An Australian hacker obtained Tony Abbott’s passport details and personal phone number using a photo of a plane boarding pass the former prime minister posted on social media.
On Wednesday, hacker Alex Hope revealed that he had managed to use a photo Abbott posted on Instagram in March to reveal a security flaw in the online check-in portal of the country’s national airline carrier, Qantas.
In a lengthy post on his blog, and as first reported by Gizmodo, Hope claimed that he had been able to use a reference number on the boarding pass to log in to Abbott’s online booking page with the airline.
He then used the page’s HTML code to find Abbott’s passport and phone number, as well as staff comments about the former prime minister’s seat requests.
Hope did not reveal the former prime minister’s details but instead spent several months trying to inform the airline, the Australian government and Abbott himself about the security breach.
In the blog post, Hope explained that when he managed to contact Abbott’s staff, the former prime minister called him personally to ask for recommendations for “a book about the basics of IT” saying he had recently felt “bamboozled” by Microsoft Teams.
“Mostly, he wanted to check whether his understanding of how I’d found his passport number was correct (it was). He also wanted to ask me how to learn about ‘the IT’,” Hope wrote.
“He asked some intelligent questions, like ‘how much information is in a boarding pass, and what do people like me need to know to be safe?’, and ‘why can you get a passport number from a boarding pass, but not from a bus ticket?’.
“It’s, I suppose, a terrible confession of how people my age feel about this stuff,” Abbott was quoted as saying.
“You could drop me in the bush and I’d feel perfectly confident navigating my way out, looking at the sun and direction of rivers and figuring out where to go, but this.”
Abbott, who was voted out of the Australian parliament at last year’s election, was recently appointed as an official UK trade adviser by prime minister Boris Johnson despite a backlash over his views on women, gay marriage and climate change.
Hope described the former prime minister’s sentiment as “possibly the most pure and powerful Australian energy a human can possess”, and said he was impressed by Abbott’s response.
“That’s exactly the right way to respond when someone tells you about a security problem,” he wrote.
“Back at the beginning, I was kinda worried that he might misunderstand, and think I was trying to hack him or something, and that I’d be instantly slam dunked into jail. But nope, he was fine with it.
“[I] realised he just wanted to understand what had happened to him, and more about how technology works. That’s the same kind of curiosity I had, that started this whole surrealist three-act drama.
“The point of this story isn’t to say ‘wow Tony Abbott got hacked, what a dummy’. The point is that if someone famous can unknowingly post their boarding pass, anyone can.”
In a short statement, a spokesman for Abbott said: “Mr Hope brought this to the attention of relevant bodies earlier this year, and it has since been resolved.”
Qantas said it appreciated Hope bringing the post to its attention “in such a responsible way, so we could fix the issue, which we did several months ago”.
“Our standard advice to customers is not to post pictures of the boarding pass, or to at least obscure the key personal information if they do, because of the detail it contains,” a spokesman for the airline said.