Home Opinions NDTV's Nidhi Razdan says her IT account was 'hacked' and details changed, find out how secure your account is

NDTV’s Nidhi Razdan says her IT account was ‘hacked’ and details changed, find out how secure your account is

Today during one of my regular peeks on to the Twitter TL, I saw a couple of tweets from Nidhi Razdan which immediately caught my attention. In the twice a day outrage cycle of Twitter, I thought this series of tweets fall into the category of outrage worthy tweets. ‘Allegedly’ (a favourite word of NDTV) her Income tax account was hacked and all her details were changed by the hacker and she did not get any notifications about this change. Let’s look at the tweets in question

- Advertisement - - article resumes -

In a follow-up tweet to another NDTV journalist, she alleges that her mobile and security questions were changed. She also used the word ‘everything’ (which may include things like email, address etc)

I was totally intrigued by these series of tweets and thought this is quite dangerous if someone is able to hack into the account and change details without getting flagged. So the next thing I did was to go to the income tax India website (https://incometaxindiaefiling.gov.in/home) to see if the above is true/possible or not. In the series of steps below I have tried to ascertain 2 things

  • How easy is it to hack into someone’s account?
  • How easy is it to change basic contact details of someone’s account?

Let’s go step by step. Is it easy to hack into someone’s income tax account? The short answer is “YES”. During my investigation, I was startled to know that it is surprisingly easy to hack into someone’s account if you know 2 details of the person, namely his/her PAN and Date of Birth.

The above is the user login screen that is presented when you click on Login for registered users. User ID here is the PAN. The user must enter 3 other fields to successfully login to the website. Password, Date of birth and the captcha code.

Let’s say the hacker gets hold of your PAN and knows your date of birth. He doesn’t know your password yet. Next, he will try to ascertain the password of the account by clicking on the Forgot password link. And this is where I think one of the biggest loopholes of the income tax website exists. Let me explain how.

Once you click on the forgot password the following screen is presented

In the above screen, the hacker will enter the User ID i.e. PAN and enters the captcha code and clicks continue. He is now presented with the below screen.

The Reset password screen gives 4 options for resetting the password.

  1. Answer Secret Question
  2. Upload DSC
  3. Using OTP
  4. Using Aadhaar OTP

The options 2), 3) and 4) are very secure because they use some sort of 2-factor authentication. So unless the hacker has your mobile, it is very difficult to reset the password using these 3 methods. Now let us concentrate on the first option i.e. Answer Secret Question. Here is where the biggest loophole which I mentioned before lies. So once you select the Secret question and click continue you are presented with the following screen

In the Reset Password with Secret Question screen, the hacker has the following fields to enter.

UserID: He already knows what else he wouldn’t have reached this screen.

Date of Birth: Assumed that it is known

Secret Question: Here in the drop down there are 2 questions. One primary and one secondary. The hacker needs to guess the answer of one of them to successfully reset the password of the person.

As you can see from the above some of the questions are fairly guessable. Let’s say you have selected “Which is your favourite sports person”? as the primary question. There could be 5/6 common name that one can think of. The biggest bug in this screen is that it allows multiple attempts to answer the question. Basically, the hacker can spend the entire night going name by name till he finds the right answer. No notification whatsoever is sent saying that the secret answer was attempted multiple times. After the hacker guesses the answer to the question he is presented with the change password screen. And voila he can now change the password and login to the account. Of course, the trial and error method is unreliable and not guaranteed to work. In fact, it may even be considered improbable that this method would work, but there exists a small minuscule chance that is present.

The Income-tax authority should immediately change the logic for this Change password algorithm. Either remove the secret question way entirely and keep only the secure OTP option or put a restriction on the number attempts that one can have while entering the secret answer. If multiple attempts are made, then lock the account and send a red flag email to the registered email address.

So we agree with the first part of Nidhi’s tweet that it is actually easy to hack into someone’s account provided they know some basic details and do guesswork with the secret answer.

Now lets come to the 2nd question i.e. How easy it is to change basic contact details of someone’s account?

Let’s say the hacker once he has the login information, now wants to change the basic profile information like mobile and email.

In the Profile Settings, there are 4 tabs

  1. PAN details: Uneditable page displaying PAN of the assessee
  2. Address: Gives the address details stored on the account. Bear in mind that this address is different than the address stored in your PAN database
  3. Contact Details: Only editable section of My Profile page
  4. Aadhaar details: Again an uneditable page mentioning if the Aadhaar is linked or not.

Let’s concentrate on the Contact details page. Now let us say the hacker wants to change the primary mobile and primary email ID. This is what Nidhi asserted in her reply to Srinivasan Jain.

If one changes the mobile number and/or the email ID, then the following screen is displayed

An OTP is sent to the mobile and the email ID and only when both the OTP’s are entered, the profile changes get affected. This is a very secure way of ensuring that the profile updates are not made without a 2-factor authentication coming into play.

So the first part of Nidhi’s reply that her mobile number was changed is entirely not possible in real life unless the hacker has access to both her mobile and her email account.

Now the second part, of the security questions being changed. That can be changed without any additional 2 factor like OTP etc. But changing this is pointless as the hacker would have entered the account using this method. A notification email does arrive at your registered email address that the secret questions have been changed.

The hacker can also update the address in the Address tab without any OTP based authentication. Although it is to be noted that this address is different than the PAN database address. I am not sure for what purpose this address is used.

So, in summary, we have learnt the following thanks to Nidhi Razdan:

  1. It is easy to hack into someone’s account provided the hacker knows the PAN and the DOB of the person. The hacker then must guess the answer a simple question. No restrictions on the number of times he can answer is probably a very big flaw in the system. Either remove the secret question workflow for resetting password or introduce some additional security measures to make it difficult to hack via this route.
  2. It is not possible to change the basic contact details without entering the mobile and email OTP. This part of the profile update is very secure. One suggestion to the Income-tax team is that they also introduce OTP based authentication address and secret question update.
Help Opindia Reach Every Indian. Share This Post
We need your support to survive in the media industry. Please consider paying us for the content we produce:

To know more about these payments, please click here.


Advertisement

Big Story

The reportage of Aaj Tak journalist Anjana Om Kashyap and TV Bharatvarsh journalist Ajit Anjum raised concerns of how bullish and high-handed the media was being with unsuspecting doctors who were only doing their job.

2019 World Cup Is Here!

Catch the latest on Cricket World Cup as it unfolds, special coverage by Opindia

Uttar Pradesh: Rampur Police shoots Nazil, accused of abducting, raping and killing a 6-year-old girl

Disturbingly, such incidents of sexual abuse against children have become rampant in India

Tausif Imran Khan repeatedly raped class X girl in Vadodara, took her to religious places to brainwash and convert her

19-year-old Tausif Imran Khan, a class XII student who lived in Manjalpur, has been booked under the Protection of Children from Sexual Offences (POCSO) Act for sexually exploiting a minor.
Evangelists going jobless

Evangelists left jobless after Modi government’s crackdown on foreign funds, Pentecostals in Kerala severely affected

Pastors are unable to repay their loans as they stopped receiving their monthly salary for their gospel work

Rahul Gandhi planning a nation-wide stir over ‘EVM hacking’, may boycott assembly polls: Report

Rahul Gandhi, the current President of the Congress party is planning to launch a non-cooperation movement against the PM Modi led Central government. 

When you don’t understand cricket, don’t tweet, else you’d sound like this journalist from The Print

Jyoti Malhotra, a journalist at the Print, which often peddles fake news, wore the hat of a cricketing expert during the India-Afghanistan World Cup match on Saturday.

Sidhu’s rant comes back to haunt: Posters in Ludhiana ask him to keep his promise of quitting politics if Rahul Gandhi loses Amethi

In one of the biggest overturns in this Lok Sabha elections, Rahul Gandhi had lost from his home turf to BJP' Smriti Irani by 55,120 votes

No Prakash Javadekar, ‘Jai Shree Ram’ is not an ‘Indian cheer’, it’s a manifestation of the Hindu faith. Don’t cheapen it

Unless the remainder of the interview to Times Now which is yet to be released gives a different picture of Javadekarr's answer, he came off as a defensive, confused man who couldn't stand by his or his party's faith.

Devotees throng a Khodiyar Mata temple in Gujarat after a crocodile, worshipped as Goddess’ vehicle, strays inside the temple

Khodiyar Maa, a family deity of the Patidar community, is often depicted as riding a crocodile.

Assam: Sidul Islam sends intimate photos with wife to in-laws, threatens to release on social media if dowry not given

Muslim man in Assam blackmails in-laws for dowry threating to release intimate photos with his own wife
Subscribe to Day's Top Stories
- Advertisment -

Latest articles

Connect with us

171,736FansLike
150,940FollowersFollow
70,209SubscribersSubscribe
Help Opindia Reach Every Indian. Share This Post