New E-toll website security flaw uncovered

There is a vulnerability on the E-toll website that lets any registered user access anyone’s outstanding balance, according to a report on ITWeb.

The report said that exploiting the vulnerability is trivial, and indicated that all that is needed is an E-toll account and a modern browser with built-in developer tools.

This is because the E-toll website billing page embeds the license number as a hidden field, which can easily be accessed and modified.

Instead of preventing the user from querying the balance of a vehicle not registered to their account, the E-toll site reportedly returns the outstanding amount.

It is not the first time an easy-to-exploit security flaw has been identified in the E-toll website.

Earlier this year a security researcher who went by “Moe1” reported a vulnerability that made it possible to get the PIN of many registered E-toll users so long as their usernames were known.

A hacker could then log into the victim’s account and access that person’s private details.

At the time, Sanral’s response to the disclosure of the security flaw in its website was to threaten legal action against Moe1.

Prior to these security vulnerabilities being uncovered, MyBroadband reported that Sanral’s E-toll website allowed anyone to check the outstanding balance of any vehicle that had passed under a gantry.

Initially Sanral said that this was a service provided to E-road users, despite the fact that to access this “feature” users had to jump through hoops.

The feature eventually disappeared from the E-toll website, but only after it was used to track the E-toll bill of US President Barack Obama during his visit to South Africa for the memorial service of former president Nelson Mandela.

Sanral did not immediately respond to requests for comment on this story.

More Sanral security articles

E-toll security hole: don’t shoot the messenger

Website security flaws in SA – shooting the messenger

E-toll website flaw a cyber-attack: Sanral

Massive E-toll website security flaw