family on an around the world trip, traveling west from Australia via Dubai and London. All our US boarding passes were stamped with big red 'SSS' letters, except for my wife, who has a British passport.

    At every security gate my three kids and I got the full treatment of pat-downs and extra screening, even being pulled out of the normal line and taken aside in some cases.

    The reason, I supposed, was because we came to the US from Dubai arriving o

  • by ardiri (245358) on Thursday October 25, 2012 @02:16AM (#41761533) Homepage

    this only applies to the TSA who actually scan and pass people around the security scanning solution based on the results of what is in the barcode. in europe, you always have to go through scanning process, regardless of what your 2D barcode has encoded within in. all the TSA is doing here, is opening up a chance for terrorists based on local soil to get through the security scanning process simpler. the challenge is that the USA has the most number of travelers through the airline system than anywhere else in the world; doing extensive security checks does choke the system - so, they need to try and filter out the more frequent/trusted flyers, the net result is they are wasting time screening some since they done screen everyone.

  • by T-Bucket (823202) on Thursday October 25, 2012 @02:19AM (#41761543) Homepage

    Not only could you photoshop the barcode, but hell, you could photoshop the name, the destination, the flight number, pretty much anything you wanted... The brainless goons at the security checkpoint wouldn't know the difference. (They don't scan tickets or anything).

    In my experience (working for a contractor for a major US airline), you could even use a photoshopped (printed at home) boarding pass to get on the plane. When they scan it at the gate and the computer beeps saying "no such thing", generally the non-english-speaking gate agent will just scan it a few more times, give up, and let the person on the plane. When the passenger count from the computer later doesn't match up to the number of people on the plane, they'll just "go with what's on the plane" in the interest of getting the plane out on time. This happens on a DAILY BASIS. "Security" is a joke.

    • by jamesh (87723)

      Not only could you photoshop the barcode, but hell, you could photoshop the name, the destination, the flight number, pretty much anything you wanted... The brainless goons at the security checkpoint wouldn't know the difference. (They don't scan tickets or anything).

      In my experience (working for a contractor for a major US airline), you could even use a photoshopped (printed at home) boarding pass to get on the plane. When they scan it at the gate and the computer beeps saying "no such thing", generally the non-english-speaking gate agent will just scan it a few more times, give up, and let the person on the plane. When the passenger count from the computer later doesn't match up to the number of people on the plane, they'll just "go with what's on the plane" in the interest of getting the plane out on time. This happens on a DAILY BASIS. "Security" is a joke.

      I'm a little dubious about your claims... although it wouldn't be the first time stupidity has exceeded expectations.

      I wonder what will happen with all this security in place when another plane gets hijacked? I guess we'll all have to be put to sleep at boarding time and then shipped to our destination in cocoons. At least we wouldn't have to eat airline food and put up with people kicking our seats then.

      • by jittles (1613415)
        You are unlikely to see another plane get hijacked in your life time. You might see an attempted hi-jack, but I'd be surprised if it went beyond that. Gone are the days when terrorists could be trusted to take you on a joyride to Syria or Africa. People now assume the worst in such a situation and I guarantee you the pilots will not willingly open the cockpit door.
      • by jwdb (526327) on Thursday October 25, 2012 @08:19AM (#41762833)

        I've actually had this happen to me. Connecting flight, they gave me a new boarding pass at the gate (one with a boarding group number), and I neglected to check that it was the right one. The ticket scanner beeped weirdly when I tried to board but the agent waved me on anyway, and only when I found someone else in my seat did I realize that I had been given someone else's boarding pass, and that person had already boarded.

        I believe it was Washington Dulles, westbound.

  • by aepervius (535155) on Thursday October 25, 2012 @02:28AM (#41761587)
    BP data is not meant to be a security things. If they saved CAPS 2 data on it, well *shrug*. Anyway the rule at check in on how to set whether there will be a screening are known. If I recall correctely the code, if you paid with CC, are business traveler or better, have a return ticket, and a miles and more or similar card, given baggage, you have next to no chance beyond random chance, whether if you paid cash, one way, with carry on, belong to the monkey class (M - Eco) , no FT cards, you are bound to be checked 100% of the time. At least it used to be that way, now the rule might be a bit more elaborate but I doubt it changed. Also it used to be you had anyway a 10-20% chance of being selected anyway at the security point, independentely of what the BP said. IMHO it is a non story.
    • I don't see how this even matters. The last time I was at the airport, they didn't even scan the boarding pass at the security check point. There wasn't even any equipment present to scan it! They just had a person verify the name on your ID matched the boarding pass.
  • The Joys Of Flying (Score:5, Interesting)

    by rally2xs (1093023) on Thursday October 25, 2012 @06:08AM (#41762255)

    including the inability to get non-stop flights for most routes, having to pay to park in a lot that is still a 10 minute ride to the terminal, having to arrive 2 hours early to ensure getting thru security on time to board, having small innocuous items in my pockets stolen by TSA, risking having large innocuous items in my bags stolen by TSA, getting severely overcharged for food at airport terminals, getting X-rayed by someone who is not my doctor or dentist, having to do mini-marathons thru airports to make connecting flights, getting my bags lost, etc. etc. have all combined to cause me to decide to drive everywhere I go. Eventually, the Alcan Highway is going to get photographed up the wazoo, by me, 'cuz I'll drive up and ferry back. But the X-rays were the last straw, that shall not stand. I quit. You can find me on I-10 to Tucson next year, I-74 from Indy to La Crosse, I-64 to St. Louis, etc. etc. Until the unconstitutional TSA activity is removed, I will not choose to fly anywhere I can drive, or boat, or travel by train.

      • including the inability to get non-stop flights for most routes: "So, the airline industry should have direct flights between all airports, oh well, at least they won't be able to oversell seats anymore, two problems solved with one brilliant solution"
      • having to pay to park in a lot that is still a 10 minute ride to the terminal: "Easily solved by making a 1000th story car park right next to the terminal and just charging a piffling 2000 bucks per hour to pay for it"
      • having small innocuous items in my pockets
  • ..."It's completely random, you're not being singled out..."

    YAH, RIGHT!

    I will stick to ground-based travel. Until they decide to put portable microwave ovens in front of the boarding gates for my CYCLE!

  • Isn't this an opt in system? I would have assumed you would need something other than the ticket, to indicate you are in the prescreening program.
    Isn't this like stamping the ticket "first class" or "mvp flyer?"
    Of course if you did away with the TSA and security screening, this wouldn't be a problem.

He keeps differentiating, flying off on a tangent.

Working...