How Easy Is it to Hack a Flight Booking Service?

“Very easy” shouts the slightly suspicious gentleman at the back, as this is indeed one of the simplest little targets for hackers to pass a cool evening collecting a bunch of personal information. In fact, while the world shrieks about dubious privacy policies taking advantage of their users or companies failing to provide adequate safety requirements over sensitive information, they lack to notice a gaping security hole in flight booking services. A statement made by investigators at Security Research Labs in Berlin comes to warn the world about how unsafe our details are when booking a flight. So you already know the drill, if you’re planning to travel in the near future or you do it regularly: make sure to enable your VPN while booking.

The three main global distribution systems (GDS) in the world – Amadeus, Sabre and Travelport – are known to manage the majority of travel reservations with flying colors but lack in providing proper safety measure. Experts stated that “while the rest of the internet is debating which second and third factors to use, GDS’ do not offer a first authentication factor“, something more than enough to raise concerns on choosing any of these for traveling means. Moreover, two of the three assign these pincodes sequentially, which only makes brute-force guesses easier as if they were attributed randomly for instance. Passengers’ booking codes can be found online, which brings all this to even darker territory. CheckMyTrip, the curiously twist-of-fate-named Amadeus’ web page, was noted as being particularly vulnerable.