NDTV’s Nidhi Razdan says her IT account was ‘hacked’ and details changed, find out how secure your account is

Today during one of my regular peeks on to the Twitter TL, I saw a couple of tweets from Nidhi Razdan which immediately caught my attention. In the twice a day outrage cycle of Twitter, I thought this series of tweets fall into the category of outrage worthy tweets. ‘Allegedly’ (a favourite word of NDTV) her Income tax account was hacked and all her details were changed by the hacker and she did not get any notifications about this change. Let’s look at the tweets in question

- Advertisement - - Article resumes -

In a follow-up tweet to another NDTV journalist, she alleges that her mobile and security questions were changed. She also used the word ‘everything’ (which may include things like email, address etc)

I was totally intrigued by these series of tweets and thought this is quite dangerous if someone is able to hack into the account and change details without getting flagged. So the next thing I did was to go to the income tax India website (https://incometaxindiaefiling.gov.in/home) to see if the above is true/possible or not. In the series of steps below I have tried to ascertain 2 things

  • How easy is it to hack into someone’s account?
  • How easy is it to change basic contact details of someone’s account?

Let’s go step by step. Is it easy to hack into someone’s income tax account? The short answer is “YES”. During my investigation, I was startled to know that it is surprisingly easy to hack into someone’s account if you know 2 details of the person, namely his/her PAN and Date of Birth.

The above is the user login screen that is presented when you click on Login for registered users. User ID here is the PAN. The user must enter 3 other fields to successfully login to the website. Password, Date of birth and the captcha code.

Let’s say the hacker gets hold of your PAN and knows your date of birth. He doesn’t know your password yet. Next, he will try to ascertain the password of the account by clicking on the Forgot password link. And this is where I think one of the biggest loopholes of the income tax website exists. Let me explain how.

Once you click on the forgot password the following screen is presented

In the above screen, the hacker will enter the User ID i.e. PAN and enters the captcha code and clicks continue. He is now presented with the below screen.

The Reset password screen gives 4 options for resetting the password.

  1. Answer Secret Question
  2. Upload DSC
  3. Using OTP
  4. Using Aadhaar OTP

The options 2), 3) and 4) are very secure because they use some sort of 2-factor authentication. So unless the hacker has your mobile, it is very difficult to reset the password using these 3 methods. Now let us concentrate on the first option i.e. Answer Secret Question. Here is where the biggest loophole which I mentioned before lies. So once you select the Secret question and click continue you are presented with the following screen

In the Reset Password with Secret Question screen, the hacker has the following fields to enter.

UserID: He already knows what else he wouldn’t have reached this screen.

Date of Birth: Assumed that it is known

Secret Question: Here in the drop down there are 2 questions. One primary and one secondary. The hacker needs to guess the answer of one of them to successfully reset the password of the person.

As you can see from the above some of the questions are fairly guessable. Let’s say you have selected “Which is your favourite sports person”? as the primary question. There could be 5/6 common name that one can think of. The biggest bug in this screen is that it allows multiple attempts to answer the question. Basically, the hacker can spend the entire night going name by name till he finds the right answer. No notification whatsoever is sent saying that the secret answer was attempted multiple times. After the hacker guesses the answer to the question he is presented with the change password screen. And voila he can now change the password and login to the account. Of course, the trial and error method is unreliable and not guaranteed to work. In fact, it may even be considered improbable that this method would work, but there exists a small minuscule chance that is present.

The Income-tax authority should immediately change the logic for this Change password algorithm. Either remove the secret question way entirely and keep only the secure OTP option or put a restriction on the number attempts that one can have while entering the secret answer. If multiple attempts are made, then lock the account and send a red flag email to the registered email address.

So we agree with the first part of Nidhi’s tweet that it is actually easy to hack into someone’s account provided they know some basic details and do guesswork with the secret answer.

Now lets come to the 2nd question i.e. How easy it is to change basic contact details of someone’s account?

Let’s say the hacker once he has the login information, now wants to change the basic profile information like mobile and email.

In the Profile Settings, there are 4 tabs

  1. PAN details: Uneditable page displaying PAN of the assessee
  2. Address: Gives the address details stored on the account. Bear in mind that this address is different than the address stored in your PAN database
  3. Contact Details: Only editable section of My Profile page
  4. Aadhaar details: Again an uneditable page mentioning if the Aadhaar is linked or not.

Let’s concentrate on the Contact details page. Now let us say the hacker wants to change the primary mobile and primary email ID. This is what Nidhi asserted in her reply to Srinivasan Jain.

If one changes the mobile number and/or the email ID, then the following screen is displayed

An OTP is sent to the mobile and the email ID and only when both the OTP’s are entered, the profile changes get affected. This is a very secure way of ensuring that the profile updates are not made without a 2-factor authentication coming into play.

So the first part of Nidhi’s reply that her mobile number was changed is entirely not possible in real life unless the hacker has access to both her mobile and her email account.

Now the second part, of the security questions being changed. That can be changed without any additional 2 factor like OTP etc. But changing this is pointless as the hacker would have entered the account using this method. A notification email does arrive at your registered email address that the secret questions have been changed.

The hacker can also update the address in the Address tab without any OTP based authentication. Although it is to be noted that this address is different than the PAN database address. I am not sure for what purpose this address is used.

So, in summary, we have learnt the following thanks to Nidhi Razdan:

  1. It is easy to hack into someone’s account provided the hacker knows the PAN and the DOB of the person. The hacker then must guess the answer a simple question. No restrictions on the number of times he can answer is probably a very big flaw in the system. Either remove the secret question workflow for resetting password or introduce some additional security measures to make it difficult to hack via this route.
  2. It is not possible to change the basic contact details without entering the mobile and email OTP. This part of the profile update is very secure. One suggestion to the Income-tax team is that they also introduce OTP based authentication address and secret question update.

Share This Post and Support:
We need your support to survive in the media industry. Please consider paying us for the content we produce:

To know more about these payments, please click here.


Most read articles recently

AAP propagandist tweets false claim about Adani Group, deletes due to fear of defamation

Earlier Delhi's Education Minister Manish Sisodia had also tweeted false claim about Adani Group

Rahul Gandhi’s lucrative and seemingly clandestine means of income and his links to scam accused FTIL, Unitech

How does Rahul Gandhi earn to buy land and other properties? A mystery we try to unravel

BJP’s aggressive candidate list for 2019 election like a blizzard on Congress led by Rahul Gandhi

The boldness of BJP is apparent in that it has 21 present Union and ministers of state in the list, alongside the candidature of its party president, Amit Shah from Gandhinagar in Gujarat.

Watch: Embarrassment for Hardik Patel, crowd chants ‘Modi, Modi’ as he addresses a Holi event

Red-faced, Hardik Patel had to stop speaking and left the place soon after

‘Krantikari’ journalist Punya Prasun Bajpai sacked, again, this time from Surya Samachar

Punya Prasun Bajpai and his team of 25 had joined Surya Samachar last month

How Caravan and Congress’ attempts to create ‘bribegate’ before 2019 election fell flat

The 'bribegate' that Congress and The Caravan tried to cried falls flat on its face on several counts. 

The Wire journalist wishes Holi with ‘Bismillah’, devout Muslims say it’s against Islam

Celebrating Hindu religious festivals is not the only that triggers abuses and threats from Muslim radicals
Prakash Raj was welcomed with pro-Modi slogans in Bengaluru

Actor-turned-politician Prakash Raj greeted with pro-Modi slogans as he went to file his nomination

Prakash Raj seemed visibly miffed with a large number of Modi supporters welcoming him with pro-Modi slogans in Bengaluru

Jammu and Kashmir Police officer Imtiyaz Hussain claims his life being under threat after he exposed Pro-Pak Islamists and ‘journalists’

Jammu and Kashmir policeman reveals how certain 'journalists' work hand in glove with the enemies across the border in Pakistan

Netizens share hilarious ‘diary entries’ to mock Congress’ latest shoddy allegations against BJP

Congress shared photocopy of a handwritten note where they claimed Yeddyurappa signed diary entry incriminating himself

Latest articles

Connect with us

148,295FansLike
120,049FollowersFollow
30,961SubscribersSubscribe

Don't miss these


Share This Post and Support: