Ticketmaster Sucks So He Hacked It
Source: YouTube · Low Level · published Apr 25, 2025 · 24:59
The video explains how Ticketmaster's Safe Tix rotating barcode system was reverse engineered, revealing it uses standard TOTP authentication with easily extractable tokens that can be used to generate valid tickets outside their ecosystem 22:38.
Key Takeaways:
• Ticketmaster's Safe Tix uses rotating barcodes that refresh every 15 seconds, marketed as fraud prevention but actually designed to maintain their ticket monopoly and force app downloads 1:31
• The system contains a static base64 token, two TOTP codes, and a timestamp - using industry-standard time-based one-time password authentication 11:33
• Researchers discovered the token is logged to the browser console, allowing anyone to extract it and generate valid barcodes that work at venue entrances 20:00
• The tokens remain valid for approximately 20 hours, enabling offline ticket saving and potential resale outside Ticketmaster's marketplace 22:06
The analysis exposes how Ticketmaster's DRM system creates customer inconvenience while failing to achieve its purported security goals.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
reverse engineering ticket master's rotating barcodes called safe ticks. This is an article that keeps getting sent to me that I want to go into. I hate Ticketmaster. Ticketmaster has made going to live events one of the most painful experiences. I miss the days where you could just, you know, print a ticket on paper and that was like the the the the proof that you paid to the event. Now you have to download an app and have this weird scanning barcode thing. So apparently in this article they go through like what this ticket actually does and a way to to bypass it. So I want to talk about this. Screenshots won't get you in, but Chrome dev tools will. Okay, that's probably going to highlight what's going on with this little uh little rotating barcode here. I recently purchased tickets to a …