141 Airlines Booking System Goes Awry Worldwide
By MYBRANDBOOK
There is a critical vulnerability found in online flight booking system, with this almost half of the fight travellers around the world were found exposed to a critical security vulnerability, that allowed remote hackers to access and modify their travel details and even claim their frequent flyer miles.
A Israeli network security researcher Noam Rotem discovered the vulnerability when he booked a flight on the Israeli airline ELAL, successful exploitation of which just required victim’s PNR (Passenger Name Record) number.
Hackers are really smart enough to enter into the flight booking system, which is developed by Amadeus, which is widely used by nearly 141 international airlines, including United Airlines, Lufthansa and Air Canada. After booking a flight with ELAL, the traveler receives a PNR number and a unique link that allows customers to check their booking status and related information associated with that PNR.
Rotem found that merely by changing the value of the "RULE_SOURCE_1_ID" parameter on that link to someone else's PNR number would display personal and booking-related information from the account associated with that customer.
Using disclosed information, i.e. booking ID and last name of the customer, an attacker can simply access the victim's account on ELAL's customer portal and "make changes, claim frequent flyer miles to a personal account, assign seats and meals, and update the customer's email and phone number, which could then be used to cancel/change flight reservation via customer service. "The report says, the vulnerability could have affected hundreds of millions of travelers.
Amadeus has able to fix the issue, and the Rotem's script can no longer identify active PNRs as demonstrated in the above video.
In a statement Amadeus says , "At Amadeus, we give security the highest priority and are constantly monitoring and updating our systems. Our technical teams took immediate action, and we can now confirm that the issue is solved."
Adani Ports to acquire 95% of the Gopalpur Port in Odisha
For ₹13.49 billion, Adani Ports would purchase a 95% ownership in Gopal...
Zoom introduces Workplace to provide AI support during meeting
Zoom Video Communications has announced Zoom Workplace, its AI-powered, op...
22 startups valued above ₹10,000 cr are being run by former
According to Private Circle, around 22 firms founded by former Paytm employ...
Tech Mahindra and IBM to accelerate digital adoption in APAC
Tech Mahindra has announced the opening of a Synergy Lounge, in collabora...
ATRIE TECHNOLOGY PVT. LTD.
OPTIEMUS INFRACOM
BHARAT ELECTRONICS LTD.
NUMERIC INDIA, A Group Brand Legrand
Technology Icons Of India 2023: Ritesh Agarwal
Ritesh Agarwal Founder & CEO of OYO Hotels & Homes-World’s fastest g...
Technology Icons Of India 2023: Sridhar Vembu
Sridhar Vembu is an Indian billionaire business magnate and the Founde...
Technology Icons Of India 2023: Ajit Balakrishnan
The Company markets specific channels, community features, local langu...
RailTel connecting every corner of India
RailTel is an ICT provider and one of the largest neutral telecom infr...
TCIL continues to strengthen India with its technology expertise
TCIL undertakes consultancy & turnkey projects in the field of Telecom...
NPCI leading India towards Digital payments
The National Payments Corporation of India (NPCI) is an initiative tak...
Crayon Software Experts India Pvt Ltd
Crayon helps its customers build the commercial and technical foundati...
SATCOM INFOTECH PVT. LTD.
Satcom Infotech Pvt. Ltd is a distribution houses in security in India...
NETPOLEON SOLUTIONS
Netpoleon Group is a Value-Added Distributor (VAD) of Network Security...