4 ms·

India’s Leading Payment Gateway “CCAvenue” Hacked by SQL Injection

68 points by dkd903 15y ago

happyfeet 15y ago
If what is published in hackerregiment.com is true, this is the most irresponsible thing the company "CCAvenue" could have done - to store plain text passwords. They also claim to have PCI DSS 2.0 certified. In light of all the discussions happening repeatedly about need to regenerate passwords & not to store plain text passwords if they have it this way, this is so stupid.
- drtse4 15y ago
  From the limited information i have on this, i'd say they don't know/care about those discussions. Hopeless engineers? Engineering department that find management in their way? Hard to tell, but considering how basic this stuff is i'd go for the last one.
  - happyfeet 15y ago
    Question for experts: Is a PCI DSS certification supposed to take care of aspects like plain text passwords or credit card info & such vulnerabilities as well? Gist of what I find in wikipedia is this: PCI DSS Requirements: Build and Maintain a Secure Network 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data across open, public networks Maintain a Vulnerability Management Program 5. Use and regularly update anti-virus software on all systems commonly affected by malware 6. Develop and maintain secure systems and applications Implement Strong Access Control Measures 7. Restrict access to cardholder data by business need-to-know 8. Assign a unique ID to each person with computer access 9. Restrict physical access to cardholder data Regularly Monitor and Test Networks 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes Maintain an Information Security Policy 12. Maintain a policy that addresses information security
    - drtse4 15y ago
      I've just read the wikipedia entry (http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...), sadly it smells like CMMI.
      - kamaal 15y ago
        How does that justify not using one's brain? Well the problem is simple. Some things break or get messed up. Now a root cause analysis is done and its found if a particular thing had been taken care of, the problem would have been avoided. So now what is the step taken? The solution to the root cause analysis is put as a 'checklist' and now applied to everything or when something is done. And this is put in as a process. Do this, do that... every time you deploy or code something. Now here comes the problem, the people who write the checklist understand that its only a guidance rather than a compliance document. People who come later or those who don't think take the both the process and checklist as some sort of document which if you adhere to, your job is done. And anything and everything else can be done without proper testing or thinking. This goes on until something breaks again, root cause is now found and it goes into that checklist. Its this sort of approach to technology and programming that is creating all the problems in software today. No certification can fix this problem.
  - kamaal 15y ago
    The problem might be 'Hopeless Engineers' as you term it. I don't think certifications can correct people who do it just to get a job. The general way of passing certification by the masses is to get dumps of previous years questions from the internet or friends. Read the the book, mug it up as much as you can. Read the questions and clear the certification. This is bad, very bad in fact. Its amazing things like this happen from time to time, even things like storing passwords in plain text. This goes on to show only two things, either utter negligence and lack of seriousness on the part of designers or just that they are not aware of even the very basics of computer security. Engineers passing out of colleges with just degrees and some out side memorized bookish knowledge. Copy pasting snippets of code from the internet when they are asked to write code. Just doing minimal feature compliance tests. Lack of idea of seriousness of jobs they are doing. Failure to understand the overall architecture. And hopping jobs when this sort of things happen. A ideal approach to computer science security is to have professionals obtain licenses. All people working on security must obtain a license. And failing on things like this must attract penalties and punishments.
    - happyfeet 15y ago
      @kamaal, I think you have misunderstood what it means by certification in this context. We are referring to the PCI DSS certification for the application / website itself & not for the engineers who work on it.
      - abdulqabiz 15y ago
        @happyfeet, most of Indian companies have certifications (ISO and whatever), in practice how many follow things? I am not sure how they got PCI DSS, but I know - how easy it is to get ISO XXXX certifications. Certification doesn't mean anything. In reality, whatever it takes to protect data, companies should do that; Even if it means doing things, which is not written in books. @kamaal, I agree with you. CCAvenue must have had these since it's first version, they were fortunate no one ever tried sql-injection attacks on them. It looks like either CEO is not technical or he is misinformed or engineers who implemented have no idea about hashing, encryption and other terms. I bet, most freshers or even experienced engineers here in India, would not know about sql-injection and storing passwords as hashes. Having said that, there are brilliant guys here as well, hence all those R&D centers of Y!, Google, et al.
- dav-id 15y ago
  I have been evaluating payment gateways in India and quite frankly I would not be surprised if this is true. If you just look at the CCAvenue website you will see what an absolute mess it is, they do not reply to any form of communication I try to make with them. If I were a customer of CCAvenue I would close my account and move to someone like DirecPay from Times Of Money.
  - rushabh 15y ago
    Have you tried it? I am waiting to get out of CCAvenue -- so many times the payment crashes that my customers are now preferring to mail me a check! Their customer service is pathetic too
    - theyaga 15y ago
      I Have been using http://ebs.in/ http://ebs.in/ and they pretty good at it.
      - happyfeet 15y ago
        Do you mean that ebs's payment pages do not crash as often as ccavenue's? May be this is an opportunity for these kind of payment service providers to come out clean & prove it out to the world (at least in forums like HN) as to how paranoid they are about security?
      - rushabh 15y ago
        Thanks for the tip. The site looks good.
  - abhaga 15y ago
    Was a user of DirecPay for 1 year about a year back. They think base64 encoding is "encryption".
swatkat 15y ago
CCAvenue CEO talks about this hack: http://www.medianama.com/2011/05/223-vishwas-patel-ccavenue-hack/ http://www.medianama.com/2011/05/223-vishwas-patel-ccavenue-...
- Garbage 15y ago
  Important replies from above link: So you’re saying that the merchant data has not been accessed? > It hasn’t. If you see, apache 2.2.14 – we’ve been live with apache 2.2.17 for last five months. You’re also saying that merchant account passwords have not been stored as plain text? > They are encrypted, and not stored as plain text. Have you ever been told that there is a security hole of some sort? > We are looking into this, and this is the intial report. From time to time what we get, I am sharing with you. As more information comes out as we investigate, we will share it.
  - narad 15y ago
    encrypted?? then, it can be decrypted. Why they were not hashed so that it cannot be decrypted. More updates posted here... http://www.medianama.com/2011/05/223-ccavenue-hacked/ http://www.medianama.com/2011/05/223-ccavenue-hacked/
    - Indyan 15y ago
      Yep. Typically passwords are hashed and salted. However, I have seen non-technical folks use the terms hashing and encryption exchangeably. Hopefully thats the case here. Anyways, since CCAvenue didn't store the full CC number (and they definitely didn't store the passcode - for that it redirected to the issuing bank/organization), this doesn't seem to be a very serious issue, even if true.
    - dkd903 15y ago
      see this: http://twitter.com/#!/heytal/status/66071065805336576 http://twitter.com/#!/heytal/status/66071065805336576
  - abhishekpathak 15y ago
deleted 15y ago
[deleted]
narad 15y ago
I am surprised on this. Why CCAvenue did not conduct a vulnerability test on their applications? It is standard practice to conduct a VA on production systems, which will certainly identify this kind of vulnerabilities. A Payment facilitator going down because of an SQL injection attack is ridiculous. Indian market is paranoid about online security. This will bring down the number of online sales. Too bad for start-ups depending on CCAvenue.
giis 15y ago
Its plain stupidity to store plain passwords. Some user said,he tried forgot password ,it returned him 'his original' password.
geetaj 15y ago
CC Avenue denies the attack: http://ndtv.in/jy6RAO http://ndtv.in/jy6RAO
- abdulqabiz 15y ago
  Isn't it obvious? They don't have right culture within their organization. Had they been like Amazon, Twitter and others, they would have accepted what happened.
giis 15y ago
more info. on the hack - when user tried to forgot password ,they got their original password back. If it was stored as encrypted then there is no way to decrypt them. And also in interview CEO claims they use "2.2.17" for past 5 months but http://uptime.netcraft.com/up/graph?site=www.ccavenue.com http://uptime.netcraft.com/up/graph?site=www.ccavenue.com shows differently

68 points by dkd903 15y ago

If what is published in hackerregiment.com is true, this is the most irresponsible thing the company "CCAvenue" could have done - to store plain text passwords. They also claim to have PCI DSS 2.0 certified. In light of all the discussions happening repeatedly about need to regenerate passwords & not to store plain text passwords if they have it this way, this is so stupid.

drtse4 15y ago
From the limited information i have on this, i'd say they don't know/care about those discussions. Hopeless engineers? Engineering department that find management in their way? Hard to tell, but considering how basic this stuff is i'd go for the last one.
- happyfeet 15y ago
  Question for experts: Is a PCI DSS certification supposed to take care of aspects like plain text passwords or credit card info & such vulnerabilities as well? Gist of what I find in wikipedia is this: PCI DSS Requirements: Build and Maintain a Secure Network 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data across open, public networks Maintain a Vulnerability Management Program 5. Use and regularly update anti-virus software on all systems commonly affected by malware 6. Develop and maintain secure systems and applications Implement Strong Access Control Measures 7. Restrict access to cardholder data by business need-to-know 8. Assign a unique ID to each person with computer access 9. Restrict physical access to cardholder data Regularly Monitor and Test Networks 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes Maintain an Information Security Policy 12. Maintain a policy that addresses information security
  - drtse4 15y ago
    I've just read the wikipedia entry (http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...), sadly it smells like CMMI.
    - kamaal 15y ago
      How does that justify not using one's brain? Well the problem is simple. Some things break or get messed up. Now a root cause analysis is done and its found if a particular thing had been taken care of, the problem would have been avoided. So now what is the step taken? The solution to the root cause analysis is put as a 'checklist' and now applied to everything or when something is done. And this is put in as a process. Do this, do that... every time you deploy or code something. Now here comes the problem, the people who write the checklist understand that its only a guidance rather than a compliance document. People who come later or those who don't think take the both the process and checklist as some sort of document which if you adhere to, your job is done. And anything and everything else can be done without proper testing or thinking. This goes on until something breaks again, root cause is now found and it goes into that checklist. Its this sort of approach to technology and programming that is creating all the problems in software today. No certification can fix this problem.
- kamaal 15y ago
  The problem might be 'Hopeless Engineers' as you term it. I don't think certifications can correct people who do it just to get a job. The general way of passing certification by the masses is to get dumps of previous years questions from the internet or friends. Read the the book, mug it up as much as you can. Read the questions and clear the certification. This is bad, very bad in fact. Its amazing things like this happen from time to time, even things like storing passwords in plain text. This goes on to show only two things, either utter negligence and lack of seriousness on the part of designers or just that they are not aware of even the very basics of computer security. Engineers passing out of colleges with just degrees and some out side memorized bookish knowledge. Copy pasting snippets of code from the internet when they are asked to write code. Just doing minimal feature compliance tests. Lack of idea of seriousness of jobs they are doing. Failure to understand the overall architecture. And hopping jobs when this sort of things happen. A ideal approach to computer science security is to have professionals obtain licenses. All people working on security must obtain a license. And failing on things like this must attract penalties and punishments.
  - happyfeet 15y ago
    @kamaal, I think you have misunderstood what it means by certification in this context. We are referring to the PCI DSS certification for the application / website itself & not for the engineers who work on it.
    - abdulqabiz 15y ago
      @happyfeet, most of Indian companies have certifications (ISO and whatever), in practice how many follow things? I am not sure how they got PCI DSS, but I know - how easy it is to get ISO XXXX certifications. Certification doesn't mean anything. In reality, whatever it takes to protect data, companies should do that; Even if it means doing things, which is not written in books. @kamaal, I agree with you. CCAvenue must have had these since it's first version, they were fortunate no one ever tried sql-injection attacks on them. It looks like either CEO is not technical or he is misinformed or engineers who implemented have no idea about hashing, encryption and other terms. I bet, most freshers or even experienced engineers here in India, would not know about sql-injection and storing passwords as hashes. Having said that, there are brilliant guys here as well, hence all those R&D centers of Y!, Google, et al.
dav-id 15y ago
I have been evaluating payment gateways in India and quite frankly I would not be surprised if this is true. If you just look at the CCAvenue website you will see what an absolute mess it is, they do not reply to any form of communication I try to make with them. If I were a customer of CCAvenue I would close my account and move to someone like DirecPay from Times Of Money.
- rushabh 15y ago
  Have you tried it? I am waiting to get out of CCAvenue -- so many times the payment crashes that my customers are now preferring to mail me a check! Their customer service is pathetic too
  - theyaga 15y ago
    I Have been using http://ebs.in/ http://ebs.in/ and they pretty good at it.
    - happyfeet 15y ago
      Do you mean that ebs's payment pages do not crash as often as ccavenue's? May be this is an opportunity for these kind of payment service providers to come out clean & prove it out to the world (at least in forums like HN) as to how paranoid they are about security?
    - rushabh 15y ago
      Thanks for the tip. The site looks good.
- abhaga 15y ago
  Was a user of DirecPay for 1 year about a year back. They think base64 encoding is "encryption".

swatkat 15y ago

CCAvenue CEO talks about this hack: http://www.medianama.com/2011/05/223-vishwas-patel-ccavenue-hack/ http://www.medianama.com/2011/05/223-vishwas-patel-ccavenue-...

Garbage 15y ago
Important replies from above link: So you’re saying that the merchant data has not been accessed? > It hasn’t. If you see, apache 2.2.14 – we’ve been live with apache 2.2.17 for last five months. You’re also saying that merchant account passwords have not been stored as plain text? > They are encrypted, and not stored as plain text. Have you ever been told that there is a security hole of some sort? > We are looking into this, and this is the intial report. From time to time what we get, I am sharing with you. As more information comes out as we investigate, we will share it.
- narad 15y ago
  encrypted?? then, it can be decrypted. Why they were not hashed so that it cannot be decrypted. More updates posted here... http://www.medianama.com/2011/05/223-ccavenue-hacked/ http://www.medianama.com/2011/05/223-ccavenue-hacked/
  - Indyan 15y ago
    Yep. Typically passwords are hashed and salted. However, I have seen non-technical folks use the terms hashing and encryption exchangeably. Hopefully thats the case here. Anyways, since CCAvenue didn't store the full CC number (and they definitely didn't store the passcode - for that it redirected to the issuing bank/organization), this doesn't seem to be a very serious issue, even if true.
  - dkd903 15y ago
    see this: http://twitter.com/#!/heytal/status/66071065805336576 http://twitter.com/#!/heytal/status/66071065805336576
- abhishekpathak 15y ago

deleted 15y ago

[deleted]

narad 15y ago

I am surprised on this. Why CCAvenue did not conduct a vulnerability test on their applications? It is standard practice to conduct a VA on production systems, which will certainly identify this kind of vulnerabilities. A Payment facilitator going down because of an SQL injection attack is ridiculous. Indian market is paranoid about online security. This will bring down the number of online sales. Too bad for start-ups depending on CCAvenue.

giis 15y ago

Its plain stupidity to store plain passwords. Some user said,he tried forgot password ,it returned him 'his original' password.

geetaj 15y ago

CC Avenue denies the attack: http://ndtv.in/jy6RAO http://ndtv.in/jy6RAO

abdulqabiz 15y ago
Isn't it obvious? They don't have right culture within their organization. Had they been like Amazon, Twitter and others, they would have accepted what happened.

giis 15y ago

more info. on the hack - when user tried to forgot password ,they got their original password back. If it was stored as encrypted then there is no way to decrypt them. And also in interview CEO claims they use "2.2.17" for past 5 months but http://uptime.netcraft.com/up/graph?site=www.ccavenue.com http://uptime.netcraft.com/up/graph?site=www.ccavenue.com shows differently