India’s Leading Payment Gateway “CCAvenue” Hacked by SQL Injection

http://digitizor.com/2011/05/05/ccavenue-hacked/

by dkd903 • 15 years ago

68 25 15 years ago

happyfeet4• 15 years ago

If what is published in hackerregiment.com is true, this is the most irresponsible thing the company "CCAvenue" could have done - to store plain text passwords.

They also claim to have PCI DSS 2.0 certified. In light of all the discussions happening repeatedly about need to regenerate passwords & not to store plain text passwords if they have it this way, this is so stupid.

drtse42• 15 years ago

From the limited information i have on this, i'd say they don't know/care about those discussions. Hopeless engineers? Engineering department that find management in their way? Hard to tell, but considering how basic this stuff is i'd go for the last one.

happyfeet4• 15 years ago

Question for experts: Is a PCI DSS certification supposed to take care of aspects like plain text passwords or credit card info & such vulnerabilities as well?

Gist of what I find in wikipedia is this:

PCI DSS Requirements: Build and Maintain a Secure Network 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor-supplied defaults for system passwords and other security parameters

Protect Cardholder Data 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data across open, public networks

Maintain a Vulnerability Management Program 5. Use and regularly update anti-virus software on all systems commonly affected by malware 6. Develop and maintain secure systems and applications

Implement Strong Access Control Measures 7. Restrict access to cardholder data by business need-to-know 8. Assign a unique ID to each person with computer access 9. Restrict physical access to cardholder data

Regularly Monitor and Test Networks 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes

Maintain an Information Security Policy 12. Maintain a policy that addresses information security

kamaal2• 15 years ago

The problem might be 'Hopeless Engineers' as you term it. I don't think certifications can correct people who do it just to get a job. The general way of passing certification by the masses is to get dumps of previous years questions from the internet or friends. Read the the book, mug it up as much as you can. Read the questions and clear the certification.

This is bad, very bad in fact. Its amazing things like this happen from time to time, even things like storing passwords in plain text. This goes on to show only two things, either utter negligence and lack of seriousness on the part of designers or just that they are not aware of even the very basics of computer security.

Engineers passing out of colleges with just degrees and some out side memorized bookish knowledge. Copy pasting snippets of code from the internet when they are asked to write code. Just doing minimal feature compliance tests. Lack of idea of seriousness of jobs they are doing. Failure to understand the overall architecture. And hopping jobs when this sort of things happen.

A ideal approach to computer science security is to have professionals obtain licenses. All people working on security must obtain a license. And failing on things like this must attract penalties and punishments.

dav-id• 15 years ago

I have been evaluating payment gateways in India and quite frankly I would not be surprised if this is true. If you just look at the CCAvenue website you will see what an absolute mess it is, they do not reply to any form of communication I try to make with them.

If I were a customer of CCAvenue I would close my account and move to someone like DirecPay from Times Of Money.

rushabh2• 15 years ago

Have you tried it? I am waiting to get out of CCAvenue -- so many times the payment crashes that my customers are now preferring to mail me a check! Their customer service is pathetic too

abhaga• 15 years ago

Was a user of DirecPay for 1 year about a year back. They think base64 encoding is "encryption".

swatkat• 15 years ago

CCAvenue CEO talks about this hack: http://www.medianama.com/2011/05/223-vishwas-patel-ccavenue-...

Garbage• 15 years ago

Important replies from above link:

So you’re saying that the merchant data has not been accessed? > It hasn’t. If you see, apache 2.2.14 – we’ve been live with apache 2.2.17 for last five months.

You’re also saying that merchant account passwords have not been stored as plain text? > They are encrypted, and not stored as plain text.

Have you ever been told that there is a security hole of some sort? > We are looking into this, and this is the intial report. From time to time what we get, I am sharing with you. As more information comes out as we investigate, we will share it.

narad2• 15 years ago

encrypted?? then, it can be decrypted. Why they were not hashed so that it cannot be decrypted.

More updates posted here... http://www.medianama.com/2011/05/223-ccavenue-hacked/

abhishekpathak• 15 years ago

As someone over there said : If there is no hack as he claims and the DB schema is not theirs then what are they really investigating?

narad2• 15 years ago

I am surprised on this. Why CCAvenue did not conduct a vulnerability test on their applications? It is standard practice to conduct a VA on production systems, which will certainly identify this kind of vulnerabilities. A Payment facilitator going down because of an SQL injection attack is ridiculous.

Indian market is paranoid about online security. This will bring down the number of online sales. Too bad for start-ups depending on CCAvenue.

giis2• 15 years ago

Its plain stupidity to store plain passwords. Some user said,he tried forgot password ,it returned him 'his original' password.

geetaj• 15 years ago

CC Avenue denies the attack: http://ndtv.in/jy6RAO

abdulqabiz2• 15 years ago

Isn't it obvious? They don't have right culture within their organization. Had they been like Amazon, Twitter and others, they would have accepted what happened.

giis2• 15 years ago

more info. on the hack - when user tried to forgot password ,they got their original password back. If it was stored as encrypted then there is no way to decrypt them. And also in interview CEO claims they use "2.2.17" for past 5 months but http://uptime.netcraft.com/up/graph?site=www.ccavenue.com shows differently

India’s Leading Payment Gateway “CCAvenue” Hacked by SQL Injection

Related Stories