Sanral website exposes e-toll bills. This is a problem, says lawyer

Hmm, so you create an account, setup a debit order/enter credit card details and enter the number plate of the person you're snooping on. So basically you are then responsible for the tolls of that number plate?
 
Rather this than being forced to register on their site
 
Oi now I understand why there are morons trying to create a special understanding of the ECA for "unauthorized access" to allow SANRAL to put up information and depend on locking up people for not doing exactly what SANRAL wants.
 
I wonder how up to date that information is on that site. I mean could you use it to track people's locations? I mean it's just a form that gets submitted, so it's not a lot of work to fire off requests to the server in a brute force fashion to get back when they passed under a gantry. Then just plot it on a map if you have the GPS co ordinates of each Gantry...Just thinking out loud here :p
 
This is quite fun - looking up plates from the "Bad Parking" thread. What happens if you tick the entry and press "Confirm"?
 
S1ght said:
I wonder how up to date that information is on that site. I mean could you use it to track people's locations? I mean it's just a form that gets submitted, so it's not a lot of work to fire off requests to the server in a brute force fashion to get back when they passed under a gantry. Then just plot it on a map if you have the GPS co ordinates of each Gantry...Just thinking out loud here :p
Click to expand...

All it shows is the total toll owed.
 
so for those who care as to why the flaw is there and have not figured it out it because of Cookie variables.

once you hit the site there is a cookie variable that goes into Cache that says you have been redirected, once you reload the page, the cookie is there so you are not redirected.(tested this by loading the url, reloading the url, clearing cache and loading url again.)

what this means is that those who do register will always be able to view any one else's number plate details.
 
S1ght said:
I wonder how up to date that information is on that site. I mean could you use it to track people's locations? I mean it's just a form that gets submitted, so it's not a lot of work to fire off requests to the server in a brute force fashion to get back when they passed under a gantry. Then just plot it on a map if you have the GPS co ordinates of each Gantry...Just thinking out loud here :p
Click to expand...

From a bit of experimentation, it's not terribly delayed. Keep in mind though that should Neotel's network go down for whatever reason, transactions are cached locally on each gantry until such point as the network coming back online, so obviously you'd see a delay in such cases.
 
rwenzori said:
This is quite fun - looking up plates from the "Bad Parking" thread. What happens if you tick the entry and press "Confirm"?
Click to expand...
Just goes to a secure credit card payment site for payment.
 
Last edited:
jes said:
Sanral website exposes e-toll bills. This is a problem, says lawyer[/URL]

Sanral’s website allows anyone to check anyone else’s outstanding fees, which may be a violation of road users’ privacy
Click to expand...
How is this a problem? As no user information (aside from the number plate and number of transactions) is shown?

No name, address information, licence information, vehicle information is displayed on this 'un-secured' link.

I agreed - bring Sanral/e-tolls down by any means necessary, but this looks like Paul Jacobson was only partially informed of what is available through the link. (unless there is more data displayed that I do not see)
 
darwinshome said:
How is this a problem? As no user information (aside from the number plate and number of transactions) is shown?

No name, address information, licence information, vehicle information is displayed on this 'un-secured' link.

I agreed - bring Sanral/e-tolls down by any means necessary, but this looks like Paul Jacobson was only partially informed of what is available through the link. (unless there is more data displayed that I do not see)
Click to expand...

I think he's moaning about the fact that people can find out how much you owe. As if you couldn't just engage in some trash can diving if that your turn on.
 
Sinbad said:
All it shows is the total toll owed.
Click to expand...

The tolls are different for each gantry so you just need to work out the difference every time the total changes. You will be able to link each change to a specific gantry. Easy enough to do to get the location and time the person travelled under the gantry assuming the website is updated on the fly.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X