Travel Booking Systems Expose User Data: Researchers
The lack of proper security mechanisms in travel booking systems exposes passengers’ personal information and allows fraudsters to steal tickets and loyalty bonuses, researchers have warned.
Last week, at the 33rd Chaos Communication Congress in Hamburg, Germany, Karsten Nohl and Nemanja Nikodijevic of Security Research Labs detailed the vulnerabilities affecting major travel booking systems and demonstrated how easily they can be exploited.
Their analysis has focused on Global Distribution Systems (GDS), which serve as a central point for service providers (e.g. airlines, hotels, travel agencies) to manage reservations. The records stored by these systems, called passenger name records (PNR), can include information such as name, contact information, ticket data, itinerary, passport number, date of birth and even payment information. The world’s top GDS providers are Amadeus, Sabre and Travelport.
