Cyber Security Projects Case Studies

VA-PT of Online Parcel Delivery Portal

Scenario: Fastest growing parcel delivery and parcel booking platform having thousands of live customers and 100s of daily parcel bookings faced issue of Customer Data leakage. The test was to provide in-depth Security Testing to find and fix all possible Security vulnerabilities.

Test: Initially started with tool based VA which moves towards penetration testing of Web Application and Server with manual techniques. Manual approach helps to find 6 Severe level and 9 High level vulnerabilities that resulted into total customer data loss and privacy loss.

Risk:

  • Improper handling of session and cookies led to unauthorized login without credential
  • Severe file upload vulnerability found that could destroy the whole server
  • User's original documents uploaded on the system were compromised and easily downloaded - hence no User privacy maintained.

    • Cyber Attack Investigation for Casino Portal

    Scenario: Casino Portal's database was hacked and screenshots were sent to owner containing database of all other portals as well that are hosted on same server. We were contacted by Development Company to identify how it was happened.

    Approach: We did initial review of the server. It was IIS server containing more than 20+ applications running on it. Based on screenshot initially it was assumed that it was done using Shell upload. We have analysed all available Logs from IIS server but as it was Basic plan purchased by Development Company, no enough logs were detected. Few of other applications are detected with vulnerable login forms. SQL server logs are examined and few manual Penetration to system tried to detect if we were able to find any known possible vulnerability - to re-generate the scenario.

    Conclusion:

  • Possible SSH compromise was happened which leads to IIS access,
  • Brute-force attack was done on SQL Server which one genuine and other few like-looking user-names,
  • One Korean IP was found from which maximum trails made,
  • Possible to bypass few portal's login form with vulnerable scripts that allows system access.

    • VA-PT of Educational ERP management System

    Data: ERP was having 60+ plug and play modules with Lakhs of live users and Hundred of Clients active on it. Challenge was to perform Penetration testing on Live server with daily bases updating code.

    Test: Primary test includes Penetration testing of Web Application, Server and Network. As system was on Production server having 3000+ daily transactions, penetration testing was conducted with taking care that system must not be down during day time. ERP was having on-line payment integration with multiple gateways. Test was to conduct for combination of Dynamically generated multiple user types with 60+ Modules with Dynamic right based access mechanism at view level + data level.

    Risks:

  • Logical Security error in payment gateway integration which enable payment fraud. By paying 11 bucks, parents could pay thousands of bucks of fees for their student,
  • Code injections could lead to system exploitation resulting into system’s misbehavior,
  • improper handling of session and cookies led to unauthorized login without credential,
  • Server was not configured enough to avoid DDoS attack,
  • Possible to enter scripts into the system which could target database integrity,
  • Other 18 security vulnerabilities that can make system open to attacker

    • Odoo Based CMS + QA Portal VA-PT

    Data: An Odoo based ERP Web Application with multi user admin panel and plug and play module purchase system.

    Test: The test was to provide overview of the available vulnerabilities into this existing system which led to few critical attack factors.

    Risks:

  • User’s session is hijacked due to which anybody to get into the account without authentication,
  • Code injections could lead to system exploitation resulting into system’s misbehavior,
  • It was possible to enter scripts into the system which could target database integrity

    • Hotels Management CMS

    Data: A very big CMS of reputed group which is being used by chains of Hotels across INDIA. It contained data of more than 1000 hotel's room details, customer details, booking details, payment details, tax details etc.

    Test: The test was to try and penetrate the CMS and look into the possible vulnerabilities of the system where we were successful in uploading a shell into the system and compromise the complete CMS along with the hotel’s data.

    Risks:

  • Able to download 4+ GB of CRM's database,
  • Hotel booking and registrations tampering,
  • Customer details compromised along with their booking IDs, room information, travel dates and payment details,
  • Reputational loss for the Hotels

    • Firewall Configuration Security Testing

    Data: Firewall UTM/WEB.

    Test: Check of configurations for the firewall, found that all the settings were put into default only and no proper channelization of traffic was restricted.

    Risks: Trespassing into sensitive transmission of data over the network.

    Online Banking site.

    Test:Few vulnerabilities from top standards

    Risks: May lead to elevating attacks going further.

    Event Site VA-PT

    Data: Details of events and location.

    Test: This test was to perform more of a code review and walk through test for some unusual behavior. It was found that there was a phishing pay-pal page implanted into the site's payment section. Going further we found a shell loaded into the root which enabled the attacker to get to the system itself.

    Risks: The whole system compromised with each and every information.

    Donor Site VA-PT

    Data: Online shopping where the purchase leads to donation instead of profit making.

    Test: It lead to many of the OWASP top 10 vulnerabilities along with the RFI/LFI attacks where one can run their own scripts within the onload event of the site's page. One can plant their scripts into the database as well.

    Risks: Sensitive data leakage, Customer's purchase details leakage, donation amount transfered to the attacker, database compromised.

    E-Commerce VA-PT

    Data:typical Online shopping, carts and payment gateways.

    Test: It was vulnerable with almost 40% of the OWASP top 10 attacks.

    Risks: Customer detail leakage as database access was open. Cart item modifications - before payment we were able to place order for 10x items in same amount. The site was detected to be used as phishing site. Business reputation loss can happen.

    Health Care Website (CMS) VA-PT

    Data: Doctor details, hospital details, patient details, undergoing treatments, health-care devices used, online/remote control of patients devices, online health monitoring.

    Test: We were able to successfully get all the details and shockingly we it was possible to alter the data to an extent that could bring variation in the medical treatment of the patient that was monitored on-line. There were chips fitted into patient which were giving constant data to details to a remote doctor. Using these, doctors were able to provide shock to patient in case of bad health. We were able to change the frequency of automatic shock - that can cause patient's death.

    Risks: Human loss, Hospital and doctor's reputational loss.