The Skill Issue Institute is delighted to recognize Dr. Valid Until Revoked (Class of 2023) for a landmark study in professional loyalty: an uninterrupted working relationship with the airline industry lasting 1,140 days, from August 10, 2023 to September 23, 2026.
The engagement took place inside the Passenger Service System of a global travel technology provider whose name most travellers will never read, and whose software connects more than 400 airlines, 210 airport operators, 34 cruise and ferry lines and roughly 2 million hotels. Our Curriculum committee describes this arrangement as “the most successful vendor partnership in the history of things you agree to in a procurement meeting.”
The method was admirable in its restraint. No zero-day, no exotic memory corruption, no theatrical command injection. According to the notices issued by the affected carriers, an unauthorized party simply used login credentials assigned to an account in the provider’s system, and the account was glad to accept them. Cathay Pacific’s statement puts it with the flat honesty of a coroner: the party used log-in credentials assigned to its system account. Our Admissions department considers this a tour de force, because “valid credentials” is the one access control that never raises its hand in a design review.
What the Institute admires most is the duration. For 37 months the account behaved, by every metric the provider was collecting, like a model member of staff: it signed in, it read reservation records, it did not trip a single alarm. There is a discipline to that kind of quiet. Most alumni are reading someone’s data and someone’s dashboard within a fortnight; Dr. Revoked simply read, and read, and read, while three years of product releases, reorgs, and security awareness trainings passed overhead.
The disclosure that followed is now taught as a case study in sequencing. On September 21 the provider says it became aware of a vulnerability affecting a travel booking display environment; on October 1 it published a statement noting that no payment or financial data appeared to have been accessed and that there were no indications of ransomware exploitation. Then the telephone calls began, in date order, across the region: Korean Air and Asiana Airlines on October 20, Japan Airlines on October 23, Cathay Pacific on October 28, then All Nippon Airways, Jin Air, Condor, Malaysia Airlines and Star Flyer. The disclosed figures already total more than 180,000 records, with two carriers still not having given numbers, and Japan Airlines noting that roughly 2,000 of its affected customers also lost passport numbers, nationalities, frequent flyer numbers, and seat assignments, because a booking system that has your seat assignment clearly wanted to be thorough.
Containment was characteristically economical. Amadeus confirmed it reset the password for the affected account and implemented enhanced monitoring and detection capabilities. The Institute wishes to place on record that we consider a password reset to be a perfectly legitimate remediation, in the same way that installing a new lock on the shed is a legitimate response to the bicycle having left the premises some time ago, on an afternoon nobody was watching.
The pedagogical detail that has our Systems faculty genuinely delighted comes from reporting on the booking display environment. Researchers described the heap dump of a Spring Boot application being reachable through an endpoint that did not ask any questions. Inside the memory dump: access credentials, authentication tokens, and administrator passwords, which is roughly the security posture of a house that keeps its keys, alarm code, and deed in a bowl by the unlocked front door. The same reporting described passenger records being retrievable by searching a surname, with names, dates of birth, booking codes, and passport data returned in plain text.
“Our contribution was largely organizational,” Dr. Revoked explained at this year’s Third-Party Colloquium. “The credentials worked, the endpoint was friendly, and the dump was generous. We mostly just declined to interrupt the flow.”
Veterans of the Institute will recognize the cadence. In 2019, a flaw in the same provider’s reservation system allowed booking data from 141 airlines to be viewed and, remarkably, changed. This year a separate hotel-facing service exposed the reservation data of thousands of guests, with bookings covering stays running comfortably into 2027. The Institute is careful not to imply a pattern. Coincidence is simply more common in travel technology than travel technology is comfortable admitting.
One adjacent footnote, for completeness: All Nippon Airways suspended parts of its website and mobile app in the same fortnight for reasons connected to active exploitation of critical flaws in PHP. That belongs to our other faculty, no alumnus has claimed it yet, and we consider it unfair to grade two performances in one review.
Dr. Valid Until Revoked now joins the canon as a reminder to every current student: your most exposed system is the one a trusted partner is allowed to log in to, because nobody monitors a login they have already approved. A credential is innocent until it is revoked, and even then, it is worth checking who else has been quietly told to accept it.