{"id":111104,"date":"2014-10-02T14:04:16","date_gmt":"2014-10-02T12:04:16","guid":{"rendered":"http:\/\/mybroadband.co.za\/news\/?p=111104"},"modified":"2014-10-02T17:18:58","modified_gmt":"2014-10-02T15:18:58","slug":"massive-privacy-security-flaw-with-gautrain-linked-site","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/111104-massive-privacy-security-flaw-with-gautrain-linked-site.html","title":{"rendered":"Massive privacy, security flaw with Gautrain-linked site"},"content":{"rendered":"<p>At least 40,000 South Africans appear to have submitted their private details to Gautraincard.co.za to \u201capply for the purchase\u201d of a new Gautrain Gold card, which the site then exposed to anyone on the Internet.<\/p>\n<p>Details exposed are full names, birth dates, ID or passport numbers, postal addresses, e-mail addresses, and telephone numbers.<\/p>\n<p>Gautrain Gold Cards are the proximity cards used to pay to ride on the Gautrain.<\/p>\n<p>MyBroadband was provided with proof that it is possible to view the personal details of people who registered on the site.<\/p>\n<p>We contacted one user whose details were exposed and they confirmed that they had indeed registered on GautrainCard.<\/p>\n<div id=\"attachment_111106\" style=\"width: 610px\" class=\"wp-caption aligncenter\"><a href=\"http:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2014\/10\/Gautraincard.co_.za-screenshot.jpg\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-111106\" class=\"wp-image-111106\" src=\"http:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2014\/10\/Gautraincard.co_.za-screenshot.jpg\" alt=\"Gautraincard.co.za screenshot\" width=\"600\" height=\"451\" srcset=\"https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2014\/10\/Gautraincard.co_.za-screenshot.jpg 947w, https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2014\/10\/Gautraincard.co_.za-screenshot-532x400.jpg 532w\" sizes=\"(max-width: 600px) 100vw, 600px\" \/><\/a><p id=\"caption-attachment-111106\" class=\"wp-caption-text\">Gautraincard.co.za screenshot<\/p><\/div>\n<p>Queried about the site, a spokesperson for the Gautrain Management Agency (GMA) said they did not operate any sites like Gautraincard.co.za.<\/p>\n<p>The only legitimate method to buy a Gold Card is at a Gautrain station, and Gautrain does not request users to provide their personal details online, the spokesperson said.<\/p>\n<p>Enterprise Outsourcing Solutions (Pty) Ltd, the company listed as the registrar of Gautraincards.co.za, was also contacted for comment.<\/p>\n<p>It is understood that this company is a subsidiary of EOH Holdings Ltd., and the phone number listed in the website\u2019s registration also connects\u00a0to EOH\u2019s switchboard.<\/p>\n<p>However, EOH also said it had no knowledge of the site, could not provide any information about it, and directed queries to the website owner, which is listed as Bombela Operating Company.<\/p>\n<p>Contacted for comment, the Bombela Operating Company disavowed all knowledge of the site, saying that websites and marketing are not their domain and directed all queries to the Bombela Concessions Company.<\/p>\n<div id=\"attachment_111108\" style=\"width: 610px\" class=\"wp-caption aligncenter\"><a href=\"http:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2014\/10\/Gautraincard.co_.za-registration-page-screenshot.jpg\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-111108\" class=\"wp-image-111108\" src=\"http:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2014\/10\/Gautraincard.co_.za-registration-page-screenshot.jpg\" alt=\"Gautraincard.co.za registration page screenshot\" width=\"600\" height=\"659\" srcset=\"https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2014\/10\/Gautraincard.co_.za-registration-page-screenshot.jpg 948w, https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2014\/10\/Gautraincard.co_.za-registration-page-screenshot-364x400.jpg 364w\" sizes=\"(max-width: 600px) 100vw, 600px\" \/><\/a><p id=\"caption-attachment-111108\" class=\"wp-caption-text\">Gautraincard.co.za registration page screenshot<\/p><\/div>\n<p>MyBroadband tried to contact the Bombela Concession Company as requested, but no one could be reached who could answer questions about the site.<\/p>\n<p>With the assistance of the Gautrain Management Agency, the correct people at Bombela were eventually alerted to the issue, and we were told they are looking into the matter.<\/p>\n<p>Another company linked to the GautrainCard site is 3G\u2019s Digital, which is credited in the footer with the site\u2019s design and development.<\/p>\n<p>3G\u2019s lists Ricardo Pieterse as its contact person, and the 3G\u2019s website is also registered in Pieterse\u2019s name.<\/p>\n<p>Queried about Gautraincard.co.za, Pieterse confirmed that he had designed and developed it under contract by Bombela. This seems to be confirmed by the fact that there is a link to the GautrainCard website from the\u00a0<a href=\"http:\/\/join.gautrain.co.za\" target=\"_blank\">main Gautrain website<\/a>.<\/p>\n<p>Pieterse\u00a0requested that further questions be sent to him by e-mail and when MyBroadband asked about the privacy concerns raised, he\u00a0directed further queries to Errol Braithwaite at Bombela.<\/p>\n<p>Braithwaite is the person at Bombela who the\u00a0Gautrain Management Agency\u00a0alerted about the issue, but\u00a0feedback from\u00a0Bombela was\u00a0not immediately forthcoming by\u00a0the time of publication.<\/p>\n<p><strong>Update: <\/strong>Braithwaite has provided the following statement on the issue.<\/p>\n<blockquote><p>We have engaged with the sub-contractors who developed and maintain the site and will revert to you with a full response as soon as it is available. In the interim we have insisted that the site is immediately quarantined with no public access until it&#8217;s security is fully verified.<\/p>\n<p>At this stage it is still unclear what the exact nature of the problem was and whether the site was the subject of a cyber attack.<\/p>\n<p>We have requested an urgent report on whether anyone\u2019s personal data integrity was in fact compromised. What we do know is that no ones personal data stored on their Gautrain Gold Cards has been compromised or altered in any way.<\/p><\/blockquote>\n<h3 id=\"related\">More Gautrain and SA information security news<\/h3>\n<p><a href=\"http:\/\/mybroadband.co.za\/news\/security\/110736-beware-of-this-banking-scam-in-sa-sabric.html\"><strong>Beware of this banking scam in SA: Sabric<\/strong><\/a><\/p>\n<p><a href=\"http:\/\/mybroadband.co.za\/news\/security\/110288-did-sa-government-blow-e2-million-on-spyware.html\"><strong>Did SA government blow \u20ac2-million on spyware?<\/strong><\/a><\/p>\n<p><a href=\"http:\/\/mybroadband.co.za\/news\/security\/110316-mass-hacking-of-south-african-websites.html\"><strong>Mass hacking of South African websites<\/strong><\/a><\/p>\n<p><a href=\"http:\/\/mybroadband.co.za\/news\/software\/109510-gautrain-app-developer-access-blocked.html\"><strong>Gautrain app developer access blocked<\/strong><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A website claiming to offer applications for Gautrain Gold Cards is harvesting and exposing people\u2019s private information<\/p>\n","protected":false},"author":23,"featured_media":72588,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[27004,27002,27006,6428,8231,26716,27000,35],"class_list":["post-111104","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-bombela-concessions-company","tag-bombela-operating-company","tag-enterprise-outsourcing-solutions","tag-eoh","tag-gautrain","tag-gautrain-management-agency-gma","tag-gautraincards-co-za","tag-headline"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/111104"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=111104"}],"version-history":[{"count":2,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/111104\/revisions"}],"predecessor-version":[{"id":111110,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/111104\/revisions\/111110"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/72588"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=111104"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=111104"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=111104"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}