Thursday, June 17, 2021
Home Opinions NDTV's Nidhi Razdan says her IT account was 'hacked' and details changed, find out...

NDTV’s Nidhi Razdan says her IT account was ‘hacked’ and details changed, find out how secure your account is

Today during one of my regular peeks on to the Twitter TL, I saw a couple of tweets from Nidhi Razdan which immediately caught my attention. In the twice a day outrage cycle of Twitter, I thought this series of tweets fall into the category of outrage worthy tweets. ‘Allegedly’ (a favourite word of NDTV) her Income tax account was hacked and all her details were changed by the hacker and she did not get any notifications about this change. Let’s look at the tweets in question

In a follow-up tweet to another NDTV journalist, she alleges that her mobile and security questions were changed. She also used the word ‘everything’ (which may include things like email, address etc)

I was totally intrigued by these series of tweets and thought this is quite dangerous if someone is able to hack into the account and change details without getting flagged. So the next thing I did was to go to the income tax India website (https://incometaxindiaefiling.gov.in/home) to see if the above is true/possible or not. In the series of steps below I have tried to ascertain 2 things

  • How easy is it to hack into someone’s account?
  • How easy is it to change basic contact details of someone’s account?

Let’s go step by step. Is it easy to hack into someone’s income tax account? The short answer is “YES”. During my investigation, I was startled to know that it is surprisingly easy to hack into someone’s account if you know 2 details of the person, namely his/her PAN and Date of Birth.

The above is the user login screen that is presented when you click on Login for registered users. User ID here is the PAN. The user must enter 3 other fields to successfully login to the website. Password, Date of birth and the captcha code.

Let’s say the hacker gets hold of your PAN and knows your date of birth. He doesn’t know your password yet. Next, he will try to ascertain the password of the account by clicking on the Forgot password link. And this is where I think one of the biggest loopholes of the income tax website exists. Let me explain how.

Once you click on the forgot password the following screen is presented

In the above screen, the hacker will enter the User ID i.e. PAN and enters the captcha code and clicks continue. He is now presented with the below screen.

The Reset password screen gives 4 options for resetting the password.

  1. Answer Secret Question
  2. Upload DSC
  3. Using OTP
  4. Using Aadhaar OTP

The options 2), 3) and 4) are very secure because they use some sort of 2-factor authentication. So unless the hacker has your mobile, it is very difficult to reset the password using these 3 methods. Now let us concentrate on the first option i.e. Answer Secret Question. Here is where the biggest loophole which I mentioned before lies. So once you select the Secret question and click continue you are presented with the following screen

In the Reset Password with Secret Question screen, the hacker has the following fields to enter.

UserID: He already knows what else he wouldn’t have reached this screen.

Date of Birth: Assumed that it is known

Secret Question: Here in the drop down there are 2 questions. One primary and one secondary. The hacker needs to guess the answer of one of them to successfully reset the password of the person.

As you can see from the above some of the questions are fairly guessable. Let’s say you have selected “Which is your favourite sports person”? as the primary question. There could be 5/6 common name that one can think of. The biggest bug in this screen is that it allows multiple attempts to answer the question. Basically, the hacker can spend the entire night going name by name till he finds the right answer. No notification whatsoever is sent saying that the secret answer was attempted multiple times. After the hacker guesses the answer to the question he is presented with the change password screen. And voila he can now change the password and login to the account. Of course, the trial and error method is unreliable and not guaranteed to work. In fact, it may even be considered improbable that this method would work, but there exists a small minuscule chance that is present.

The Income-tax authority should immediately change the logic for this Change password algorithm. Either remove the secret question way entirely and keep only the secure OTP option or put a restriction on the number attempts that one can have while entering the secret answer. If multiple attempts are made, then lock the account and send a red flag email to the registered email address.

So we agree with the first part of Nidhi’s tweet that it is actually easy to hack into someone’s account provided they know some basic details and do guesswork with the secret answer.

Now lets come to the 2nd question i.e. How easy it is to change basic contact details of someone’s account?

Let’s say the hacker once he has the login information, now wants to change the basic profile information like mobile and email.

In the Profile Settings, there are 4 tabs

  1. PAN details: Uneditable page displaying PAN of the assessee
  2. Address: Gives the address details stored on the account. Bear in mind that this address is different than the address stored in your PAN database
  3. Contact Details: Only editable section of My Profile page
  4. Aadhaar details: Again an uneditable page mentioning if the Aadhaar is linked or not.

Let’s concentrate on the Contact details page. Now let us say the hacker wants to change the primary mobile and primary email ID. This is what Nidhi asserted in her reply to Srinivasan Jain.

If one changes the mobile number and/or the email ID, then the following screen is displayed

An OTP is sent to the mobile and the email ID and only when both the OTP’s are entered, the profile changes get affected. This is a very secure way of ensuring that the profile updates are not made without a 2-factor authentication coming into play.

So the first part of Nidhi’s reply that her mobile number was changed is entirely not possible in real life unless the hacker has access to both her mobile and her email account.

Now the second part, of the security questions being changed. That can be changed without any additional 2 factor like OTP etc. But changing this is pointless as the hacker would have entered the account using this method. A notification email does arrive at your registered email address that the secret questions have been changed.

The hacker can also update the address in the Address tab without any OTP based authentication. Although it is to be noted that this address is different than the PAN database address. I am not sure for what purpose this address is used.

So, in summary, we have learnt the following thanks to Nidhi Razdan:

  1. It is easy to hack into someone’s account provided the hacker knows the PAN and the DOB of the person. The hacker then must guess the answer a simple question. No restrictions on the number of times he can answer is probably a very big flaw in the system. Either remove the secret question workflow for resetting password or introduce some additional security measures to make it difficult to hack via this route.
  2. It is not possible to change the basic contact details without entering the mobile and email OTP. This part of the profile update is very secure. One suggestion to the Income-tax team is that they also introduce OTP based authentication address and secret question update.

  Support Us  

Whether NDTV or 'The Wire', they never have to worry about funds. In name of saving democracy, they get money from various sources. We need your support to fight them. Please contribute whatever you can afford

Amit Kelkar
a Pune based IT professional with keen interest in politics

Related Articles

Trending now

Haryana: Man burnt alive to make him ‘martyr’ against farm laws, villagers demand security from ‘farmers’ at Tikri border

As per reports, casteist slurs were hurled towards Mukesh after which he was set on fire. A video of him being set on fire has gone viral on social media where one can hear casteist abuses being thrown at him before he was set ablaze.

How a personal animosity was turned into defaming ‘Jai Shri Ram’ chant: All you need to know about Ghaziabad incident

The chronology of what all transpired in the fake 'hate crime' story where an elderly Muslim man claimed he was attacked and forced to chant 'Jai Shri Ram'

Mamata Banerjee govt recommends suspension of several accounts from Twitter, YouTube and Facebook, for criticising her: What we know

Sources indicate that Govt of West Bengal recently recommended the suspension of over 200 accounts for criticising Mamata Banerjee

The churn in Bengal BJP is normal and on expected lines. Here is why I don’t worry too much about it

Candidates don’t matter so much in Bengal, party affiliations do. The TMC proved this beyond all possible doubt in 2021.

The Wire tries to force fit a ‘hate crime’ angle in Ghaziabad incident only because victim is a Muslim

The Wire lowers its bar, goes from whitewashing Islamist terrorists to defending random 'taveez maker' from rural Uttar Pradesh

‘Based on social media narrative than evidence and chargesheet: Delhi Police files SLP after Pinjra Tod accused get bail

On 15th June, the Delhi High Court granted bail to Jamia Milia Islamia student leader Asif Iqbal Tanha, far-left ‘activists’ Devangana Kalita and Natasha Narwal in the Anti-Hindu Delhi riots case.

Recently Popular

Salman Khan’s ‘Radhe – Your Most Wanted Bhai’ earns Rs 17,792 over three days from two theatres in Maharashtra: Details

Citing low occupancy, the theatres screening Salman Khan starrer Radhe: Your Most Wanted Bhai have reduced number of its daily shows

Virtual hearing embarrassment: Congress leader Abhishek Manu Singhvi caught attending the court proceedings without pants

Abhishek Manu Singhvi was caught attending court proceedings in boxer shorts when one of the screens accidentally fell off and showed the naked legs of the senior advocate

As Yogi Sarkar lodges FIR against Twitter, 8 others, Alt News co-founder Zubair deletes fake hate crime video: Details

The UP Govt has initiated action against Twitter for failing to take down tweets that spread misinformation about a crime in the state.

Did a journalist inadvertently end up revealing real reason why Rahul Gandhi ended his West Bengal rallies?

COVID-positive Rahul Gandhi cancelled his public rallies in West Bengal, but did not disclose it while announcing the same. He, instead, claimed it was being done in view of raging pandemic.

Dhruv Rathee fans mark YouTuber Karolina Goswami for targeted harassment after she exposed his lies

After Karolina Goswami pointed out the factual errors and mistakes in the Dhruv Rathee video, Rathee's supporters have been harassing and abusing Goswami.

Pakistani audience go ballistic over Zee5 web series featuring Muslim girl-Indian Hindu boy love story, call it ‘haram’

The Pakistani web series features the love story between a Pakistani Muslim girl and Indian Hindu boy who have both lost their fathers to the conflict between the two nations.
- Advertisement -

 

Connect with us

255,564FansLike
554,245FollowersFollow
24,400SubscribersSubscribe