Categories: Hacking

Vulnerabilities In Alibaba threatens security of million users

Numerous vulnerabilities in Alibaba’s eCommerce platform compromised the account details of millions of Merchants and shoppers according to Israel cyber security Experts. Alibaba has patched up the flaws and is urging its customers to update their accounts accordingly.

If you can’t afford a $600 product from an online store, why not change the price to $1? This is a typical decision customers to Alibaba’s online stores had to make on a daily basis that is, before a vulnerability discovered by Israel cyber security researchers was patched.

The security flaw allowed a malicious hacker to alter the shipping address and have purchased product delivered directly to them therefore compromising the security of millions of merchants and shoppers to the Chinese online store.

“If I want to buy a $600 phone, I can change the price to a dollar and buy it,” said AppSec founder Erez Metula said. “I can see what people have bought, I can change the shipping address so things can be sent to me instead.”

The vulnerability, first reported on Israel channel 10 TV, was discovered by, Barak Tawily, a 21 year old researcher at AppSec Labs. He however said the flaw was yet to be exploited on a large scale, so not a cause for alarm.

The security flaw comes in the wake of almost a similar vulnerability that that compromised personal account information of Alibaba customers. The flaw, discovered by Cybermoon security firm was fixed shortly after Cybermoon founder Amitay Dan notified Alibaba.

While acknowledging the vulnerabilities, Alibaba spokeswoman Molly Morgan said on Tuesday that all “potential vulnerabilities” on Alibaba’s ecommerce platforms have been fixed. She further assured shoppers that the company will continue doing everything possible to ensure a “secure trading environment on its platforms.”

Alibaba operates successful ecommerce platforms, with two of its online stores, Tmall and Taobao curving a whopping 84% market share in China. The company is expanding to other sectors including health, online insurance and travel booking, after a successful IPO in New York stoker exchange that raise over $25 billion. Industry analysts expect Alibaba’s smartphone OS, YunOS to garner a larger market share after a speculated partnership with Chinese smartphone makers such as Xiaomi and Coolpad.

Alibaba is also in talking terms with Apple for a possible partnership in processing payment through its online payment service Alipay, as reported by Chinese media. The deal will enable over 300 million Alipay users in China to authenticate their accounts using a fingerprint sensor in iPad through a recently updated Alipay iOS App.

Pierluigi Paganini

(Security Affairs – Alibaba, hacking)

The post firstly published on Security Gladiators at this URL http://securitygladiators.com/2014/12/11/alibaba-group-site-vulnerabilities-israel-security-experts/

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.