Incident
incident:passport_number_exposure
Exposure of Tony Abbott's passport number and other personal information through Qantas booking data and publicly posted boarding-pass details.
Exposure of Tony Abbott's passport number and other personal information through Qantas booking data and publicly posted boarding-pass details.
“I think I have the former prime minister’s passport number.”
“I found the former prime minister’s passport number.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INITIAL_ACCESS_VIA | boarding pass | Explicit | 84 |
| outgoing | INVOLVES | Qantas | Explicit | 84 |
| outgoing | INVOLVES | Tony Abbott | Explicit | 84 |
| outgoing | INVOLVES | Alex | Explicit | 84 |
| outgoing | INVOLVES | HTML | Explicit | 84 |
| outgoing | INVOLVES | JSON | Explicit | 84 |
| outgoing | INVOLVES | Special Service Request | Explicit | 84 |
| outgoing | INVOLVES | CTCM | Explicit | 84 |
| outgoing | INVOLVES | Australian Signals Directorate | Explicit | 84 |
passport number exposure INITIAL_ACCESS_VIA boarding pass
The exposure began when Tony Abbott publicly posted a photograph of his boarding pass, which supplied information used to access the booking.
Explicit Direction flagged Confidence 99% · Jack Rhysider EP 84 Details
“By posting your boarding pass, someone can use that information to log into the airline’s website”
passport number exposure INVOLVES Qantas
The incident involved access to Tony Abbott’s Qantas Manage Booking page and exposure of information in that page.
Explicit Confidence 99% · Jack Rhysider EP 84 Details
“Alex was now logged into Qantas Airline’s [00:10:00] website as the former Australian Prime Minister Tony Abbott”
passport number exposure INVOLVES Tony Abbott
The incident concerned Tony Abbott’s boarding pass and exposed personal information associated with him.
Explicit Confidence 99% · Alex EP 84 Details
“I think I have the former prime minister’s passport number.”
passport number exposure INVOLVES Alex
Alex investigated the boarding pass, accessed the booking page, found the exposed information, and reported it.
Explicit Confidence 99% · Jack Rhysider EP 84 Details
“Alex took on the challenge of hacking the former PM Tony Abbott’s boarding pass”
passport number exposure INVOLVES HTML
The exposed passport and phone information was present in the HTML source of the booking page.
Explicit Confidence 98% · Jack Rhysider EP 84 Details
“someone can use that information to log into the airline’s website and click View Source and see your birth date, passport number”
passport number exposure INVOLVES JSON
The page source contained a large section of JSON data that included the exposed booking information.
Explicit Confidence 98% · Alex EP 84 Details
“there was this big section of JSON, this big section of data just in the page”
passport number exposure INVOLVES Special Service Request
The incident involved airline Special Service Request data containing a phone number associated with the passenger.
Explicit Confidence 98% · Jack Rhysider EP 84 Details
“It turned out that Alex had found a section of the code called SSR for Special Service Request.”
passport number exposure INVOLVES CTCM
The incident involved a CTCM note in the airline data that contained the passenger’s phone number.
Explicit Confidence 98% · Jack Rhysider EP 84 Details
“one of the notes started with the code CTCM”
passport number exposure INVOLVES Australian Signals Directorate
The incident was reported to the Australian Signals Directorate, which requested more information and said it would take over handling the matter.
Explicit Confidence 99% · Alex EP 84 Details
“Here’s this e-mail address where you can report this to ASD.”