Another E-toll website security flaw uncovered

[jes]

New E-toll website security flaw uncovered

Another security flaw has been uncovered on Sanral’s E-toll website that lets a “hacker” see the outstanding balance on any vehicle

 

[PoisonedPawn]

Another E-toll fail!

 

[Jola]

I don't know anyone with an e-toll account !

 

[Seriously]

Another "Hack Attack" will be the outcry from the brainless!

 

[Gezza]

Is that hack still working where you can see your balance even though you haven't registered?

 

[MagicDude4Eva]

Quite obvious that Sanral and others will fail the most obvious OWASP vulnerabilities - https://www.owasp.org/index.php/Top_10_2013-A4-Insecure_Direct_Object_References

 

[Wall]

Doesn't surprise me in the slightest.

 

[morkhans]

Full article: http://www.itweb.co.za/index.php?op...nother-e-toll-security-flaw-exposed&catid=450

 

[AfricanTech]

Agents!

 

[Tns]

cant they do a proper hack and delete the whole system?

 

[envo]

who the **** programs like that? I hope they fire their developers

 

[Allin]

who the **** programs like that? I hope they fire their developers

Why, they will get another contract. It is not their fault hackers broke the system!

 

[Seriously]

who the **** programs like that? I hope they fire their developers

They can't as normally they contract in friends and family!

 

[kissingmybbgoodbye]

Not surprised, you don't even need

modern browser with built-in developer tools.

it can be achieved with simple get parameters in the url (They don't even check for a valid ID)

 

[Petec]

Not surprised, you don't even need it can be achieved with simple get parameters in the url (They don't even check for a valid ID)

Ohhhh, that is l337 h4CkZ0r speak in the eyes of the Guv.

I can see it now... "Eish, get this bleddy agent Parameter arrested right now!"

 

[cfilorux]

Security volunteer service

And, in other news, due to the overwhelming popularity of the e-toll system, an army of volunteer security professionals are combing it for problems, and reporting these so they can be fixed. Nazir Ali is reported to have said, "We will shoot volunteers on sight." He might have meant "on site".

 

[munky82]

"modern browser with built-in developer tools. "

like Chrome, the most used browser in the world?

http://upload.wikimedia.org/wikiped...hare_of_web_browsers_(Source_StatCounter).svg

 

[Mk786]

only in SA.