The E-toll website once again let anyone view the so-called 7-day \u201cgrace period\u201d outstanding balance of any vehicle, provided you had its license plate number.<\/p>\n
A concerned reader recently contacted MyBroadband, saying that they were able to query the E-toll website of the South African National Roads Agency Limited (Sanral<\/a>) without providing a legitimate ID number or validation code to its system that lets unregistered users view and pay their E-toll bill.<\/p>\n According to the reader, they were able to get at the grace period balances using a URL that was formed as follows:<\/p>\n https:\/\/www.sanral.co.za\/e-toll\/portal\/PayTollFeesUnregisteredUsers.aspx?CountryCode=ZA&RegionCode=GP&licensePlate=AA00AAGP&identificationNumber=1& validationCode=1<\/p><\/blockquote>\n MyBroadband contacted Sanral for comment on the flaw, but by the time of publication the agency had yet to respond.<\/p>\n However, following MyBroadband\u2019s questions the roads agency seems to have patched its website. Further attempts to query bills without providing a valid ID number and validation code now reportedly result in an error being displayed.<\/p>\n This is the latest in a series of security flaws discovered in Sanral\u2019s E-toll website.<\/p>\n Shortly after E-tolls launched in December 2013, a flaw that used the same URL as above also let anyone [query the outstanding E-toll balance on a vehicle, provided they had its license plate number:<\/p>\n Sanral maintained that the feature was not a privacy concern<\/a>, but disabled it \u201cdue to the misinformation and concerns raised\u201d.<\/p>\n \u201cThe portal provided an easy way for road users travelling on the Gauteng e-roads but are not registered to establish the amount due and to allow for a secure payment through an online e-commerce gateway,\u201d Sanral spokesperson Vusi Mona said at the time.<\/p>\n Towards the end of December 2013, a significant security vulnerability was reported in the E-toll website which potentially let an attacker retrieve the PIN of a user if their username was known.<\/p>\n Sanral called the exposing of the vulnerability a \u201ccyber attack\u201d.<\/p>\n On 20 March 2014 Sanral finally called on its users to reset their PINs:<\/p>\n Earlier in March, another flaw was reported that once again let anyone with an E-toll website account view the outstanding balance on any vehicle so long as they had the licence plate number:<\/p>\n This means that there have been at least 3 different flaws on E-toll website that exposed the outstanding balance on a vehicle, and one more serious vulnerability that Sanral took months to respond to.<\/p>\n Perhaps it is time that the roads agency change its approach to security on its website.<\/p>\n E-toll security hole: don\u2019t shoot the messenger<\/strong><\/a><\/p>\n Website security flaws in SA \u2013 shooting the messenger<\/strong><\/a><\/p>\n Gmail to be encrypted<\/strong><\/a><\/p>\n How to stop government from spying on your torrents<\/strong><\/a><\/p>\nFlaw fest<\/h3>\n
\n
\n
\n
More information security articles<\/h3>\n