When people travel the world, agents working on their behalf typically use one of three major Global Distribution Systems (GDSs) to store information related to hotel and airline reservations. According to researchers from Security Research Labs, these travelers and service providers have reason to worry about booking systems security. The Berlin-based research team delivered a critical analysis of the threat models used in GDS at the 33rd Chaos Communication Congress in Hamburg, Germany.

Booking Blinders

GDS originated in the mainframe and leased-line era, and it approaches security with all the blinders typical of that time period. The idea of a centralized data repository comes from a mainframe mindset. The idea that nonservice users would ever touch GDS, however, apparently did not occur to the designers. They didn’t account for the possibility that employees might use multiple access paths to query information.

Eventually, developers came up with an authentication mechanism for passenger name records (PNR) that would be easy for the service providers to use. It consists of the passenger’s last name added to a six-character alphanumeric string called the booking code. The code is often generated sequentially, as opposed to randomly.

That in itself is fine, but the system uses the code in nonsecure ways. It is usually printed right on boarding passes and baggage tags, for example. If an attacker can somehow obtain this booking code, they can easily piece together the entire authentication token.

Brute-Forcing Booking Systems Security

Attackers can also use a brute-force attack here since GDS systems do not generally limit requests. Fraudsters can simply keep banging on a portal’s input until they exhaust all possible data combinations.

The researchers offer some advice for better booking systems security. “In the short term,” they wrote, “all websites that allow access to traveler records should require proper brute-force protection in the form of Captchas and retry limits per IP address.”

GDS Firms Hold Firm

When contacted by SecurityWeek, GDS firms downplayed the booking systems security issues. Sabre, for example, said in a statement that it had multiple security systems in place but would not discuss them for fear of inadvertently sharing critical information with cybercriminals.

It’s possible that the GDS systems are actually better defended than the researchers claimed. There’s no denying, however, that they lack an effective method of logging PNR. Should an attacker breach a GDS system, the firm would have no record to prove it happened.

Though old GDS systems are still functional, they certainly need significant upgrades to run smoother and more securely than they do now.