United Airlines Frequent Fliers Find Security Lapse

United Airlines has suffered a glitch in their security system that would allow users to literally shift points to themselves and score free flights worldwide.

A glitch in United Airlines' Web site exposed customers' frequent-flier account information to site visitors, the company confirmed Friday. A number of customers said that starting Thursday night they were inadvertently kicked into someone else's Mileage Plus account when they tried to log in to their own accounts on the site. Once in the accounts, the site visitors could see other customers' names, mileage balances and travel history since the start of the year, according to one customer...

Copyright 2001 Knight Ridder/Tribune Business NewsCopyright 2001 Contra Costa Times

Contra Costa Times

July 21, 2001, Saturday

KR-ACC-NO: CC-UNITED-AIRLINES

LENGTH: 467 words

HEADLINE: Frequent Fliers Find Security Lapse on United Airlines Web Site

BYLINE: By Janet Adamy

BODY:

Another customer, complaining about the problem on the Internet chat board FlyerTalk, suspected the glitch allowed visitors to book trips using other people's accrued flier miles. United could not confirm whether this was possible but said it was not aware that anyone's flier miles were stolen as a result of the problem.

Airline spokeswoman Whitney Staley could not say how long the problem lasted or how many people were affected. But she said it was not widespread and was fixed as of Friday. About 10 people on the FlyerTalk board complained they easily accessed other people's accounts, some doing it as many as eight times.

When Clayton resident Chuck Blaisdell used his Mileage Plus number to log into United's site Thursday night, he was instead routed into the account of someone who had spent the night in a Pleasanton hotel. In addition to seeing their name, mileage balance and travel history, he believes he was just a click away from stealing the person's mileage credits.

"I could have booked a ticket and changed the name to mine, and the miles would have been deducted out of his account and I would have had a free ticket," said Blaisdell, a minister. But he didn't try.

Blaisdell said he thinks it may have been possible to get at the person's credit card number, too. United denies this.

Blaisdell, who flies between 40,000 and 50,000 miles a year, said the glitch makes him nervous about using the site. He used to book his tickets using a United software program that connected him directly to the airline's database and was "literally 10 times faster than the Web site." But United told him a month ago it was canceling the software as of Friday, he said.

Some customers complained on FlyerTalk about having the mistaken impression that they had a glut of miles. Most were simply concerned that their accounts were vulnerable.

"This is totally unacceptable," said a poster from Orange County who used the name "auh2o." "Anyone who gets my account could have a great time booking tickets."

United is one of the biggest carriers in the Bay Area, flying out of both Oakland International Airport and San Francisco International Airport.

SNP.