Serious security issue with IRCTC website

The login form of the IRCTC web site is being submitted over HTTP in plain text. This is a very serious issue since both your user ID and password could be sniffed by someone. One thing that I observed was that they have a HTTPS server running and this server is capable of receiving login requests. I think it was a bug in the code that the developer gave the URL as HTTP instead of HTTPS.

How to overcome the issue? This is not a clean approach but works fine. You can copy and paste the URL "https://www.irctc.co.in/cgi-bin/bv60.dll/irctc/services/login.do?userName=XXX&password=YYY" in your browser. Replace the XXX with your user ID and YYY with your password.

I tried to send a feedback about this to the site admin or someone in charge. Pathetic ... I could not find any link/email address in that website to do this. Hopefully someone from IRCTC will read this blog and fix the issue.

Comments

Lavnish said…
hhmmmm nice finding buddy
sad but true... the government websites in country of techies ... guess thats why china is easily attacking indian government servers

more at
http://lavnish.blogspot.com/2007/05/wwwindianrailgovin-usability.html
5/08/2008 09:23:00 AM
Unknown said…
This comment has been removed by the author.
6/01/2008 03:00:00 PM
PRK said…
Wait a minute! Do you say that they send the password as plain text in the URL?
6/01/2008 11:39:00 PM
Unknown said…
Have you heard of these....
In 1982 a Lockheed F-117 aircraft was crashed because of a software bug. The software interchanged the "yaw rudder" with "pitch elevator".
Becauseof a code number mix-up, in September 1994, three parking offenders in Bayreuth, Germany got charged with "preparation of a war".
In 1985 in a assembly hall of General Motors all the black cars were assembled without the windscreen. Why? Because a Robot couldn't recognize the "Black" color.
The "shutdown molody" of the Siemens S65 mobile was so laud when the battery was faint, some even got hearing damages.
In 1996 a Prototype of the Ariane 5 rocket of the european space agency was destroyed because they used the software from Ariane 4 rocket.
1985 - 1986 few patients were killed in a hospital in USA because the medicine dose was calculated wrongly.
In 1962 NASA lost their 80 Million Dollar "Mariner 1" because of a missing "hyphen" in the program code.
Because of a "prefix" error in a F-16 Attack Aircraft, it turns upside down every time it flew over the equator.
NASA Mars Lander
Failed translation English units into metric units
major error in spacecraft's path as it approached Mars
Crashed into the planet
Shut off descent engines prematurely
Taxpayer cost: $165 Million
IN 1988, the US Vicennes shoots down Airbus 320
290 human lives lost
“cryptic and misleading output displayed by the tracking software “
Im still digging for fatal flaws of2000!!
But still Software are manmade! and here no one is infallible
8/09/2008 04:39:00 AM
Bhanu said…
Hello,

Thanks for posting such a great information on India railways, but I think the main issue with IRCTC is the REFUND.
The refund policy is very bad, it may take more then 3-4 months even after many followups via emails and even send a written complaint to the GM of Indian Railways.. This is the only drawback, our Govt. should take some action and improve the refund policy so that customer do not face at least refund problem.
1/30/2010 11:08:00 PM
Post a Comment

Popular posts from this blog

The mysterious ORA-03111 error

Recently one of the applications that I developed started throwing exceptions, that had the following message: SQL state [72000]; error code [1013]; ORA-03111: break received on communication channel When I googled around, I couldn't come across anything useful. Sadly enough most of the sites just showed the documentation for that error, without any explanation from anyone experiencing that issues. So here you go, with the best possible explanation that I could come up with. My application sets two things on the connection that is throwing this exception: It sets the fetchSize to be 2500 rows It sets the query timeout to be 10 seconds The database server and the application are separated over a long latency network (actually there is a NetEm box that emulates the long latency between these two boxes) which has a latency characteristic of 50+/-5 milliseconds. This is the whole setup. It is important to understand how the timeout is handled by the Oracle client (in my case JDBC clien...
Read more

Note on allocationSize parameter of @SequenceGenerator while using JPA

I ran into what I thought as an issue while I was using the sequence ID generation strategy in JPA. The JPA provider I am using is Hibernate. I think sharing my experience will save someone some time. To use a sequence (For e.g. Oracle sequence) to generate values and assign them to the ID field of your persistence object, you will following something like this: @Id @Column(name = "ITEM_ID") @GeneratedValue(strategy = GenerationType.SEQUENCE, generator="ItemIdSeqGenerator") @SequenceGenerator(name="ItemIdSeqGenerator", sequenceName="ITEM_ID_SEQ", allocationSize=1) private long itemId; This means the following things: The @Id annotation says that the field itemId is a primary key. The @Column annotation says that the corresponding column in the database is ITEM_ID. The @GeneratedValue says that the value that needs to be populated in the itemId should be generated, while that object is persisted. The strategy to generate the value is to...
Read more

xVM's vboxmanage.exe command

You can view and edit the configuration of your guest OSs using the vboxmanage command. To view the list of guest OSs you have, give the following command: C:\Program Files\Sun\xVM VirtualBox>VBoxManage.exe list vms VirtualBox Command Line Management Interface Version 2.2.2 (C) 2005-2009 Sun Microsystems, Inc. All rights reserved. "MySolaris" {dc6dc85f-5583-4a1b-bf3e-969941a2cd91} "Ubuntu" {eb973bbf-d86e-4579-85eb-6ea2cd12bf95} "Debian" {3e784597-89d8-4f17-90cb-63e866c651a3} "openSUSE" {6862884e-60e1-4c65-8aab-b57ec38a3922} "Debian-Lenny" {4b561432-abac-4a27-a501-b42af956b96b} To view the specific guest, you can use the UUID of the guest. For e.g. C:\Program Files\Sun\xVM VirtualBox>VBoxManage.exe showvminfo eb973bbf-d86e-4579-85eb-6ea2cd12bf95 VirtualBox Command Line Management Interface Version 2.2.2 (C) 2005-2009 Sun Microsystems, Inc. All rights reserved. Name: Ubuntu Guest OS: Ubuntu UUID: eb973bb...
Read more