Ethical Hackers Claim HDFC Bank Website Hacked-Customer Database Affected

Banking industry giant HDFC Bank may have recently suffered a hack affecting its critical customer database system. According to a blog post on ZSecure , which claims to be a dedicated IT Security Research Group, their ethical hackers discovered a critical threat (Hidden SQL Injection Vulnerability) on HDFC Bank’s website on July 15. According to the bloggers they immediately notified the bank through an e-mail. This Hidden SQL Injection Vulnerability had apparently endangered HDFC’s Bank’s customer database and the blog further claimed that the vulnerability allowed hackers to gain total control over information they wished to plunder. Hackers could create a dump and easily carry out shell uploading, too.

The blog post further revealed that the e-mail notifying the bank of the critical vulnerabilities was replied to a good 22 days later. And while HDFC Bank claimed the vulnerability had been fixed and even tested by a third-party service provider, the blog claims this was not true and it was only a further e-mail with complete details which resulted in HDFC Bank removing the vulnerable file from its web server. ZSecure questions how even a third–party provider could not find the vulnerability after being warned.