Feeds

TheTrainline revamps security handling after glitch

Back on track

The Essential Guide to IT Transformation

TheTrainline.com, the UK website for buying train tickets, has revamped its procedures for dealing with security reports following an incident where a security bug meant that customers could be invited to submit credit card details over an insecure link. The flaw had an effect only when users made an error in submitting their credit card details, so it didn't affect the majority of customers.

Nonetheless it was a serious slip-up, which went unresolved even three weeks after it was reported to the firm by Tim Anderson, a Reg Developer contributor, on 8 October. Another Reg reader reported similar problems. Our initial attempts to contact the firm also proved fruitless, but less than a day after our story was filed on the problem TheTrainline.com implemented a fix.

The passenger transport etailer said on Monday that it has now updated its procedures for handling reports of security bugs, following a review after our report in November.

"I cannot express firmly enough that security is an issue that this company takes very seriously," Ben Pearson, commercial director of TheTrainline.com, told El Reg. "It was with considerable dismay that I learned of this fault and the problem was resolved within a day of it being brought to my attention. Subsequent to your article we have also introduced new procedures such that customer reported faults of this nature get escalated immediately for diagnosis and remedy."

TheTrainline.com deserves credit for its willingness to review how it handles security bugs. It's a lesson other firms in the transport sector - who in our experience at least are far more difficult to contact about problems over security than other ecommerce firms - would do well to note.

The original problem - now resolved - kicked in when customers made an error on the final payment page after choosing a journey they wished to purchase. Customers who made an error were bounced over onto an insecure page, inviting them to submit corrected details over an unencrypted HTTP link, as a result of a coding error. Inattentive users could be forgiven for missing the change. Although the HTTPS signifier in the URL was absent, a falsely reassuring padlock graphic remained in place, along with logos for Verified by Visa and MasterCard SecureCode.

There's no evidence that the bug was used to carry out fraud, but the potential for abuse was clearly there. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.