An unofficial security advisory issued by a hacker identifying themselves as \u201cMoe1\u201d has warned E-toll users that the PINs used to log into their E-toll website accounts can be easily obtained if their username is known.<\/p>\n
This is due to a page on the South African National Roads Agency Limited (Sanral) website which can be exploited to expose the PIN of any registered E-toll website user.<\/p>\n
The page is intended to be used as part of a standard two-stage account registration process, Moe1 explained, where the user would click on a link in an e-mail to confirm their account.<\/p>\n
However, the page at the link contains a \u201cserious security problem,\u201d according to Moe1. It provides the user\u2019s PIN on the confirmation screen.<\/p>\n
Although displayed as asterisks (*), creating the impression that the PIN is obscured, the PIN is actually available in clear text in the source code of the web page. The source can be easily viewed from just about any browser.<\/p>\n
In the security advisory, Moe1 provides a four-step guide to \u201chack an E-toll account in 5 seconds\u201d, along with a proof of concept exploit and a video of the exploit in action:<\/p>\n