Advertisement
Friday, Aug 12, 2022
Outlook.com
Outlook.com

CyberX9 Says Vulnerability In PNB Server Exposed Customer Data

CyberX9 has claimed that the vulnerability provided access to the entire digital banking system of PNB with administrative control.

CyberX9 Says Vulnerability In PNB Server Exposed Customer Data
CyberX9 Says Vulnerability In PNB Server Exposed Customer Data
outlookindia.com
2021-11-21T16:07:19+05:30

A vulnerability in the server of Punjab National Bank allegedly exposed the personal and financial information of its about 180 million customers for about seven months, according to cyber security firm CyberX9.

CyberX9 has claimed that the vulnerability provided access to the entire digital banking system of PNB with administrative control.

Meanwhile, the bank has confirmed the glitch but denied any exposure of critical data due to the vulnerability.

PNB said "customer data/applications are not affected due to this" and "server has been shut down as a precautionary measure."

"Punjab National Bank kept severely compromising the security of funds, personal and financial information of over 180 million (all) its customers for about the last 7 months. PNB only woke up and fixed the vulnerability when CyberX9 discovered the vulnerability and notified PNB through CERT-In and NCIIPC," CyberX9 founder and MD Himanshu Pathak told PTI.

He said the CyberX9 research team discovered a very critical security issue in PNB which was leading to admin access to internal servers hence exposing a massive number of banks' systems nationwide open for cyber-attacks for the last about seven months.

Pathak said that vulnerability was found in an exchange server that is interconnected with other exchanges and shares all access -- including access to all email addresses which results in access to all email addresses.

"The vulnerability which we discovered was leading to the highest level of admin privilege in PNB's exchange servers. If you gain access to Domain Controller through an exchange server then the doors very easily open to making any computer accessible in the network.

"These computers even include those that are being used in their branches and other departments," Pathak said.

When contacted, PNB said the server in which the vulnerability was found had no sensitive or critical data.

"The server wherein the vulnerability was reported, was being used as one of the multiple Exchange Hybrid servers used to route emails from On-prim to Office 365 Cloud. There is no sensitive/critical data in this server," PNB said.

PNB denied CyberX9's claim on the impact of the vulnerability on customers' data.

"The server is in a separate VLAN segment and customer data/applications are not affected due to this. Vulnerability assessments and penetration testing is done periodically by external Cert-in empanelled Information Security Auditors and the observations are complied with.

Now this server has been shut down as a precautionary measure," PNB said.

According to CyberX9, the vulnerability was mitigated on November 19, and it reported the incident to Indian cyber security watchdog Cert-In and National Critical Information Infrastructure Protection Centre (NCIIPC).

(With PTI Inputs)

Advertisement

Outlook Newsletters

Advertisement
Advertisement
Advertisement

Read More from Outlook

Lament Of Separation: Songs Of Habba Khatun, Last Queen Of Kashmir, Still Echo In Valley

Lament Of Separation: Songs Of Habba Khatun, Last Queen Of Kashmir, Still Echo In Valley

In happy times and sad, Habba Khatun’s sensuous songs make both young and old emotional. With the never-ending conflict bringing tragedies to every doorstep, Habba’s lyrics of separation amplify their mourning.

How Indian Laws Govern People’s Right To Love And Live

How Indian Laws Govern People’s Right To Love And Live

In India, only those relationships between a man and a woman are considered to be legitimate when there is a marriage between the two.

Kohli Quits Test Captaincy, Leaves Leadership Vacuum

Kohli Quits Test Captaincy, Leaves Leadership Vacuum

Virat Kohli, 33, had recently stepped down as India's T20I captain and was subsequently removed as the ODI captain.

UP Elections 2022: How Congress Is Harnessing Power Of 'Persecuted' Women To Counter BJP

UP Elections 2022: How Congress Is Harnessing Power Of 'Persecuted' Women To Counter BJP

A Mahila Congress leader, who is the face of the ‘Ladki Hoon, Lad Sakti Hoon’ campaign, however, has accused the party of anti-women bias after she was denied a ticket.

Advertisement