A Shocking Discovery
Veer Gosai, a second-year computer science student at Stellenbosch University, discovered a vulnerability in Nedbank’s free credit score checking system. The flaw could have allowed attackers to access security questions linked to financial records across South Africa.
How the System Was Compromised
The issue stemmed from a poorly implemented bearer authorization token, which allowed any logged-in user to query security questions of others. Alarmingly, users didn’t even need to be Nedbank customers to exploit the flaw.
Immediate Action Taken
Upon learning of the vulnerability, Nedbank swiftly disabled the affected system and launched an investigation. The bank assured customers that no evidence suggests the flaw was exploited by malicious actors. The system is set to be reinstated in June 2025 with enhanced security measures.
The Bigger Picture
This discovery follows Gosai’s previous investigation into fraud within Sassa’s Social Relief of Distress (SRD) grant system. Alongside classmate Joel Cedras, he exposed security weaknesses that enabled identity theft and fraudulent grant applications.
Lessons for Cybersecurity
Experts warn that financial institutions must prioritize security to prevent similar breaches. Weak authentication methods and poor implementation of authorization tokens can leave sensitive data vulnerable to exploitation.
What’s Next?
As cybersecurity threats evolve, banks and financial institutions must remain vigilant. Strengthening security protocols and conducting regular audits can help prevent future vulnerabilities.
Stay updated with us on uninews.co.za for more insights into South Africa’s cybersecurity landscape. Share this article to raise awareness!
Leave a Reply