http://arstechnica.co.uk/security/2016/07/ecotricity-password-reset-bug-ev-charging-app/ Ecotricity plugs password reset security hole in EV charging app 26/7/2016 Tom_Mendelsohn
[image / Aurich / Getty http://cdn.arstechnica.net/wp-content/uploads/sites/3/2016/07/bugs-on-board-640x360.jpg bugs-on-board ] Major vuln found, reported, and fixed within 48 hours of tip-off from infosec bod. Ecotricity—the outfit behind one of Britain's largest networks of electric vehicle charging stations—introduced a bug earlier this month into the app its customers use to charge their cars. Any moderately skilled hacker could have used the flaw to reset anyone's password and take control of the account. Ecotricity plugged the security hole in its Electric Highway app on July 11—roughly 48 hours after it was reported to the firm by infosec expert Scott Helme. He notified Ecotricity as soon as he had confirmed that the app contained a serious vulnerability. In a blog post, Helme explained how easy it can be for major security bugs to be introduced into an app's API. The app, available on Apple iOS and Android, gives drivers access to Ecotricity's network of nearly 300 charging stations across the UK. It was released earlier this year to replace a simpler RFID card system, and is free to customers who get their household energy from the firm. A price tag of £6 per half-hour of charge comes attached for non-subscribers to Ecotricity. Helme signed up and—like any good white hat—started poking around. He soon found that the app's password reset function sent him a link containing a token that would allow him to reset the password on any account, "using either the username or e-mail address for the account." This could give him full control of anyone's account, Helme noted, meaning he could "perform any action the account holder could." He said: "This includes incurring charges to any credit cards stored on the account. I can also change the account e-mail address now I'm authenticated so the genuine owner can't password reset their way back in!" Helme praised Ecotricity's "rapid response" to his disclosure of the security bug, and added that it took "immediate action to protect its user's accounts by disabling the affected API endpoint." He added: Fellow security researchers will probably be all too aware that reporting issues like this to companies can often result in a very hostile interaction. It's quite refreshing to have dealt with a company that was open to being contacted by a security researcher but next time perhaps engage one before publishing your API online. Ars sought comment from Ecotricity, but it hadn't got back to us at time of publication. Update A spokesperson at Ecotricity told us: “Despite having the app independently security tested with an accredited organisation, there was an oversight in its development. This was a flaw in how users reset their password that made it possible for someone to access another users account—though not their bank details." He added: "We immediately worked on a fix and deployed it overnight—[which] permanently closed the vulnerability." [© 2016.Condé Nast UK] ... http://www.oxforddictionaries.com/us/definition/american_english/cheapjack cheapjack http://www.collinsdictionary.com/dictionary/english/cheap-jack For EVLN EV-newswire posts use: http://evdl.org/evln/ {brucedp.150m.com} -- View this message in context: http://electric-vehicle-discussion-list.413529.n4.nabble.com/Ecotricity-uk-plugs-security-hole-in-cheapjack-EVSE-charging-app-tp4683174.html Sent from the Electric Vehicle Discussion List mailing list archive at Nabble.com. _______________________________________________ UNSUBSCRIBE: http://www.evdl.org/help/index.html#usub http://lists.evdl.org/listinfo.cgi/ev-evdl.org Read EVAngel's EV News at http://evdl.org/evln/ Please discuss EV drag racing at NEDRA (http://groups.yahoo.com/group/NEDRA)
