Teenage Hackers Buy Ducati After Stealing $300,000 Worth Of Airline Tickets

Teenagers hack and steal $300,000 worth of airplane tickets from website

What would you do if you have $308,000 USD worth of airplane tickets? Would you take a tour around the world or buy some expensive stuff for yourself?

A group of Indonesian teenagers along with an 27-year-old man managed to hack into Tiket.com, one of the popular online travel agents in Indonesia and steal Rp 4.1 billion ($308,000 USD) worth of airline tickets for the budget carrier Citilink Indonesia, the National Police said in Jakarta on Tuesday, April 4, 2017. The hackers then sold the stolen tickets on Facebook and used the funds to buy themselves expensive motorcycles.

In November last year, Global Network, the company behind Tiket.com, reported the case to the police when it suspected someone hacked into Tiket.com and stole tickets alloted for the low-cost airline, Citilink Indonesia.

Usually, airlines allot a ticket quota for each travel agent, where in the tickets are already paid in advance. In this instance, the teenagers hacked into the website and accessed Citilink’s ticket pool.

“The perpetrators had illegal access to Citilink Indonesia’s server, using an account owned by Global Network from Oct. 11 to 27, 2016,” Brig. Gen. Fadil Imran, the director of cybercrime at National Police’s Criminal Investigation Unit (Bareskrim) said on Tuesday.

 The hackers then sold the stolen tickets on Facebook, Fadil added.

Confessing to the crime, the group’s self-confessed leader, Sultan Haikal, 19, told Motherboard that, “I bought a Ducati and went on a shopping spree. I didn’t invest the money in anything.” The hackers also refer to themselves as “Gangtengers Crew.”

While the three other members were arrested in Balikpapan, East Kalimantan on March, 28, Haikal was nabbed by the police in Ciputat, Banten two days later.

The four members of “Gangtengers Crew” could be slapped up to 12 years in prison under the Indonesia’s Electronic Information and Transactions Law (ITE) revised in 2013.

 Apparently, Haikal who is quite fond of motorcycles has never entered high school. He learnt all his network infiltration skills from the Internet, which he used to exploit vulnerable security measures. In this instance, it was the website Tiket.com

Haikal has also managed to impress the Indonesian authorities with his hacking abilities.

“He is quite sophisticated and the website was also not that hard to hack,” said Idam Wasiadi, an official with the National Police’s Criminal Investigation Department’s cybercrime unit, according to Motherboard.

The “Gangtengers Crew” consisted of two freshers out of high school and one who was a college dropout, National Police Spokesman Brig. Gen. Rikwanto told CNN Indonesia. While only Haikal was named by the National Police, the other three alleged hackers remained anonymous.

The four member group has successfully hacked the National Police Department’s website and the ride hailing app, GO-JEK. “He’s hacked around 4,600 sites, but not all of them for profit,” Rikwanto said. “He’d hack them and show it to his friends, as a way to show off.”

The robbery fetched Haikal Rp 600 million ($45,000 USD), with the other group members too earning about the same amount.

According to Citilink, a subsidiary of the state-owned carrier Garuda Indonesia, none of its customers’ private details were compromised in the hack and the breach was only restricted to the online agent. Also, Tiket.com was able to recover Rp 1.9 billion ($142,546 USD) of the stolen funds.

Jai Prajapati

Jai Prajapati is a security analyst and author for Securityleaks, where he passion for covering latest happening in cybersecurity world such as malware, breaches, vulnerabilities, exploits, white-papers, hacking newsbytes, Dark Web, hacking tutorials and a few more.

Leave a Reply

Your email address will not be published. Required fields are marked *