Feeds

TheTrainline revamps security handling after glitch

Back on track

Remote control for virtualized desktops

TheTrainline.com, the UK website for buying train tickets, has revamped its procedures for dealing with security reports following an incident where a security bug meant that customers could be invited to submit credit card details over an insecure link. The flaw had an effect only when users made an error in submitting their credit card details, so it didn't affect the majority of customers.

Nonetheless it was a serious slip-up, which went unresolved even three weeks after it was reported to the firm by Tim Anderson, a Reg Developer contributor, on 8 October. Another Reg reader reported similar problems. Our initial attempts to contact the firm also proved fruitless, but less than a day after our story was filed on the problem TheTrainline.com implemented a fix.

The passenger transport etailer said on Monday that it has now updated its procedures for handling reports of security bugs, following a review after our report in November.

"I cannot express firmly enough that security is an issue that this company takes very seriously," Ben Pearson, commercial director of TheTrainline.com, told El Reg. "It was with considerable dismay that I learned of this fault and the problem was resolved within a day of it being brought to my attention. Subsequent to your article we have also introduced new procedures such that customer reported faults of this nature get escalated immediately for diagnosis and remedy."

TheTrainline.com deserves credit for its willingness to review how it handles security bugs. It's a lesson other firms in the transport sector - who in our experience at least are far more difficult to contact about problems over security than other ecommerce firms - would do well to note.

The original problem - now resolved - kicked in when customers made an error on the final payment page after choosing a journey they wished to purchase. Customers who made an error were bounced over onto an insecure page, inviting them to submit corrected details over an unencrypted HTTP link, as a result of a coding error. Inattentive users could be forgiven for missing the change. Although the HTTPS signifier in the URL was absent, a falsely reassuring padlock graphic remained in place, along with logos for Verified by Visa and MasterCard SecureCode.

There's no evidence that the bug was used to carry out fraud, but the potential for abuse was clearly there. ®

Internet Security Threat Report 2014

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Reducing the cost and complexity of web vulnerability management
How using vulnerability assessments to identify exploitable weaknesses and take corrective action can reduce the risk of hackers finding your site and attacking it.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.