The codes in your Boarding Pass

The next time you’re thinking of throwing away a used boarding pass with a barcode on it, consider tossing the boarding pass into a document shredder instead. Two-dimensional barcodes and QR codes can hold a great deal of information, and the codes printed on airline boarding passes may allow someone to discover more about you, your future travel plans, and your frequent flyer account.

Earlier this year, I heard from a longtime KrebsOnSecurity reader named Cory who said he began to get curious about the data stored inside a boarding pass barcode after a friend put a picture of his boarding pass up on Facebook. Cory took a screen shot of the boarding pass, enlarged it, and quickly found a site online that could read the data.

1

An older Delta boarding pass with a bar code that does not include a frequent flyer number. Source: IATA.

“I found a website that could decode the data and instantly had lots of info about his trip,” Cory said, showing this author step-by-step exactly how he was able to find this information. ‘

“Besides his name, frequent flyer number and other [personally identifiable information], I was able to get his record locator (a.k.a. “record key” for the Lufthansa flight he was taking that day,” Cory said. “I then proceeded to Lufthansa’s website and using his last name (which was encoded in the barcode) and the record locator was able to get access to his entire account. Not only could I see this one flight, but I could see ANY future flights that were booked to his frequent flyer number from the Star Alliance.”

The access granted by Lufthansa’s site also included his friend’s phone number, and the name of the person who booked the flight. More worrisome, Cory now had the ability to view all future flights tied to that frequent flyer account, change seats for the ticketed passengers, and even cancel any future flights.

The information contained in the boarding pass could make it easier for an attacker to reset the PIN number used to secure his friend’s Star Alliance frequent flyer account. For example, that information gets you past the early process of resetting a Star Alliance account PIN at United Airline’s “forgot PIN” Web site.

After that, the site asks for the answer to a pre-selected secret question. The question in the case of Corey’s friend was “What is your Mother’s maiden name?” That information can often be gleaned by merely perusing someone’s social networking pages (e.g., does your aunt or uncle on your mom’s side have your mother’s maiden name as their last name? If so, are they friends with you on Facebook?)

2

The readout from the barcode on Cory’s friend’s boarding pass (redacted).

United Airlines seems to treat its customers’ frequent flyer numbers as secret access codes. For example, if you’re looking for your United Mileage Plus number, and you don’t have the original document or member card they mailed to you, good luck finding this information in your email correspondence with the company. When United does include this code in correspondence, all but the last three characters are replaced with asterisks. The same is true with United’s boarding passes. However, the full Mileage Plus number is available if you take the time to decode the barcode on a boarding pass.

Interested in learning what’s in your boarding pass barcode? Take a picture of the barcode with your phone, and upload it to this siteThis blog on the same topic from several years back includes some helpful hints on how to decode the various information fields that get dumped by the barcode reader.

Finally, the standards for the boarding pass barcodes are widely available and have been for years. Check out this document (PDF) from the International Air Transport Association (IATA) for more on how the barcode standards work and have been implemented in various forms.

Thriving in Aviation without Global Alliances

Courtesy: Brett Snyder*

Over the last decade, more and more airlines have drifted into one of the three global alliances: Star Alliance,oneworld, and SkyTeam. You might think that the alliances have become crucial to airline survival. In fact, though, a few airlines have successfully bucked the alliance trend and instead thrived by working across alliances with multiple partners.

Only a handful of airlines can make this type of strategy work, and it requires a specific type of airline. But before discussing that, it’s helpful to know why airlines join alliances in the first place.

How alliances work

There’s no question that it’s expensive to join an alliance. Alliances have a base level of standards that are required for any airline to join, and there is usually some expensive tech work to connect all the dots. For the airlines that have joined alliances (and stayed there), the costs end up being worth the jump in revenue.

When an airline joins an alliance, the frequent fliers of partner airlines can instantly earn miles when flying on the new member airline. Not only that, but they can earn elite status qualifying miles, and that’s a big deal for building loyalty. The inevitable codeshares that follow help to flow passengers between all the networks in the airline system and that results in a big bump in terms of traffic.

Star Alliance member US Airways (LCC), for example, has said that its European operation wouldn’t be able to be nearly as large as it is without its alliance partners LufthansaSwissAustrian, etc., feeding passengers into the US Airways network.

How some airlines thrive without them

For the flip side, look at Hawaiian Air, for example. Nearly every U.S. airline flies to Hawai’i, but none of them fly between the islands. Would it make sense for Hawaiian to partner with a single alliance in order to increase connections? No. Hawaiian can take traffic from airlines in all the alliances (and non-alliance airlines) and fill its inter-island flights.

Being in an alliance wouldn’t increase traffic. It’s already getting the traffic from all the airlines, so an alliance would only increase costs. Closer cooperation wouldn’t really spark any additional passengers because there is no real competition for those partnerships in the islands right now. So Hawaiian can sit where it is and enjoy its place.

Another airline with this type of arrangement is Alaska Airlines(ALK). In the Pacific Northwest, Alaska has the hearts and minds of nearly every local resident. It’s a very strong brand with a tremendously popular frequent flier program. And because of that, it has a lot of airlines knocking at its door.

In fact, it has close cooperation with archrivals Delta (DAL) andAmerican (AMR). Both airlines use Alaska to extend their reach into the Pacific Northwest and they also use Alaska for Mexico flying. Delta has built international operations in Seattle with the expectation that it can use Alaska to fill those flights. Likewise, American counts on Alaska to help fill flights in LA. Alaska’s ability to feed passengers into major airlines up and down the west coast is tremendous.

So would Alaska benefit from joining an alliance? Not much. It already has reciprocal frequent flier agreements (including elite qualifying miles) with those airlines, and it has one-off partnerships with other airlines that it can help feed in its home base. The airline also partners with Air FranceAir PacificBritish AirwaysCathay PacificIcelandairKLMKoreanLAN, and Qantas. Its reach extends beyond just one alliance.

JetBlue’s international connections

Another airline that has decided to follow this strategy is JetBlue. Sitting on its perch in New York, JetBlue realized that it could partner with all sorts of airlines that fly into JFK in order to help provide connecting options throughout the U.S. It’s most recent partners are Virgin Atlantic and LAN but it also works with Aer Lingus, American, EmiratesLufthansaSouth African, and more are on the way.

South African is a great example of why this works. As a member of the Star Alliance, it could easily send connections via its Star Alliance partners, but there aren’t many connecting options at JFK. Sure, South African can connect people over Washington/Dulles on to United, but having this partner at JFK also helps it fill its New York flights better. It also gives JetBlue loyalists an airline preference when flying to South Africa. That can only help South African.

So why couldn’t JetBlue, Alaska, or Hawaiian join an alliance but then still have these one-off partnerships like South African? They could, but the point is that they don’t need to. As mentioned, joining an alliance is very expensive, and if these airlines can make it work without joining an alliance, then that’s a better way to go. Not many airlines can pull it off, but those with very strong niches in desirable places alongside strong brands can and do make it work.

*-http://www.bnet.com/blog/airline-business/how-some-airlines-thrive-without-global-alliances/3513