27 C
Jaipur
Sunday, October 25, 2020

IRCTC Website Flaw Allow Hackers to access All Your Private Info

Must read

Lenovo Legion Phone Duel, a bizarre new gaming phone, is available to buy now

If you're looking to buy a new gaming phone the Lenovo Legion Phone Duel is out today, and it might be great for the...

Packers vs Texans live stream: how to watch NFL week 7 online from anywhere

The Green Bay Packers roll into week 7 with an impressive 4-1 record and all signs point to that becoming 5-1 after today's game...

Steelers vs Titans live stream: how to watch NFL week 7 online from anywhere

Two of the NFL’s three remaining undefeated teams do battle at Heinz Field today in the pick of week 7's games. After a three-week...

YouTube TV Channels In 2020: Cost & Features Explained

When it comes to cord-cutting due to the constant leaps in the cable bill, the first thing that comes to our minds is Netflix...

A new bug discovered in IRCTC website allows attackers to gain access to the lakhs of users private information and alter the sensitive data include cancelling the booked ticket.

IRCTC (Indian Railway Catering and Tourism Corporation) is a part of Indian Railway and one of the busiest Railway booking system in the world that manages around 15 to 16 lakh tickets every day.

An Indian Security researcher Ronnie T Baby who discovered this critical vulnerability in the password reset option that used in IRCTC.

During the process of login, When input the user id, an OTP gets automatically sent to the registered mobile number of the account.

In this case, Ronnie said, “Though there was captcha enabled to prevent brute-forcing of the OTP’s, it surprisingly allowed the reuse of captchas for unlimited requests.”

Cancelling IRCTC Booked Tickets

Initially targetted user ID is required to exploit the bug and it is not a big deal to found the variety of user ID online, here you can see some of Top 100 common names in India.

If any users try to reset their password, 6 random character OTP gets generated and send it the users registered mobile number.

Researcher said, “After a little observation I found that, there is indeed rate limiting to the amount of OTP being sent (it will say that your account has exceeded the OTP limits for the day…). But here the issue was the reuse of valid captchas”

Since the OTP contains a 6 digit corrector, attackers can easily validate the OTP using a variety of brute force tools available online for the maximum checking count of 999999.

During the process of OTP Validation, a parameter called “seqAns ” helps to validates if the OTP matches the one sent on mobile number.

Ronnie said to “GBHackers on Security” via Email, I could have hacked lakhs of IRCTC accounts and get access to all your private info including easily cancelling booked tickets by repeated request while changing the value of seqAns to reset the password and login to IRCTC user account after observing that correct OTP.”

Here you can see the Proof of concept video that was published online.

Ronnie reported this vulnerability to IRCTC and the bug was fixed by proper captcha verification.

Source link

- Advertisement -

More articles

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest article

Lenovo Legion Phone Duel, a bizarre new gaming phone, is available to buy now

If you're looking to buy a new gaming phone the Lenovo Legion Phone Duel is out today, and it might be great for the...

Packers vs Texans live stream: how to watch NFL week 7 online from anywhere

The Green Bay Packers roll into week 7 with an impressive 4-1 record and all signs point to that becoming 5-1 after today's game...

Steelers vs Titans live stream: how to watch NFL week 7 online from anywhere

Two of the NFL’s three remaining undefeated teams do battle at Heinz Field today in the pick of week 7's games. After a three-week...

YouTube TV Channels In 2020: Cost & Features Explained

When it comes to cord-cutting due to the constant leaps in the cable bill, the first thing that comes to our minds is Netflix...

This 70-inch 4K TV is on sale for $499.99 in early Black Friday deal at Best Buy

Best Buy is releasing early Black Friday deals this year, and we've spotted a stellar bargain on a big-screen 4K TV. Today only, you...