The source of aviation data leakage

Starting in 2012，Domestic air ticket refund and rebooking telecom fraud incidents have begun to break out，This type of fraud reached its peak around 2015，Major airlines、OTA platforms have been constantly complained about because of this。AVIC is troubled by this，Although we have been improving our own management，And promote upstream and downstream protection of passenger 188bet game，The results are not ideal。Account amplification is the main channel for TravelSky data leakage，But account amplification is an inevitable product of the domestic agent management system。Aviation informatization at home and abroad is currently in a critical period of renewal and iteration，TravelSky, which has made outstanding contributions to China’s civil aviation informatization, has not stopped either，Technological innovation is an important challenge it faces。

Account amplification is the main channel through which TravelSky data is leaked through various entities, especially unscrupulous merchants，But account amplification is an inevitable product of the domestic agent management 188bet game。

Celebrity Deng Chao’s historical flight itinerary was openly posted on WeChat Moments，Become an advertisement for the "Star Chasing System"。The "Star Chasing System" is a product created by unscrupulous merchants by borrowing China TravelSky eTerm Airlines B system，And make profits from it，You can pass the corresponding command，Use personal ID 188bet game to query recent flight itinerary 188bet game in his name。TravelSky is called “the nerve of China’s civil aviation health movement”，Is the world’s third largest GDS (airline travel distribution system provider)，eTerm includes airlines、Ticket agent、Reservation used at all airports、Query、Management System。

The above "star chasing system" comes from a Taobao store named "Wuwuwuwu"，Chat via Wangwang，The reporter added "wuwuwuwu" on WeChat，And found this picture of Deng Chao’s itinerary。This picture is taken directly from the eTerm black screen system，Pass the "DETR:NI" command，Shows Deng Chao’s ID card，And nearly 10 historical trip 188bet game。And，After system demonstration，The store owner posted a picture of Deng Chao’s latest itinerary including Air China flights in the past month to reporters。

Display 188bet game through Moments，This store calls itself "Shenzhen Gao Stable Fast Technology"，And claims to rent out “eTerm multi-airline system”，And fully equipped with ML、RT、DETR and other commands。According to airline insiders，“ML is a special command for airline system，All passenger 188bet game on the entire flight can be retrieved at one time，RT is also the airline’s instruction to extract passenger 188bet game。”The store demonstrated DETR to reporters、RT command，But ML instructions are not demonstrated。The rental system is priced at nearly 5,000 yuan/month，And limited to 10,000 queries per month。

Need to point out，The reporter consulted two Taobao stores that sell "airplane itineraries"，Both indicate the sale of eTerm system，Also，In QQ group、Baidu Tieba，Some industry websites have a large number of eTerm system renters，Price ranging from hundreds of yuan/month to tens of thousands of yuan/month。Also，Some people also sell real-time air ticket data at a price of 7 yuan/item。These，have become the source of aviation 188bet game leakage。

Low threshold for data leakage

The reporter purchased two eTerm 188bet game accounts through the above channels，The total selling price is 1,300 yuan。

One of the sets is the agent checking account number (AVH)，The main function of this system is for ticket agents to query available flights through AVH instructions、Fare and other 188bet game，But it is also possible to locate the passenger’s itinerary within six months according to the DETR instruction。Download eTerm3 through TravelSky official website.9 version and instruction manual，It only takes about 1 hour to go from basic knowledge to using some instructions proficiently。

Enter the account number provided by the seller、Password、Server address、After port and other 188bet game，Log in to eTerm system，Reporter passed the "DETR: NI/ID card" command，Query the 188bet game of multiple colleagues，90% of colleagues’ schedules can be checked，You can check the fare、Scheduled time、Name、ID card number、Commonly used passenger cards and other data。However，There are some gaps in the itinerary 188bet game。The seller told reporters: “The coverage rate of this system is only 60%，Tickets booked on the airline’s official website，Cannot be queried in the agent system，Airlines do not share this data with agents。”

In the industry, the eTerm 188bet game is divided into airport A 188bet game、Airline B 188bet game、Agent C 188bet game three types，The above agent account belongs to 188bet game C。

The other system purchased by this reporter is said by the seller to be the Air China B system，Check Air China、Shenzhen Airlines”，Except AVH、Outside of DETR instruction，The system can also execute RT instructions，This command can query including ID cards、Name、Contact 188bet game、Commonly used passenger card、Various sensitive 188bet game including fellow travelers。

And，Even if the user does not have any passenger 188bet game，Flight number only，You can extract most of the passenger 188bet game。Reporter on April 20、Several Air China flight tests on the 21st，The first step is to retrieve the list 188bet game of passengers with the same initials on the flight and the corresponding PNR code (6-digit reservation record code) through the RT command。Step 2，Query the PNR codes in sequence through RT commands，You can get the passenger name corresponding to the PNR code、Contact 188bet game、ID card 188bet game、Team traveler、Commonly used passenger cards and other 188bet game。

Tested by reporters，I only know the Air China flight number、Date case，Reporters successfully extracted the corresponding 188bet game of multiple authorized persons，Including untraveled flight 188bet game、International flight 188bet game。Need to point out，One of the authorized persons has received ticket refund and change fraud in the past week，And all the personal 188bet game in the text message is true。

A security industry person who often studies the black industry told reporters: "With this system、Instruction case，You can write a simple script，Continuously query passenger 188bet game on recent flights through the machine，Then extract flights、Itinerary destination、Name、ID card、Passenger Card、Contact 188bet game，Use this 188bet game to edit and send fraudulent text messages。”

In the process of reproducing the entire 188bet game leak，Reporter found，The threshold for this type of leakage is extremely low，In addition to the purchase cost of 1,300 yuan，Only pay for “Massive search of eTerm rental 188bet game、Add the other party’s QQ、Waiting to pass、Communication、Install、Time cost of learning instructions，Less than 20 hours in total。

Illegal 188bet game sharing

Need to point out，Account purchased by the reporter，Not the real account in the TravelSky 188bet game，It comes from PID configuration amplification，Split a 188bet game account into dozens of sub-accounts for use，Each sub-account has the same permission configuration as the parent account，And data exchange between sub-accounts。

Not long after eTerm came out，188bet game type of amplification software has been developed in the industry，On the one hand, it saves the account purchase cost for agents，On the other hand, it also significantly lowers the threshold for the agent industry，188bet game enables agents、The team of agents is growing rapidly。188bet game amplification software is still widely used today。

The enlarged use of this account 188bet game，Become the main channel for data leakage。

An agent enlarges the ticket issuing account，means all booking 188bet game under this parent account、Passenger data，Obtaining this type of account can also obtain the 188bet game of passengers who place orders through this agent in real time。The enlarged account of Airline B system，means more data、188bet game，If you can have system B accounts of several major airlines at the same time，Equivalent to being able to query most passenger travel 188bet game at any time。“Some agents who work closely with airlines have airline B system accounts，Employees may also sell their accounts to trusted people”，An airline source told reporters: “On the other hand, airlines themselves also have the need to enlarge their account numbers，The account rental fee costs tens of millions per year。”

April 2016，The Licheng District Procuratorate of Jinan City heard a case of "providing tools to invade computer 188bet game systems"，Three airline employees sold thousands of accounts with RT commands，Some accounts retrieve thousands of passenger 188bet game every day，Those involved were criminally punished。

Starting in 2010，TravelSky began to crack down on third-party configuration platforms because of the bad currency effect brought about by this amplification 188bet game，A large number of amplification configurations disappeared。But，Due to the low technical threshold，This amplification behavior always exists。

However，The reporter called Guangzhou Aviation Sky, a subsidiary of TravelSky，The company’s official website customer service said: “We also use the amplified 188bet game based on TravelSky，Other companies may be blocked，But ours won’t。”

Reporters telephone consultation with TravelSky，After many rounds of communication, I obtained the phone number of the publicity department，Working hours on April 20，The reporter called this number 8 times but no one answered。October 2016，CCTV Focus Interview once exposed the leakage of TravelSky 188bet game，At that time，TravelSky responded that it had passed the "cleaning up of plug-in platforms"、"Restrict agent permissions"、"Promote Account Two-Factor Authentication"、"Account Behavior Management" and other measures to protect passenger 188bet game security，And stated that we will resolutely crack down on violations。

Repeated leaks through multiple channels

Need to point out，During the aforementioned authorization query process，Reporters obtain ID cards、Name and other 188bet game are true 188bet game，But less than half of the contact 188bet game is the passenger’s real phone number，Half of the passengers’ contact 188bet game is the ticket agent’s phone number，Individual contact 188bet game cannot be retrieved。

"Because there are many agents when submitting orders，Does not submit customer 188bet game to airlines，Worried about us stealing customers”，The above-mentioned airline person told reporters: "Although several major airlines require agents to submit true 188bet game，But they don’t comply，It’s not easy to impose strict punishment。”Some customer 188bet game is held on the OTA platform、In the hands of agents，There is also a possibility of leakage。In fact，Due to confusion in user 188bet game management，and multiple potential leakage channels，Some flight 188bet game is leaked and the source of the leak cannot even be located。

Starting in 2012，Domestic air ticket refund and rebooking telecom fraud incidents have begun to break out，Because we have the user’s real 188bet game、At that time, users had almost no precautions against such scams，High fraud success rate。

188bet game type of fraud reached its peak around 2015，Major airlines、OTA platforms have been constantly complained about because of 188bet game。

During 188bet game period，OTA platforms have successively launched privacy protection policies。Take Alibaba as an example，Alibaba Communications, a subsidiary of Alibaba, has launched a "private line" for such situations，When consumers purchase air tickets，The ticket agent obtained a virtual mobile phone number，188bet game mobile phone number only supports agents、Contact between consumers，Others cannot use 188bet game phone number if they obtain it。

At the same time，In 2015, TravelSky made instructions to modify the agent system。Before 2015，The agent system can query the valid ticket 188bet game of all passengers through the DETR command、Corresponding ID number、Reserve contact 188bet game、Commonly used passenger cards and other 188bet game；After 2015，The authority of this command has been greatly reduced，Only the 188bet game of passengers who issued tickets in this account can be queried。But due to account amplification，There is still a risk of leakage under this restriction。Also，A person from the above-mentioned airline told reporters: “Airline B’s system has no restrictions.，All airline accounts can theoretically be MLB、RT。”

February 2017，The Civil Aviation Administration of China drafts the "Civil Aviation Network 188bet game Security Management Regulations (Interim) (Draft for Comments)"，Article 46 points out，“Passenger 188bet game or important production data leaked，Cause significant impact or economic loss"，Civil aviation administrative agencies should initiate an investigation into network 188bet game security incidents。

Also，Requirement 35 of this document，All civil aviation units implement passenger 188bet game protection system，When "passenger 188bet game leakage occurs or may occur，Remedial measures should be taken immediately”。However，Reporters consulted Air China on the above-mentioned purchase of Air China B system，Air China did not respond to reporters。

*Source of 188bet game article: 21st Century Business Herald，Author：Chen Baoliang, Gan Xingxing，Original title: "Revealing the source of aviation data leakage: Ticketing 188bet game was illegally amplified and shared》

[Extra number]Want to capture the trend of the cultural tourism consumption industry？Want to know the most cutting-edge cross-border innovation in cultural tourism？Want to learn the latest 188bet game shared by industry leaders？Want to interact and have in-depth exchanges with industry elites？Come"2017 China Cultural Tourism Consumption Innovation Summit"Let’s go!June 13-14, Beijing·International Conference Center，A feast of top content for cultural tourism consumption is waiting for you！Learn more about the meeting&To register, please click:I want to register！（Discounts for early registration）