Flaw in boarding pass check system puts fliers in danger
Posted on 26 October 2012.
Everybody knows by now that airline boarding passes have barcodes that, when decoded, show a series of letters and numbers that "summarize" the main information about one's flight - name, flight number, seat assignment, the codes for the airports from which the flight departs and lands, and so on.

But what you might not know is that it also includes a code that tells the U.S. Transportation Security Administration (TSA) officers whether you are eligible for TSA's Precheck Program, and could consequently pass through the security check after receiving the expedited screening treatment (shoes, light outerwear and belts can be left on, and laptops and compliant liquids in carry-on bags don't have to be taken out of it for scanning).

This would not be a problem were it not for the fact that this information isn't encrypted.

"What terrorists or really anyone can do is use a website to decode the barcode and get the flight information, put it into a text file, change the 1 to a 3, then use another website to re-encode it into a barcode. Finally, using a commercial photo-editing program or any program that can edit graphics replace the barcode in their boarding pass with the new one they created," says John Butler, the aviation blogger who discovered the flaw.

"Even more scary is that people can do this to change names. So if they have a fake ID they can use this method to make a valid boarding pass that matches their fake ID. The really scary part is this will get past both the TSA document checker, because the scanners the TSA use are just barcode decoders, they donít check against the real time information. So the TSA document checker will not pick up on the alterations."

Luckily, the problem is easily solved by using encryption or by connecting TSA scanners to the airline database and check the boarding pass against the one recorded with the airline - or both.

The TSA has yet to comment on Butler's discovery, but I suspect they will initially respond with the quote that it is included in the Precheck Program's webpage: "TSA will always incorporate random and unpredictable security measures throughout the airport and no individual will be guaranteed expedited screening."


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Mon, Feb 8th