Ah, travel. Do you remember traveling
Travel was when we were visiting "other places" at a time when the US was not literally banned from the rest of the world. And often in preparation for trips we would post pictures of our boarding pass on social media to show to our friends and, more importantly, anonymous internet strangers.
It turns out this was and was a terrible idea since the internet is dark and full of hackers. Or, in this case, someone in Australia who knows how to access the "Check Item" option on a website's drop-down menu and use it to hack personal information about the country's former Prime Minister.
"So you know when you're freaking around at home, minding your own business, drinking from your water bottle in ways that have no intention of undermining the Commonwealth of Australia?" https: //t.co/ OCvJKODTTZ
& mdash; "Alex" (@mangopdf) September 16, 2020
As recorded in an extremely funny blog post, complete with YMCA Background music, Alex Hope, an Australia-based hacker and blogger, described his odyssey when he accidentally discovered the passport and phone numbers of former Australian Prime Minister Tony Abbott.
It all started when Abbott posted a picture of his boarding pass on Instagram in March, clearly showing the booking reference number (the photo has since been removed because duh).
As Hope found out, it is very easy to log into specific airline websites using just this information: a last name and booking reference. And voilà, Hope got their hands on the great Australian diplomat's fairly sensitive information, including what the airline said about Abbott, his phone number, and his diplomatic passport number.
This sent Hope through a wormhole of government email addresses and phone numbers in an attempt to inform those in power that he had captured this information fairly easily and that it was a problem. In the end, Hope said officials were correcting the problem.
When Hope reached out for a comment, he confirmed to Tips Clear that he wasn't a professional white hat hacker and the blog was basically just a fun side project, but that he is professional in computer security.
"I didn't have to use any similar computer knowledge to do this," he told Tips Clear on Twitter. "But to do something like that for work did Get in the habit of recording my screen when trying to commit a crime. "
Make yourself an easy target
While Hope's story is the latest (and funniest right now) documentation on how this type of identity theft works, it's been a well-known problem for a while.
Hope's hack was pretty low-tech (a simple right-click is enough), but there are sites out there that, according to Reader's Digest, can also simply scan a boarding pass barcode through the image.
In 2017 and 2018, both Forbes and tech blog Null-Byte pointed out that while some bad actors will go so far as to "socially develop" information (aka phish) from people, a simple search for it However, #boardingpass on Instagram will reveal thousands of potential goals. Even if no barcode or booking reference is available, only a frequent flyer number will work. Even Google Images indexes boarding pass images.
It doesn't take much to get people's personal information and screw up their lives with identity theft. So don't let vanity - or an obsessive desire for validation through social media - plunge you. Stop posting pictures of your boarding passes. Or at least obscure the important information when you need to show off to your friends.
Editor's recommendations
