NOS: KLM passengers’ private data was easy to collect

The personal flight information pages of KLM customers were easy to collect and view by unauthorized persons. This is evident from research by NOS. This often contains telephone numbers, e-mail addresses and in some cases passport details. The leak has now been resolved.

The NOS and security researcher Benjamin Broersma managed to scrape more than 900 working URLs with personal flight information of customers ‘in a few hours’. so writes the medium on Monday morning. This often also contained private information. In addition to e-mail addresses and telephone numbers, in some cases passport data could also be viewed. The flight information pages also included the option to edit and delete passport and visa information, although NOS did not test whether this was actually possible. KLM did not want to confirm that either. The data breach also affects Air France customers.

The URLs in question are sent by KLM to customers by SMS. These flight information hyperlinks are personalized with six characters, so they can easily fit into a text message. These therefore turned out not to be unique enough. It is possible to introduce such links on a large scale. On average, 1 in 100 to 200 automatically entered links were actually valid, NOS reports.

The KLM and Air France links use upper and lower case letters and numbers, allowing at least 56.8 billion different combinations. According to the most conservative estimate from the NOS, about 0.5 percent of the combinations tried worked. Extrapolated, that would amount to approximately 284 million correct combinations. However, it is unknown how many working flight info pages there actually are. KLM did not want to confirm this to the NOS.

KLM resolved the security problem on Friday afternoon. The airline did this within a few hours after being informed of the problem by NOS. People who now access a valid link must first log in to the My Travel environment of KLM or Air France. It is not known whether the vulnerability has been exploited. According to KLM, the system ‘already raised the alarm’ due to the ‘large amount of suspicious activity’ from the NOS and Broersma investigation. However, they say they made no effort to conceal this activity. The IP addresses used by NOS and Broersma were blocked after more than five hours.