Find Top-Rated Products at Prices That Can't Be Beat, Only Here

Hackers reverse-engineer Ticketmaster’s barcode system to unlock resales on different platforms

Scalpers have used a safety researcher’s findings to reverse-engineer “nontransferable” digital tickets from Ticketmaster and AXS, permitting transfers exterior their apps. The workaround was revealed in a lawsuit AXS filed in Could in opposition to third-party brokers adopting the follow, in line with 404 Media, which first reported the information.

The saga started in February when an nameless safety researcher, going by the pseudonym Conduition, published technical details about how Ticketmaster generates its digital tickets. If you happen to aren’t already conversant in how fashionable e-ticketing methods work, Ticketmaster and AXS lock ticket resales inside their platforms, stopping transfers on third-party providers like SeatGeek and StubHub. (For higher-priority occasions, they usually take it a step additional by prohibiting transfers to different accounts on the identical platform.)

Though the businesses declare the follow is strictly a safety measure, it additionally conveniently permits them to manage how and when their tickets are resold. (Yay, capitalism?)

Side-by-side phone screenshots of the Ticketmaster app showing event barcodes.


Ticketmaster and AXS create their “nontransferable” tickets utilizing rotating barcodes that change each few seconds, stopping working screenshots or printouts. On the again finish, it makes use of comparable underlying tech much like two-factor authentication apps. As well as, the codes are solely generated shortly earlier than an occasion begins, limiting the window for sharing them exterior the apps. With out interference from exterior events, the platforms get to lock ticket patrons into their very own resale providers, giving them vertical management of your entire ecosystem.

That’s the place the hackers are available. Utilizing Conduition’s printed findings, they extracted the platforms’ secret tokens that generate new tickets, utilizing an Android cellphone with its Chrome browser linked to Chrome DevTools on a desktop PC. Utilizing the tokens, they create a parallel ticketing infrastructure that regenerates real barcodes on different platforms, permitting them to promote working tickets on platforms Ticketmaster and AXS don’t permit. On-line stories declare the parallel tickets usually work on the gates.

In response to 404 Media, AXS’ lawsuit accuses the defendants of promoting “counterfeit” tickets (regardless that they normally work) to “unsuspecting prospects.” The court docket paperwork allegedly describe the parallel tickets as “created, in entire or partially by a number of of the Defendants illicitly accessing after which mimicking, emulating, or copying tickets from the AXS Platform.”

AXS’ lawsuit claims the corporate doesn’t know the way the hackers are doing it. The promise of primarily jailbreaking Ticketmaster is so profitable that a number of brokers have reportedly tried hiring Conduition to assist them construct their very own parallel ticket-generating platforms. Providers already working on the researcher’s findings go by names like Safe.Tickets, Amosa App, Digital Barcode Distribution and

404 Media’s entire story is worth reading. Extra technically minded of us might take an curiosity in Conduition’s earlier findings, which illustrate what the ticketing behemoths are doing on their back ends to keep the entire ecosystems in their clutches.

Trending Merchandise

Add to compare
Corsair 5000D Airflow Tempered Glass Mid-Tower ATX PC Case – Black

Corsair 5000D Airflow Tempered Glass Mid-Tower ATX PC Case – Black


We will be happy to hear your thoughts

Leave a reply

Register New Account
Compare items
  • Total (0)
Shopping cart