Consulting & implementing total network security solutions for businesses

SECURITY FOR BUSINESS

PROVIDING PENETRATION TESTING SERVICES 

About customer:
This customer is a company that operates mainly in the field of mobile payment in the form of an e-wallet. This is the leading company in Vietnam providing mobile e-wallet service, cash transfer service at transaction point and payment platform. The customer's e-wallet is used on smartphones with more than 1.5 million users, providing customers with a One Touch Payment experience. Up to now, the Company has made tens of millions of transactions for 2.5 million customers and this community is growing day by day. &nbsp;
Challenge
Payment gateway is an attractive target for hackers, because it contains transaction information of users and e-commerce website, especially credit card information. In addition, customers actively develop online software utilities to provide more convenient services to existing customers as well as expand new customer networks. But this continuous development of add-ons and continual upgrades can hardly guarantee safety and arise many security problems easily. The service development puts pressure on information security.
Solution
Bao Tin has provided web application and mobile application pentest service to customers in the form of Bug bounty (customers only have to pay for the number of detected bugs within a predetermined budget). We has performed a security assessment of the system.
Bao Tin experts act as attackers, using automated tools and simulating real-world techniques to find the security vulnerabilities of the website as well as the e-wallet mobile application on the Apple Appstore (iOS version) or Google Play (Android version). With mastery and various specialized tools, our pentesters will learn the application's behavior, how the server interacts with the application, detect weaknesses, fix security vulnerabilities, and ultimately report together. After 2 weeks of pen-testing, experts have discovered a number of serious vulnerabilities such as vulnerability allowing customers to correct an arbitrary amount when booking a hotel or movie ticket. These serious security vulnerabilities occur because programmers have not applied strict control over user accounts or safety programming standards.
Prevention:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
Bao Tin has handed over the entire implementation method to the Customer. At the same time, we offers a fix recommendation by editing the application. The application needs to be checked to make sure that the logic is being guaranteed and that a function / action can only be performed a certain number of times, when the limit is reached the user will no longer perform that function. To prevent a user from using an application function too many times, mechanisms such as cookies can be used to keep numbers or through sessions that do not allow users access to perform functions. add the number of uses
Benefits and effectiveness:
Bug bounty is a new service that Bao Tin has put into use recently. With this service, the customer can plan a budget for the program, and pay a reward for each type of vulnerability, depending on the severity. Customer will not have to pay if there are vulnerabilities being found, or vulnerability is out of scope. Bug Bounty program can be divided into many stages of implementation, suitable for SMEs, startups that need to spread costs. Besides, Bug Bounty is quite flexible in terms of time, allowing experts to send reports continuously to customers for timely handling.

Bug Bounty project for Electronic payment gateway

With a team of experienced professional experts, Bao Tin have been in charge of major systems of social networks, e-commerce, ads network, ect of companies such as VNG, FPT Online, Webtretho, LavaDigital Group.
Requirement:
The website system can meet a large amount of traffic, load up to millions of CCUs, can expand flexibly according to actual needs, always operate stable 24/24. H&nbsp;
Solution:
To meet the above requirement, our team has designed, consulted and implemented solutions for system infrastructure in the opensource direction to save investment costs for customers.&nbsp;
<img src="http://api.btis.vn/files/2021/4/2/17363e70-935b-11eb-8c43-9129f3036240-1617330500568.jpg" alt="" width="1183" height="821" />
( Illustration )
The system is always monitored, all problems must be notified to fix in time. You cannot spend all day monitoring each device or service in your system. Solution is using tools to alert information through channels: chat Telegram, slack, SMS, email..
<ul>
<li>Monitoring system resources (Network, CPU, RAM, services ...) are reported in detail through web interface anywhere.</li>
<li>Human resources for management are minimized.</li>
</ul>
Result: Some data projects done
<ul>
<li>OpenX Ads Server meets a high number of requests (several tens of millions of Impr per day)</li>
</ul>
<img src="http://api.btis.vn/files/2021/4/2/322080b0-935b-11eb-8c43-9129f3036240-1617330545724.jpg" alt="" width="588" height="340" />
<ul>
<li>Monitor CCU of the system&nbsp;</li>
</ul>
<img src="http://api.btis.vn/files/2021/4/2/3ab41700-935b-11eb-8c43-9129f3036240-1617330560113.jpg" alt="" width="1316" height="322" />

Consulting - implementing IT systems

About customer:
The Department of Natural Resources and Environment is a specialized agency under Provincial People's Committee, with the function of providing public services in the fields under its management, advising and performing the function of state management in the field of natural resources and environment such as land, water resources, mineral resources, geology, environment, hydrometeorology, measurements and maps, plans and schemes, integrated management of sea and islands. &nbsp;
Challenge
With the above functions, the Department of Natural Resources and Environment is keeping a huge and important amount of information on its system. Although the customer's computer system is not connected to the network, it is still fully linked together, making the attack even easier. In addition, the technical staff of the customer is also responsible for many different tasks and a lot of work, so usually they do not have the resources, time and skills to perform an information security assessment or penetration test.
Solution
Bao Tin received the trust and accompanied the Department of Natural Resources and Environment to implement the periodic project of Information Security Assessment for the Department. We provided the web application penetration test for the Department's portal (including main tasks such as testing identification, authentication, authorization, session management ...); network security assessment, information technology infrastructure to promptly detect existing weaknesses; audit services for the operating system, web server, application database, network equipment, and firewall equipment of the Department to determine the safety of network systems and servers.&nbsp;
Information provided:
<ul>
<li>1 system</li>
<li>30 devices including 20 physical servers and 10 network devices, firewall equipment</li>
<li>04 static IPs</li>
</ul>
We applied two types of evaluation services to customers' systems:
For website: Use blackbox method. Our experts use both automatic methods with tools and manual methods that simulate real-world techniques to find website security vulnerabilities and evaluate the security of the system.
For server, network equipment and other parts: We use the whitebox method: customers provide Bao Tin the network map, source code, information or device access. Our experts will check the source code, find vulnerabilities and simulate information stealing from the system and thereby assess the safety of the devices. After evaluating the whole system, Bao Tin makes a report and gives suggestions for remediation and prevention methods.
Result:
Through the system evaluation and pen-test process, serious vulnerabilities such as Error allowing users to bypass the authentication and code execution, password cracking vulnerability, information disclosure, weak encryption algorithm, hijacking vulnerability, CVE-2013-4786 vulnerability, ect were found. These vulnerabilities cause the risk of data leakage, intrusion or theft of internal information. Pass and Fail values ​​of test cases also have a big difference, the Fail is almost 2 times larger than the Pass. The reason for this discrepancy is due to the fact that during the initial system installation and configuration, it did not comply with CISCAT or other equivalent standards. Bao Tin analyzed, made reports, identified interventions to ensure and improve the safety and security of information for the Department's environmental and resource data integration operating system and handed over the implementation process to the client, and also held meetings, consulted with stakeholders and experts for the package.
Benefits and effectiveness: 
Implementation is quick and the Client does not need to provide much information. Shorten the time to fix information security gaps. Minimize costs of investment in components throughout the system. Completing the overall security situation.

Information Security Assessment Project for the Department of Natural Resources and Environment 

About customer:
Our customer this time is an e-commerce exchange built according to the B2C2C (business - to - consumer - to &ndash; consumer) model. Through stores opened at the e-commerce exchange, businesses can provide the best products / services to consumers with a large volume of transactions, and a high rate of completed transactions. The exchange provides many forms of support services such as advertising through PR articles, banners, e-clicks, product photography ... and proactively consulting on methods to promote business efficiency for businesses. &nbsp;&nbsp;&nbsp;
Challenge
As an e-commerce exchange, customers own a huge database containing many sensitive information of partners. It is the most important asset of an enterprise when using technology as its primary business tool. Securing this database is of utmost importance. In addition, with a large number of users, the system receives a huge volume of transactions every day. The more applications associated with banks in transactions, the more security factors must be controlled. Therefore, the Customer has contacted and used Bao Tin's information security penetration testing service to assess the security of web, mobile and network applications for objective and multidimensional information.
Solution
Bao Tin attacked according to OWASP 2019 standards to detect security vulnerabilities promptly and prevent external interference from exploiting these vulnerabilities. At the same time, we also collected information, made statistics on the services used in the system, checked configuration items and fixed errors in the configuration of network equipment and information security equipment.
* &nbsp;&nbsp;Web, mobile application
<ul>
<li>Testing by Greybox method</li>
<li>Checklist vulnerability detection is built on the basis of the OWASP 2019 report and the experience of engineers, as well as how the application works to provide the most suitable testing method.</li>
<li>Use real devices and a virtual machines to test the application on the client side</li>
<li>Use decompilation tools to check software source code, encryption functions, decoding in the application, sensitive information can be revealed ...</li>
<li>Use website vulnerability detection tools to test server penetration</li>
<li>Combine automated tools such as Burpsuite Pro, Dirsearch, Nmap, Acunetix and manual assessment</li>
</ul>
* &nbsp;&nbsp;Network
<ul>
<li>Web Server security assessment including import and export values, web application functions... according to PTES, OSSTMM and OWASP network security assessment process.</li>
<li>Proactively scan network system, the collected server, IP, services portal, protocols used, system service version</li>
<li>Review the information technology infrastructure for promptly detection of weaknesses. Determine the risk of data leakage, intrusions or theft of internal information</li>
<li>Statistics of services used in the whole system.</li>
<li>Check the system's availability when an attack occurs.</li>
<li>Evaluation of problems related to configuration, decentralization of systems and services</li>
<li>Combining automated tools such as IBM AppScan, Metasploit Framework, Acunetix Consultant, and open source tools, ...</li>
</ul>
Result:
Through the review process, our pentesters found a large number of vulnerabilities in web, mobile application and network, including: 4 urgent errors, 20 critical errors and many other lower level vulnerabilities. These are mostly dangerous vulnerabilities that directly affect the customer's server operations, and can be easily exploited to exploit users accounts such as stealing accounts. &nbsp;
Prevention:
After pen-testing the entire system, Bao Tin has reported and handed over the entire implementation process to customers, along with recommendations and prevention methods. It is most essential for the customer to quickly fix the vulnerabilities completely as they are especially dangerous. Bao Tin gave some suggestions as follows
<ul>
<li>In-depth decentralization checks to avoid a user being able to reference data and use the features of other users.</li>
<li>Disable some features no longer used on the application, avoid being used to detect passwords.</li>
<li>Update CMS, framework to the latest version.</li>
<li>Use the emulator, root device, application patch detection mechanisms</li>
</ul>
Benefits and effectiveness: 
Minimize costs of investment in components throughout the system. Most of the vulnerabilities have been warned by the service. Significantly reduce financial and equipment losses in information security. Work process is done with more secure.&nbsp;

sàn Thương mại điện tử, pentest, OWASP, lỗi bảo mật

Pentesting project for E-Commerce Exchange

SECURITY FOR BUSINESS

PROVIDING PENETRATION TESTING SERVICES

Bao Tin - Accompanying business with information security!

Penetration testing

Consulting - implementing information security solutions

Information security training

Get started with Bao Tin today

Thank customers for trusting and accompanying us

CASE STUDIES

Main Menu

Language