where in the world is carmen sandiego? · pdf filewhere in the world is carmen sandiego? ......
TRANSCRIPT
SRLabsTemplatev12
Corporate Design
2016
WhereintheWorldIsCarmenSandiego?
KarstenNohl<[email protected]>NemanjaNikodijević<[email protected]>
Das Logo Horizontal
— Pos / Neg
3
Globalbookingsystemsstoredatafromairlinesandpassengers
2
Bookingsystems/GDS Fares Availability Reservations
Bookingagents Bookingwebsites Travelagencies
Createreservations
Travelproviders Airlines Hotels Carrental
companies
Updatefares,Changeavailabilityrules
Das Logo Horizontal
— Pos / Neg
3
GDSstorepriceandavailabilityrules TAP(TP)OLDEUSTPHAMtoSFO
GeneralnotesBASIC SEASON ECONOMY ONE WAY SPECIAL EXCURSION FARESBetween EUROPE and THE UNITED STATES APPLIES FOR ONE WAY FARES
Category3:SeasonalrestrictionsPERMITTED 01NOV THROUGH 15DEC OR 31DEC THROUGH 12MAY FOR EACH TRIP.
Category4:FlightrestrictionsIF THE FARE COMPONENT INCLUDES TRAVEL WITHIN EUROPE
THEN THAT TRAVEL MUST BE ONONE OR MORE OF THE FOLLOWINGANY TP FLIGHT OPERATED BY TP …
Fare
Availability
3
Das Logo Horizontal
— Pos / Neg
3
GDSalsostorereservationsincludingpersonalinformation
4
Reservation/PNR
Das Logo Horizontal
— Pos / Neg
3
ThreeGDSdominatethemarket
5
Bookingagents Expedia
GDS Amadeus SabreGalileo(nowpartofTravelport)
Airlines(examples)
AirBerlin Aeroflot
Example:AnAmericanAirlinesticketbookedthroughExpediaiskeptinAmadeusand Sabre
AmericanAirlines Notreally
usedbyairlines
Lufthansa
Das Logo Horizontal
— Pos / Neg
3
§ Fine-grainedaccesscontrol
§ Strongauthentication
§ Rate-limiting
§ Logging
Wewerecuriousabouttheprotectionofpassengerinformation
6
WhichwebservicesecuritybasicsareimplementedinGDS?
?
?
?
?
GDSmaybeinsecure:
§ Bookingsystems(GDS)gobacktothe70sand80s
§ Theywerethefirst“cloud”beforetheterm(ortheInternet)existed
§ Cansuchsystemshavemodernsecurity?
GDSmaybesecure:
§ Passengerdatahasbeenindisputebetweengovernmentsforyears
§ EspeciallytheEUexpressedstrongpoliticalwilltoprotecttravelerdata
Ourresearchmotivation
Das Logo Horizontal
— Pos / Neg
3
GDShaveverycoarseaccessrestrictions
7
PNRspace
Airlinestaff canaccessallPNRsthatareinanywayconnectedtothatairline
Bookingagents canaccessanyticketconnectedtotheagency
OnePNR(canincludedifferentairlines)
GDSstaff canaccessallPNRs
Toomuchinformation–§ ThePNRincludesallinfofromdifferent
providers(flight,hotel,car)forproviderstosee§ Includespaymentinformationaddress,credit
cardincl.expiry
Toomuchaccess– plentyofpeoplehaveaccesstoprivatebookingdetails:1. Employeesofthetravelagency/websitethat
createdthebooking2. Employeesofthetravelprovidersincludedon
thePNR3. EmployeesofanyoftheGDSinvolvedinany
partofthePNR,includingexternalsupportcompanies
4. AllegedlytheUSDHS
Accesscontrol:Verylittle
Das Logo Horizontal
— Pos / Neg
3
§ Fine-grainedaccesscontrol
§ Strongauthentication
§ Rate-limiting
§ Logging
?
?
?
?
Arebookingsystemsprotectedwithbasicsecuritycontrols?
8
Webservicesecuritybasics
Das Logo Horizontal
— Pos / Neg
3
Authenticationoptionsrangefromweaktoveryweak
9
Agent
<Agentid>User:
WS<DDMMYY>pw:
GDS
<Lastname>
<Bookingcode>
Traveler
Travel/airlineagentaccess
§ Traditionallyoverdirectconnections§ TodayaswebservicethatconnectsovertheopenInternet
§ Passwordsoftenterrible
Traveleraccess
§ Forgottoassignusernamesorpasswords,oops!§ Let’suselastnameasusername;andbookingcode/PNRlocatoraspassword
§ These“passwords”cannotbechangedandarewidelysharedbetweenoperators
Authentication:Fail
Login:
Das Logo Horizontal
— Pos / Neg
3
PNRscanbegatheredoffline
10
Das Logo Horizontal
— Pos / Neg
3
PNRscanbegatheredonline
11
Instagram Traveldetails
Das Logo Horizontal
— Pos / Neg
3
§ Fine-grainedaccesscontrol
§ Strongauthentication
§ Rate-limiting
§ Logging
?
?
?
?
Arebookingsystemsprotectedwithbasicsecuritycontrols?
12
Webservicesecuritybasics
Das Logo Horizontal
— Pos / Neg
3
Flighttheft
Milediversion
Privacyintrusion
Phishing
Travelers’privateinformationisaccessible
13
PNRabuse AnybodywithaccesstothePNRlocator(6-digitnumber)andlastnamecanaccess:§ Identitydetails;possiblyincludinghotelsandcarrentals§ Frequentflyerdetails§ Contactinformation:Phonenumber,e-mailaddress,oftenpostaladdress§ Oftendateofbirthandpassportdetails
Agents(orhackers)withdirectGDSaccessalsosee:§ Paymentinformation:Creditcard#andexpiry§ IPaddress(ifbookedonline)
Stalking
Tracking
Photoofluggagetagorboardingpass
Lastname PNRbruteforcesearch
Privacyintrusion
AbuseScenarios
Traveldetails,contactinfo
Das Logo Horizontal
— Pos / Neg
3
Flighttheft
Milediversion
Privacyintrusion
Phishing
Fraudsterscanpossiblystealflights
14*Miscellaneouschargesorder
§ AirlinestypicallyonlyauthenticatepassengerswiththePNRlocator,evenforticketchanges
§ Differentairlinesallowdifferentactions:– Allallowdateandflightchanges(atleastonsometickets)– Fewallownamechanges– Mostallowsomeformofrefund,oftenforacoupon
AbuseScenarios
Bruteforcesearchticketsforcommonname
RefundforcreditinPNR
RefundforMCO*Flyforfree
Booknewflightwithcredit
PNRabuse
Changename,e-mail,anddate
Changee-mailanddateandtaketheflight(onanairlinethatdoesnotcheckID)
Selectflexibleticket
Das Logo Horizontal
— Pos / Neg
3
Flighttheft
Privacyintrusion
Phishing
MilediversionMilediversion
§ Addingamilesnumber(withtherightname)toabookingdivertsavictim’smiles
§ Milescanberedeemedforfreeflights,hotelnights,orgiftcertificates
Milescanbestolen,fullyremotely
15
PNRabuse
AbuseScenario
Bruteforcesearchforcommonname
Selectsexpensivetickets
Createmilesaccountinpassengername
Addorchangemilesaccountinbooking
Convertonredeemcollectedmiles
Example
EU-AustraliaRound-tripFirstclass
10,000milesx2x3
60,000miles~900USD
Das Logo Horizontal
— Pos / Neg
3
Allpathtoabookingneedtobesecured
16
AmericanAirlinesasksforfirstname ViewTrip+TripCaseprovidealternativepathw/ofirstname
1.Brute-forcePNR+lastnameonViewTrip
2.CheckdetailsonTripCase
Das Logo Horizontal
— Pos / Neg
3
PNRscanbeguessed
17
Guessability
Sequential
Amadeus
✓
Sabre
✗
Galileo
Entropy
28.6bits:§ 1st digit:2-8,X-Z§ 2nd:Dependson1st (38of340combinationsinvalid)
§ 2nd-6th:2-9,A-Z
28.2bits:§ 1st-6th:A-Z§ (Namespacesplitbyairline)
28.9bits:§ 1st:1-9,A-Z(exceptF-I,O,U,Y)§ 2nd -5th:0-9,B-Z(exceptE,I,O,U,Y)§ 6th:0-9,A-Z,butlastbitignored!
Brute-forcesusceptibility
Airlines(examples)
Lufthansa§ Standard:§ Mobile:
Captchamax30rqs/IP
AirBerlin
max1,000rqsà Captcha
AmericanAirlines✓ +Firstname
Aeroflot
✓
Notreallyusedbyairlines,butinsteadbybookingagents
GDS-provided
CheckMyTrip
§ Classic:§ Current:
killedineffectiveCaptcha,
max1,000requests/IP
VirtuallyThere
§ DirectPNRaccessforsomeairlines(e.g.Etihad),forothers:redirecttoairlinewebsite(e.g.AA,Aeroflot)
✓
ViewTrip
✓
✓
✓à
✓ à
Helpsagainsttargetedprivacyintrusion,butnotfraud
Das Logo Horizontal
— Pos / Neg
3
§ Fine-grainedaccesscontrol
§ Strongauthentication
§ Rate-limiting
§ Logging
?
?
?
?
Arebookingsystemsprotectedwithbasicsecuritycontrols?
18
Webservicesecuritybasics
Das Logo Horizontal
— Pos / Neg
3
Flighttheft
Milediversion
Privacyintrusion
Phishing
Datadisclosureexposestravelerstotargetedattacks
19
§ Duetotheirsequentialnature,fraudsterscanfindrecentlycreatedPNRs
§ Andthensendverytargetedphishinge-mails
AbuseScenario
PollforcommonlastnameandrecentPNRs(inaGDSwherePNRsaresequential)
Fetche-mailaddressfrombooking
Phishforfrequentflyerloginorcreditcardinformation
PNRabuse
Phishing
From: LH.com [email protected]: Booking Details | Departure: 22 August 2016 | TXL-MUC | Reservation code: Z8JC8RDate: August 7, 2016 at 18:55To: [email protected]
Lufthansa booking code:
URGENT: Please update yourpayment information
33C3PO
SANDIEGO / CARMEN MS
Miles & More: XXXXXXXXXXX0054
Ticket no.: 220-2376788232
* Seat reservations are not binding and may be changed without notice in case of aircraft change.
Passenger Type Price Taxes, fees &surcharges
Passengers
07:0 0 h MUNICH DE MUNICH INTERNATIONAL (MUC) TERMINAL 2
08:1 5 h HAMBURG DE (HAM)TERMINAL 2
Status: confirmed Seat: 03A*
Class/fare: BUSINESS (Z)
Adults OPC
222.00 € 83.67 € 1
If you cannot view this e-mail properly, please open the attached PDF version.Do not reply to this e-mail.
Additional support is available via the FAQs.
URGENT NOTICE: Your payment has been rejectedIMPORTANT: The following transaction has been rejected, so we are unable to process payment for your trip to HAMBURGDE (HAM) on 31 December. Your reservation is currently ON HOLD FOR 24 HOURS. Please update your paymentinformation to confirm your reservation.
Passenger Information
Receipt and additional documents
NOTE: Your receipt for this itinerary cannot currently be provided. PLEASE UPDATE YOUR PAYMENTINFORMATION.
Option for download is valid up to 90 days after end of travel.
Your itinerary
Sat. 31 December 2016: MUNICH DE - HAMBURG DE
LH2060operated by: LUFTHANSA
Total Price of your Ticket
Total Price of yourTickets
305.67 €
5.04 €
Total Price for all Passengers 310.71 €
From: LH.com [email protected]: Booking Details | Departure: 22 August 2016 | TXL-MUC | Reservation code: Z8JC8R
Date: August 7, 2016 at 18:55To: [email protected]
Lufthansa booking code:
URGENT: Please update yourpayment information
33C3PO
SANDIEGO / CARMEN MS
Miles & More: XXXXXXXXXXX0054
Ticket no.: 220-2376788232
* Seat reservations are not binding and may be changed without notice in case of aircraft change.
Passenger Type Price Taxes, fees &surcharges
Passengers
07:0 0 h MUNICH DE MUNICH INTERNATIONAL (MUC) TERMINAL 2
08:1 5 h HAMBURG DE (HAM)TERMINAL 2
Status: confirmed Seat: 03A*
Class/fare: BUSINESS (Z)
Adults OPC
222.00 € 83.67 € 1
If you cannot view this e-mail properly, please open the attached PDF version.Do not reply to this e-mail.
Additional support is available via the FAQs.
URGENT NOTICE: Your payment has been rejectedIMPORTANT: The following transaction has been rejected, so we are unable to process payment for your trip to HAMBURGDE (HAM) on 31 December. Your reservation is currently ON HOLD FOR 24 HOURS. Please update your paymentinformation to confirm your reservation.
Passenger Information
Receipt and additional documents
NOTE: Your receipt for this itinerary cannot currently be provided. PLEASE UPDATE YOUR PAYMENTINFORMATION.
Option for download is valid up to 90 days after end of travel.
Your itinerary
Sat. 31 December 2016: MUNICH DE - HAMBURG DE
LH2060operated by: LUFTHANSA
Total Price of your Ticket
Total Price of yourTickets
305.67 €
5.04 €
Total Price for all Passengers 310.71 €
Das Logo Horizontal
— Pos / Neg
3
GuessabilityissuesarenotlimitedtolargeGDS
20
SITA§ Only4digitstoguess,plusonedigitforairline
OmanAir (Sabre) PakistanInternationalAirlines (Sabre)§ Wontheraceforeasiestguessability
§ Guessonecityinitineraryinsteadoflastname(Muscat,duh!)
RyanAir(Navitaire,anAmadeussubsidiary)§ UnevendistributionmakesiteasiertoguessPNR
§ Guess4creditcarddigitsinsteadoflastname
Othernoteworthysystemswedidnotlookat:§ MACS(Emirates)§ Troya(TurkishAirlines)§ HPShares(United,andothers)
Das Logo Horizontal
— Pos / Neg
3
PNRaccessisnotlogged
21
Logging/accountability:Fail
§ Foryears,questionswereraisedoverwhoisaccessingPNRs
§ Untiltoday,GDSprovidersrefusetologreadaccesstothisprivatedata(writeaccesshasalwaysbeenlogged)
§ Canmoreresearchmotivatefinallyaddingloggingandmaketransparenttotravelerswhoaccessestheirinformation?
Das Logo Horizontal
— Pos / Neg
3
§ Fine-grainedaccesscontrol
§ Strongauthentication
§ Rate-limiting
§ Logging
?
?
?
?
Bookingsystemslackbasicsecuritycontrols
22
Webservicesecuritybasics
Das Logo Horizontal
— Pos / Neg
3
Weneedbetterprotectedbookingsystems
23
Insummary Whatweneed
Coarseaccesscontrol
§ Afewglobaldatabaseskeepinformationontravelers,insystemsthathavegrownfordecadesandnowlackmodernITsecurity
§ Limitationsonwhichagents(andgovernments!)canaccesswhatinformation
Weakauthentication
§ Passengersauthenticateonlywiththeirlastnameandalow-entropy(oftensequential)bookingcode,whichisalsoprintedonpassesandtags
§ Passwordsforbookings
Insufficientratelimiting
§ Numerouswebinterfacespermitbrute-forcingofthesebookingcodes,puttingtravelers’privacyatrisk
§ Minimumwebservicesecurityforallexposedinterfaces
Nologging§ Travelerswillneverknowwhoaccessedtheirinformation,sincePNRaccessisintentionallynotlogged
§ Strictloggingofanyaccesstopersonalinformation
Das Logo Horizontal
— Pos / Neg
3
Thankyou!
24
Questions?KarstenNohl<[email protected]>
NemanjaNikodijević<[email protected]>
ManythankstoLucaMelette,SebastianGötte,andPatrickLuceyformakingthisresearchpossible!
ThankyouEdHasbrouck,HendrikScholz,andSethMillerforveryvaluablefeedback!