wordpress blog stats
Connect with us

Hi, what are you looking for?


Updated: CCAvenue Payment Gateway Hacked: Report

Update 7: Countering what Patel claims in an interview with us, Akash Mahajan, in the comments to this post, points out a web server update log(screenshot), that indicates that the upgrade to Apache 2.2.17 for CCAvenue took place today. Patel had told us that the upgrade took place 5 months ago, and used that as a basis for claiming that the logs published are inaccurate, since they indicate that the server was Apache 2.2.14. As a counterpoint, OneMindsl says that netcraft updates that data only when requested, so this may not be indicative of upgrades, rather updates of upgrades (confusing, eh?).

Update 6: FullDisclosure appears to have the original copy of the email that d3hydr8 sent. Thanks @dotmanish.

Additionally, Anon, in the comments, says that “its still possible that someone accessed this backup somewhere in their file system on their server; and asks “if there was no hack, how is company confidential schema, employee data out in the public domain?” Note that Patel told us that it’s not “real live database schema”.

Akash Mahajan points out “Sorry for nitpicking but, Passwords need to be hashed. Hashing means one way encryption. This means once hashed there is no way of getting the original value back. Ideally secure passwords are salted and hashed. This helps in avoiding a dictionary attack against hashed passwords.”

More questions in the comments from asdf

Advertisement. Scroll to continue reading.

Update 5: Hetal R on Twitter says that when he tried resetting a CCAvenue password, he got the plaintext password, and that is a security hole. He says that “By encrypted, it means non-decryptable. When you click on forgot password, a link should be sent, allowing password reset”. Sounds reasonable enough.

Update 4: Also read this Q&A with Patel, where he addresses some of the questions we received, and some claims made in that hacking report.

Update 3: the account of HackerRegiment.com, it appears, has been suspended. Details, last we checked, were still up at Pluggd.in and ClubHack. We’ve just got more details from Vishwas Patel, who says that the information that was published as ‘hacked’ was incorrect, and there is misinformation being spread. He’s pointed out a few things that point towards incorrect information.

Note that MediaNama is not in a position or qualified to determine hacker intent/claims or CCAvenue claims. We’ll let sides be represented. Take your pick.

Update 2: Patel further clarifies that “More than 85-90% of our transactions are netbanking and non-credit cards related transactions. Those transactions go through the bank server, where the end customer enters usernames and passwords, and we don’t store those. They are entered on the bank servers. There is no payment related info on our servers. CCAvenue is just a redirector in this case.”

Update 1: An initial response from Vishwas Patel, CEO of Avenues India, which owns CCAvenue, who says that he’ll get back to us after they’ve looked into this in detail. On the face of it, this is what he has to say: “From our side, we’ll have to look into it. It is not possible, because of the kind of application level firewalls that we have put up. We don’t store credit card numbers or any other kind of payment details because of the Payment Card Industry Data Security Standards, and there is no credit card or payment related info on our servers. There are new standards that have come in, that is PCI DSS 2.0, which are more stringent than the earlier standards, and we have just completed the assessment under that last week.”

Advertisement. Scroll to continue reading.

Earlier: CCAvenue, among India’s largest online payment gateway services, has been hacked using “Hidden SQL injection”, according to a report on HackerRegiment.com. Apparently, all admin passwords at CCAvenue have been leaked. HackerRegiment has published a copy of some if the information it received via email from a hacker called d3hydr8 (leetspeak for dehydrate), including a list of databases, some information on tables within the databases, and more importantly, screenshots that suggest that administrator passwords may have leaked. Please note that MediaNama is unable to confirm the veracity of this report – calls, SMS’ and emails to Avenues India CEO Vishwas Patel await a response.

A MediaNama reader informs us that they’ve just made a payment via CCAvenue, so it appears that it is still active. HackerRegiment says it has informed India’s Computer Emergency Response Team. We’ll update in case we get a response from CCAvenue.

Written By

Founder @ MediaNama. TED Fellow. Asia21 Fellow @ Asia Society. Co-founder SaveTheInternet.in and Internet Freedom Foundation. Advisory board @ CyberBRICS

MediaNama’s mission is to help build a digital ecosystem which is open, fair, global and competitive.



The Delhi High Court should quash the government's order to block Tanul Thakur's website in light of the Shreya Singhal verdict by the Supreme...


Releasing the policy is akin to putting the proverbial 'cart before the horse'.


The industry's growth is being weighed down by taxation and legal uncertainty.


Due to the scale of regulatory and technical challenges, transparency reporting under the IT Rules has gotten off to a rocky start.


Here are possible reasons why Indians are not generating significant IAP revenues despite our download share crossing 30%.

You May Also Like


Google has released a Google Travel Trends Report which states that branded budget hotel search queries grew 179% year over year (YOY) in India, in...


135 job openings in over 60 companies are listed at our free Digital and Mobile Job Board: If you’re looking for a job, or...


Rajesh Kumar* doesn’t have many enemies in life. But, Uber, for which he drives a cab everyday, is starting to look like one, he...


By Aroon Deep and Aditya Chunduru You’re reading it here first: Twitter has complied with government requests to censor 52 tweets that mostly criticised...

MediaNama is the premier source of information and analysis on Technology Policy in India. More about MediaNama, and contact information, here.

© 2008-2021 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ

Subscribe to our daily newsletter
Your email address:*
Please enter all required fields Click to hide
Correct invalid entries Click to hide

© 2008-2021 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ