E-tolling or E Thief?

[Hermes14]

Originally poster by tny

http://tny.cz/ef11db01

SANRAL E-TOLL WEBSITE VULNERABILITY

By Moe1

SECURITY ADVISORY

DOCUMENT ID: v1.0

RISK LEVEL : CRITICAL


DISCLAIMER

The information provided in this document is for educational purposes only. The author is in no way responsible for any misuse of the information. The author insists that such information should never be used for malicious purposes.

INTRODUCTION

The SANRAL e-Tolls website allows users to register their e-tags online and provides a service where by customers can monitor, pay and track their e-toll accounts. The website contains sensitive customer information such as ID numbers, car number plates, postal addresses, payment methods etc. therefore it is crucial that SANRAL ensure it is secured and user data is protected. The purpose of this report is to display the false sense of security the website portrays by highlighting a simple vulnerability which exist due to a lack of basic web application security logic.

OVERVIEW

When a user registers on the website for the first time the account is put into a “pre-registration” state. The account will remain in a “pre-registration” state until the user confirms the account by clicking on a link provided in a confirmation email. This “pre-registration” confirmation link contains a serious security problem where by it provides the users pin number on the confirmation screen. Using this link an attacker can inject another username into it which would result in the confirmation page containing the pin number of another user.

VULNERABILITY DEMO – HACK AN E-TOLL ACCOUNT IN 5 SECONDS


1. Browse to the SANRAL e-toll login page. https://www.sanral.co.za/e-toll/portal/default.aspx
2. Okay so you have the USERNAME and the VERIFICATION CODE that is provided. To get the users PIN all you need to do is browse to the “pre-registration” confirmation link and specify the USERNAME.

http://www.sanral.co.za/e-toll/portal/PreRegisterAccountValidate.aspx?UserName=jasonbourne

(Notice the pin of that users account is provided! To view it in clear-text simply view the pages source)

3. Now that you have the pin go back to the login screen, enter username, pin and verification code provided.
4. And there you have it an e-toll account hacked in 5 seconds!

PROOF OF CONCEPT EXPLOIT

http://tinyurl.com/melw4nw

VIDEO DEMO

http://www.youtube.com/watch?v=cacn2vRWzF8

CONCLUSION

It is great that SANRAL informs you to keep your pin safe in their “Terms and conditions” but it’s not very great that they give out your pin to anyone that basically requests for it.

[Trickzta]

We're on the road to nowhere! Mixups galore.

Already, the Sanral system is self-destructing. The continued boycott of e-tags by motorists must continue.

The only way that Sanral can make the system become a cash-cow is when motorists submit.

I've totally avoided the roads, but come next week the roads will become busy again. Then users may be forced to use the highways.

Don't pay. Ask for proof. Tie the system up with paperwork. It is not enforcable to insist that motorists get tagged.

http://www.fin24.com/MyFin24/Feedback-on-e-tolls-still-streaming-in-20140105

More weird messages in these links.

http://www.fin24.com/MyFin24/E-toll-woes-continue-20140106

http://www.fin24.com/MyFin24/More-e-toll-surprises-20140106

[Justloadit]

Just received my first eToll invoice via post.
I am in a bit of a dilemma, as the vehicle belongs to a Trust, and as a Trustee, mu fiduciary duty is to always ensure that the trust is not prejudiced in any way by the control of the trustee.

Anyway, that is a discussion for another day.
On the invoice, albeit a small one for R36.00, it has pictures of each time the vehicle passed the gantry with date and time stamp, it also has almost a 50% discount if paid with in 10 days.
They are really trying very hard to get motorists to pay.

I was considering, that if I was to pay the invoice not sure yet if i will, I was going to use a cheque to make the payment to get the receiving bank to charge a cheque deposit fee, but I also received a letter from Standard bank that they are now going to charge a flat rate of R45.00 for each cheque issued on the account that I would be using, a bit of a bummer to the consumer.

[Citizen X]

Just received my first eToll invoice via post.
I am in a bit of a dilemma, as the vehicle belongs to a Trust, and as a Trustee, mu fiduciary duty is to always ensure that the trust is not prejudiced in any way by the control of the trustee.

Anyway, that is a discussion for another day.
On the invoice, albeit a small one for R36.00, it has pictures of each time the vehicle passed the gantry with date and time stamp, it also has almost a 50% discount if paid with in 10 days.
They are really trying very hard to get motorists to pay.

I was considering, that if I was to pay the invoice not sure yet if i will, I was going to use a cheque to make the payment to get the receiving bank to charge a cheque deposit fee, but I also received a letter from Standard bank that they are now going to charge a flat rate of R45.00 for each cheque issued on the account that I would be using, a bit of a bummer to the consumer.

First hand feedback such as this allows one to put things into perspective

[Jacques#1]

If you listened to Jacaranda yesterday they spoke to Vusi, the SANRAL spokesperson. He admitted that the sms's and the phonecalls does not dictate an invoice, as they will still send the invoice later, and was not denying the fact that you dont have to pay without a proper invoice, so their 7 day story is bull, to start with. Then a listener phoned in and said their vehicles are business use, and they need a VAT invoice before paying according to the VAT act, Vusi replied by saying that the business vehicle passing through a normal toll gate would do so without receiving an invoice first, what the poor man forgets, is if you pass through the conventional tollgates you request a receipt immediately, ag shame, he probably didnt know that. Then his excuse for paying immediately is the discounts, a caller said he requested his amount from the call centre, and they refused to give him the amount, stating he must register first, old Vusi denied this, stating that they must give you the amount outstanding, once again, the left hand does not know what the right hand is doing. I am so far on R90 and R78 for two cars, not quite sure how I got 18 units on one car since I know I passed the tollgates only about 6 times? P.S. I got the amounts by using a loophole in the SANRAL website, no registration web registration etc.

[Citizen X]

If you listened to Jacaranda yesterday they spoke to Vusi, the SANRAL spokesperson. He admitted that the sms's and the phonecalls does not dictate an invoice, as they will still send the invoice later, and was not denying the fact that you dont have to pay without a proper invoice, so their 7 day story is bull, to start with. Then a listener phoned in and said their vehicles are business use, and they need a VAT invoice before paying according to the VAT act, Vusi replied by saying that the business vehicle passing through a normal toll gate would do so without receiving an invoice first, what the poor man forgets, is if you pass through the conventional tollgates you request a receipt immediately, ag shame, he probably didnt know that. Then his excuse for paying immediately is the discounts, a caller said he requested his amount from the call centre, and they refused to give him the amount, stating he must register first, old Vusi denied this, stating that they must give you the amount outstanding, once again, the left hand does not know what the right hand is doing. I am so far on R90 and R78 for two cars, not quite sure how I got 18 units on one car since I know I passed the tollgates only about 6 times? P.S. I got the amounts by using a loophole in the SANRAL website, no registration web registration etc.

A picture is being drawn right here by South Africans, a clear reflection if you will!

All this feedback allows one not only to understand this e-tolling system in practice but also to demonstrate that there are real problems and not imaginary ones.

[Hermes14]

Until today Standard bank were offering free etags.
After some people threatened to close their accounts I see they have removed the page.
Proudly etag free also commented on it.

https://www.facebook.com/proudly.etagfree?hc_location=timeline

[Trickzta]

10 year old gets SMS from Sanrail for toll fees! (702 Radio today)

Plus the claim of 900,000 registrations is challenged.
“The government is just gangsters in nice suits.”
http://www.nytimes.com/2013/12/27/wo...t&emc=rss&_r=0

[sterne.law@gmail.com]

Hmm...
Is SANRAL a registered credit provider?

[AndyD]

Shouldn't be too long now before the lawyers and advocates get busy with the first legal wrangles over the billing and start establishing the case-law for similar future cases.

[Blurock]

All this appaers to be evidence piling up to strengthen the case against e-tolling. With a president dabbling in witchcraft and parlementarians engaging in stone age barbaric practices, can we now expect some spell to be cast upon those who do not comply?

[Justloadit]

We will send the tokolosh after you if you do not pay! OK!
If that does not move you, then I will get your ancestors to bestow bad luck on you!

[Trickzta]

Tag or tagless 'free'way users have access to camera images.

I'm not sure what the setup is, but here's the link that caught my eye.

Would've opened the link if I could see the photos as well, oh well they'll get around to it one day.

http://m.engineeringnews.co.za/artic...13/rep_id:3182

[Justloadit]

The main issue here will be that upon registering a user name and password, it will request your email address, under the guise as a contact email to validate your user name and also to send a password in the case that you forget it. Then wham bam emails will arrive at your box with invoices attached.

I DO NOT TRUST THEM.

[IanF]

Still waiting for an invoice been through 2 gantries. I see the DA has a court case against them starting 4 March. But this will probably go the same as the other cases. Also we can try and "demand" we get the Afrikaans tariffs