Feeds

TheTrainline revamps security handling after glitch

Back on track

High performance access to file storage

TheTrainline.com, the UK website for buying train tickets, has revamped its procedures for dealing with security reports following an incident where a security bug meant that customers could be invited to submit credit card details over an insecure link. The flaw had an effect only when users made an error in submitting their credit card details, so it didn't affect the majority of customers.

Nonetheless it was a serious slip-up, which went unresolved even three weeks after it was reported to the firm by Tim Anderson, a Reg Developer contributor, on 8 October. Another Reg reader reported similar problems. Our initial attempts to contact the firm also proved fruitless, but less than a day after our story was filed on the problem TheTrainline.com implemented a fix.

The passenger transport etailer said on Monday that it has now updated its procedures for handling reports of security bugs, following a review after our report in November.

"I cannot express firmly enough that security is an issue that this company takes very seriously," Ben Pearson, commercial director of TheTrainline.com, told El Reg. "It was with considerable dismay that I learned of this fault and the problem was resolved within a day of it being brought to my attention. Subsequent to your article we have also introduced new procedures such that customer reported faults of this nature get escalated immediately for diagnosis and remedy."

TheTrainline.com deserves credit for its willingness to review how it handles security bugs. It's a lesson other firms in the transport sector - who in our experience at least are far more difficult to contact about problems over security than other ecommerce firms - would do well to note.

The original problem - now resolved - kicked in when customers made an error on the final payment page after choosing a journey they wished to purchase. Customers who made an error were bounced over onto an insecure page, inviting them to submit corrected details over an unencrypted HTTP link, as a result of a coding error. Inattentive users could be forgiven for missing the change. Although the HTTPS signifier in the URL was absent, a falsely reassuring padlock graphic remained in place, along with logos for Verified by Visa and MasterCard SecureCode.

There's no evidence that the bug was used to carry out fraud, but the potential for abuse was clearly there. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Bad PUPPY: Undead Windows XP deposits fresh scamware on lawn
Installing random interwebs shiz will bork your zombie box
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.