An adversarial approach to Airline Revenue Management
Where
Proving Ground
BSides Las Vegas
Duration
25 min
Explains how airline fares, ticketing and revenue management work, and where their pricing logic can be abused.
Summary
The talk opens with why the airline industry is structured the way it is. The speaker covers the regulatory backdrop of bilateral air agreements and traffic freedoms, and explains how airlines use revenue management to fill seats and raise earnings. He frames the session as a black-box view built from personal experimentation rather than insider experience.
The middle section walks through published fares, routing rules, permitted mileage limits and advance purchase restrictions. It distinguishes a reservation from an electronic ticket and describes the roles of validating, marketing and operating carriers. Inventory booking classes are shown as the mechanism that caps how many seats each fare can sell. Fuel surcharges are examined as a weak point, with examples of how surcharge rules have been sidestepped by issuing tickets through another carrier or by adding segments. Related practices such as hidden-city ticketing, currency-based arbitrage and mistake fares are also discussed.
To close, the speaker points to agency debit memos as the industry's main enforcement lever. He suggests that fraud and revenue integrity teams could use pricing data and analytics to spot abuse, which ranges from minor gaming to account takeover and seat hoarding. The main takeaway is an introductory understanding of how fares are built and how their rules can break, giving practitioners a foundation for more specialised discussion.
Related talks
Talks·49 min
Joshua DeWald
Walks through layers 2 to 7 of networking and shows how framing and routing confusion enable attacks like request smuggling.
Proving Ground·23 min
Ben Kofman · Ali Kabeel
Walks through four ways attackers can exploit SaaS data platforms, from access control flaws to abusing serverless scaling.
Main Stage·20 min
Robert Kruczeck · Kamit Szczurowski
Two Polish researchers walk through unauthenticated code execution flaws they found across government websites and the vendor disclosure fights that followed.


