北京地铁充值漏洞仍未修补：可随意改余额

2014-12-05 08:45

原图

评论 ( 0 )

标签：北京地铁充值漏洞

一个多月前，乌云网曝光称北京地铁收费系统存在基础安全算法方面的漏洞，已经交给相关部门进行处理，但随后就没了下文。日前，有白帽子（不恶意利用漏洞的黑客）进行实测，成功利用充值程序漏洞修改公交卡内余额。同时希望能引起相关部门重视，尽早修补漏洞。（来源：中国青年网）

北京地铁充值漏洞仍未修补：可随意改余额

图集已浏览完毕

重新浏览

评论 ( 0 )

推荐视频

俄乌准备直接谈判，特朗普称，我也…

雷倩灵魂质问：超视距空战实力碾压…

上
一
图
片

下
一
图
集

瑞士冰雪酒店受追捧雪中泡澡…

{
            "info": {
                "setname": "北京地铁充值漏洞仍未修补：可随意改余额",
                "imgsum_bk": 7,
                "imgsum": 7,
                "lmodify": "2014-12-05 08:45:12",
                "prevue": "一个多月前，乌云网曝光称北京地铁收费系统存在基础安全算法方面的漏洞，已经交给相关部门进行处理，但随后就没了下文。日前，有白帽子（不恶意利用漏洞的黑客）进行实测，成功利用充值程序漏洞修改公交卡内余额。同时希望能引起相关部门重视，尽早修补漏洞。（来源：中国青年网）",
                "channelid": "",
                "reporter": "",
                "source": "",
                "dutyeditor": "",
                "prev": {
                    "setname": "瑞士冰雪酒店受追捧 雪中泡澡享冰火两重天",
                    "simg": "http://img3.cache.netease.com/photo/0025/2014-12-05/100x75_ACMJO1U65BNT0025.jpg",
                    "seturl": "/photoview/5BNT0025/17026.html"
                },
                "next": {
                    "setname": "瑞士冰雪酒店受追捧 雪中泡澡享冰火两重天",
                    "simg": "http://img3.cache.netease.com/photo/0025/2014-12-05/100x75_ACMJO1U65BNT0025.jpg",
                    "seturl": "/photoview/5BNT0025/17026.html"
                }
            },
            "list": [
            
                
                {
                   "id": "ACMHGNO75BNT0025",
                   "img": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGNO75BNT0025.jpg",
                   "timg": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGNO75BNT0025.jpg",
                   "simg": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGNO75BNT0025.jpg",
                   "oimg": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGNO75BNT0025.jpg",
                   "osize": {},
                   "title": "",
                   "note": "一个多月前，乌云网曝光称北京地铁收费系统存在基础安全算法方面的漏洞，已经交给相关部门进行处理，但随后就没了下文，大家更关注的还是今后如何涨价。有专业人士称，这主要是由于漏洞的危害尚未得到直接复现，说服力不强，因此结果就是不仅没有得到地方有关部门的配合，也没有得到社会的重视。以下图片将展示利用此漏洞随意更改公交卡余额的过程。",
                   "newsurl": "#"
                }
            
                ,
                {
                   "id": "ACMHGNQ05BNT0025",
                   "img": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGNQ05BNT0025.jpg",
                   "timg": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGNQ05BNT0025.jpg",
                   "simg": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGNQ05BNT0025.jpg",
                   "oimg": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGNQ05BNT0025.jpg",
                   "osize": {},
                   "title": "",
                   "note": "",
                   "newsurl": "#"
                }
            
                ,
                {
                   "id": "ACMHGNT25BNT0025",
                   "img": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGNT25BNT0025.jpg",
                   "timg": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGNT25BNT0025.jpg",
                   "simg": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGNT25BNT0025.jpg",
                   "oimg": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGNT25BNT0025.jpg",
                   "osize": {},
                   "title": "",
                   "note": "",
                   "newsurl": "#"
                }
            
                ,
                {
                   "id": "ACMHGNVT5BNT0025",
                   "img": "http://img3.cache.netease.com/photo/0025/2014-12-05/ACMHGNVT5BNT0025.jpg",
                   "timg": "http://img3.cache.netease.com/photo/0025/2014-12-05/ACMHGNVT5BNT0025.jpg",
                   "simg": "http://img3.cache.netease.com/photo/0025/2014-12-05/ACMHGNVT5BNT0025.jpg",
                   "oimg": "http://img3.cache.netease.com/photo/0025/2014-12-05/ACMHGNVT5BNT0025.jpg",
                   "osize": {},
                   "title": "",
                   "note": "",
                   "newsurl": "#"
                }
            
                ,
                {
                   "id": "ACMHGO2O5BNT0025",
                   "img": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGO2O5BNT0025.jpg",
                   "timg": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGO2O5BNT0025.jpg",
                   "simg": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGO2O5BNT0025.jpg",
                   "oimg": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGO2O5BNT0025.jpg",
                   "osize": {},
                   "title": "",
                   "note": "",
                   "newsurl": "#"
                }
            
                ,
                {
                   "id": "ACMHGO8J5BNT0025",
                   "img": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGO8J5BNT0025.jpg",
                   "timg": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGO8J5BNT0025.jpg",
                   "simg": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGO8J5BNT0025.jpg",
                   "oimg": "http://img4.cache.netease.com/photo/0025/2014-12-05/ACMHGO8J5BNT0025.jpg",
                   "osize": {},
                   "title": "",
                   "note": "",
                   "newsurl": "#"
                }
            
                ,
                {
                   "id": "ACMHGOBC5BNT0025",
                   "img": "http://img3.cache.netease.com/photo/0025/2014-12-05/ACMHGOBC5BNT0025.jpg",
                   "timg": "http://img3.cache.netease.com/photo/0025/2014-12-05/ACMHGOBC5BNT0025.jpg",
                   "simg": "http://img3.cache.netease.com/photo/0025/2014-12-05/ACMHGOBC5BNT0025.jpg",
                   "oimg": "http://img3.cache.netease.com/photo/0025/2014-12-05/ACMHGOBC5BNT0025.jpg",
                   "osize": {},
                   "title": "",
                   "note": "从演示过程中可以看出，利用此APP，可以随意对北京地铁票卡进行扣费、充值，原来免费充值还真是可以的。国家信息安全漏洞共享平台(CNVD)此前其实曾对此漏洞做出回应，但是表示未直接复现，只是说会根据后续提供的信息，对所述标准披露情况以及截图验证情况进行初步确认，拟后续协调北京市政府信息化主管部门处置。",
                   "newsurl": "#"
                }
            
            ]
        }