4 ms·

CCAvenue CEO talks about this hack: http://www.medianama.com/2011/05/223-vishwas-patel-ccavenue-hack/ http://www.medianama.com/2011/05/223-vishwas-patel-ccavenu

• Garbage 15y ago
  Important replies from above link: So you’re saying that the merchant data has not been accessed? > It hasn’t. If you see, apache 2.2.14 – we’ve been live with apache 2.2.17 for last five months. You’re also saying that merchant account passwords have not been stored as plain text? > They are encrypted, and not stored as plain text. Have you ever been told that there is a security hole of some sort? > We are looking into this, and this is the intial report. From time to time what we get, I am sharing with you. As more information comes out as we investigate, we will share it.
  • narad 15y ago
    encrypted?? then, it can be decrypted. Why they were not hashed so that it cannot be decrypted. More updates posted here... http://www.medianama.com/2011/05/223-ccavenue-hacked/ http://www.medianama.com/2011/05/223-ccavenue-hacked/
    • Indyan 15y ago
      Yep. Typically passwords are hashed and salted. However, I have seen non-technical folks use the terms hashing and encryption exchangeably. Hopefully thats the case here. Anyways, since CCAvenue didn't store the full CC number (and they definitely didn't store the passcode - for that it redirected to the issuing bank/organization), this doesn't seem to be a very serious issue, even if true.
    • dkd903 15y ago
      see this: http://twitter.com/#!/heytal/status/66071065805336576 http://twitter.com/#!/heytal/status/66071065805336576
  • abhishekpathak 15y ago
    As someone over there said : If there is no hack as he claims and the DB schema is not theirs then what are they really investigating?