Comments on Digital Daaroo - by Saurabh Nanda: CCAvenue hack: What can developers & businesses le...

sa they say that no hack were done bt this is to i...

2011-08-22T17:27:12.170+05:30

sa they say that no hack were done bt this is to inform you tat paytm.com

latest hack yesterday

ccaevenue has low security anyone should tell the...

2011-08-22T17:24:17.848+05:30

ccaevenue has low security

anyone should tell them to upgrade

now hackers are very sharp ,like me and childrens like age of 17 hacking it

ccavenue is a payment gateway website tat gateways...

2011-08-22T17:22:14.371+05:30

ccavenue is a payment gateway website tat gateways the bank and the website"S

it got hacked many times

I'm glad that my gyaan helped. Where have you ...

2011-06-10T17:49:35.160+05:30

I'm glad that my gyaan helped. Where have you used bcrypt, Srikanth?

Thanks for the bcrypt thing Saurabh.

2011-06-10T17:41:20.727+05:30

Thanks for the bcrypt thing Saurabh.

Hmm, probably you're right about the upgrade d...

2011-05-08T10:46:37.921+05:30

Hmm, probably you're right about the upgrade date, but it could be that the hacker got lazy and looked-up the server ID string on netcraft on 4th may just before publishing the hack. Possible?

And yeah, hiding server identification is security 101. Not sure whether that's part of PCI-DSS or not.

Good point about MD5 and SHA. The CCAvenue respon...

2011-05-08T08:08:45.979+05:30

Good point about MD5 and SHA.

The CCAvenue response is preciously what one would have expected. We are like our politicians - always blaming the opposition party for the "mischief". However I don't think the interpretation of Netcraft report is correct. Since the last 2 pings are at a difference of 1 year, upgrade could have happened anytime in between. Also have a look at this: http://toolbar.netcraft.com/site_report?url=http://ccavenue.com which shows that Apache was indeed upgraded on another server.

Also isn't it also suggested as part of basic hardening of site that you turn off detailed server headers giving the version of Apache and other installed modules? :)