"Finding Tony Abbott's Passport Number and entering the Do Not Get Arrested Challenge 2020"
summary
A photo of a boarding pass yields a six‑character booking reference, used on the airline’s “manage booking” page; right‑clicking and using inspect element reveals JSON with SSR codes, a phone number and what matches a passport number exposed and DOB. The backend (Amadeus) and Qantas are notified, ASD takes the report, Qantas patches the issue months later, permission to publish is granted by the subject’s office, and no charges follow.
AI-written summary · about
chapters (10)
- 0:00Introduction and setup
- 1:32Purplecon and hacker culture
- 2:35Red team work at Atlassian
- 4:41Finding Tony Abbott's boarding pass
- 14:56Entering the Do Not Get Arrested Challenge
- 22:54Reporting to government and Qantas
- 31:14Contacting Tony Abbott's team
- 38:53Permission to publish the blog post
- 40:15Publishing and public reaction
- 51:13Q&A session
related talks
27mNew Phone, Who Dis?: Human Authentication in the Digital Age
43mNew Phone, Who Dis: Human Authentication in the Digital Age
25mOne Year on with Passkeys: Air New Zealand's Insights and Learnings from a Global Rollout
49mBugs on a Plane: Implementing a Bug Bounty in an Airline IT/OT Environment
46mD1T1 - Abusing The Travel Industry
20mPassport App: The role of SPIFFE and SPIRE in a return to work solution
32mYou have 2 seconds to respond - Atob
25mThe Case Against Passwords: Biometric Authentication for SCA and the Pathway Forward