Why was Hindustan Times (HT) epaper Server Hacked ?

Many people think that Hindustan Times (HT) (English Edition) + Hindustan (Hindi Edition) is available on the internet free of cost, HT Media has made it compulsory to register on their website in order to read the daily online edition of their published newspapers, on completion of registration HT Media provides you instant access to read daily edition, the CATCH is – you can only read the daily edition + past seven days editions (from the current date) as a free user, whileas if you wanna read any edition beyond seven days, you will have to pay a huge (rip off) amount to HT Media (in the name of digital archive subscription)

As a hacker, i think its not fair (for anyone) to loot common people and sell (publicly gained) information in such a way, so i decided to peek inside the server and find some bugs / architectural flaws which would allow me to access past newspaper (Images / PDF) editions for free

Within a couple of hours, i managed to find some bugs / architectural flaws (& vulnerabilities) which gave out free access to the past (Images / PDF) newspaper editions

Calvin and Hobbes publishing error

I used to search the newspaper (HT hard copy) every morning for technology related news (hoping any Indian journalist must have written some piece) that went on for like weeks and then i started reading Calvin and Hobbes (the comic strip) every day published in HT Cafe

On 2nd / 4th / 9th June, Hindustan Times (HT) published the same Calvin and Hobbes strip, how should i react against this publishing error by Hindustan Times, as a fan of Calvin and Hobbes, i expect new comic strip every day

Checkout the exact same Calvin and Hobbes strip published thrice on various days in the single month of June (2009)

2nd June
http://epaper.hindustantimes.com/Web/HTMumbai/Article/2009/06/02/538/02_06_2009_538_013.jpg

9th June
http://epaper.hindustantimes.com/Web/HTMumbai/Article/2009/06/09/538/09_06_2009_538_002.jpg

4th June
http://epaper.hindustantimes.com/Web/HTMumbai/Article/2009/06/04/538/04_06_2009_538_006.jpg

Informing the privileged authorities

On 10th July 2009, i informed the editor and other top most authorities @ HindustanTimes via email regarding the serious bugs / flaws (& vulnerabilities) on their ePaper Server which can be exploited to compromise data and cause financial losses for HT Media

Although i received a reply from Rashmi Chugh (Business Head and Publisher, LIVEMINT) within 3 minutes, i waited for 24 hours to receive other recipients reply (as i wanted to know what they thought about the issue) but sadly no one replied back except Rashmi Chugh, so i sent her a reply the other day

After sending my reply to to Rashmi Chugh, i haven’t received any responses (since 29 days) from any of the authorities / employees working for HindustanTimes

I have been using these architectural flaws for sometime to gain access to past editions of newspapers / magazines / supplements published by HT Media, i believe information taken from the people (especially newspapers) should be free and accessible to everyone

The bugs / architectural flaws (& vulnerabilities) found by me still exists and works actively when used on the server, this shows that they are not interested (or don’t care) anymore to fix it, which makes me post the full disclosure information on my blog for (free access to previous epaper editions)

Follow the below steps to gain free access to past (online) editions without subscribing to the archives

• Proceed to the HindustanTimes – ePaper Registration URL @ http://epaper.hindustantimes.com/registernew.aspx

• Fill in only the essential fields required (for registration) such as (any) email ID, name, password, address, city, state, zip

By default the country (field) option value (txtCntry) is set to Albania, whileas it should be India – at least show some patriotism towards our country

• After you complete the registration, you will be presented with

Once the registration process is completed, the email ID (used during registration) will be activated instantly by Pressmart (the automated system used by HT Media) without any welcome / verification email to the inbox, which would allow anyone to use any email ID (during registration) without being detected by the real email ID owner, which in itself poses a security risk (making it a vulnerability)

The implementation / usage of verifying the email ID (used during the registration) with a random activation link to the inbox should resolve this issue (which HT Media currently doesn’t)

Its possible that such facilities might be already existing within Pressmart (the automated system used by HT Media) and the Webmaster didn’t feel like activating it to save time and increase more registrations on their epaper website in order to retrieve the users information (filled during the registration) for their internal marketing / research purposes or to increase their newspaper ranking

• Proceed to the Login Page @ http://epaper.hindustantimes.com/Login.aspx

• Enter the email ID and password, select any edition from below and paste the URL into your address bar (to view the past editions in Image / PDF format for free)

In the URLs below, after the text (pg2=) first value is the date / second is the month / third is the year / fourth is the page number

English Editions – Hindustan Times (PDF Format)

• Mumbai Edition

http://epaper.hindustantimes.com/PDFHandler.ashx?p1=Web/HTMumbai&p2=12_06_2009_001.pdf

• Delhi Edition

http://epaper.hindustantimes.com/PDFHandler.ashx?p1=Web&p2=21_05_2009_001.pdf

• Chandigarh Edition

http://epaper.hindustantimes.com/PDFHandler.ashx?p1=Web/HTPunjab&p2=19_06_2009_001.pdf

Hindi Editions – Hindustan (PDF Format)

• Delhi Edition

http://epaper.hindustandainik.com/PDFHandler.ashx?p1=Web&p2=29_05_2009_001.pdf

• Kanpur Edition

http://epaper.hindustandainik.com/PDFHandler.ashx?p1=Web/HTKanpur&p2=21_06_2009_001.pdf

• Patna Edition

http://epaper.hindustandainik.com/PDFHandler.ashx?p1=Web/HTPatna&p2=26_05_2009_001.pdf

• Lucknow Edition

http://epaper.hindustandainik.com/PDFHandler.ashx?p1=Web/HTLucknow&p2=24_05_2009_001.pdf

Hindustan Times (HT) Brunch Magazine (English) (PDF Format)

• Mumbai Edition (Published Only On Sundays)

http://epaper.hindustantimes.com/PDFHandler.ashx?p1=Web/HTMumbai&p2=31_05_2009_321.pdf

Hindustan Times (HT) Cafe (English) (PDF Format)

• Mumbai Edition (Daily Supplement with HT Mumbai – English Edition)

http://epaper.hindustantimes.com/PDFHandler.ashx?p1=Web/HTMumbai&p2=26_05_2009_531.pdf

Accessing the past ePapers in Image Format

If you would like to browse the past newspapers in image edition, then simply change the values according to your choice in the below URL and retrieve it from the server

The variable format is

/ Page / year / month / date / date_month_year_pageno.jpg

/ Page / year / month / date / date_month_year_pageno_part.jpg

Hindustan Times – 31st December 2008 – Main Edition (English) – Mumbai
http://epaper.hindustantimes.com/Web/HTMumbai/Page/2008/12/31/31_12_2008_001.jpg

HT Cafe (English) – 26th January 2009 – Hindustan Times – Mumbai
http://epaper.hindustantimes.com/Web/HTMumbai/Page/2009/01/26/26_01_2009_531.jpg

HT Brunch – Magazine (English) – 31st May 2009 – Hindustan Times – Mumbai
http://epaper.hindustantimes.com/Web/HTMumbai/Page/2009/05/31/31_05_2009_321.jpg

The automated system

Hindustan Times epaper webportal is powered by Pressmart, which provides electronic publishing software (& digital publishing solutions) to various newspaper publishers across the world, if i had more time to work then i would have surely dug out more bugs / architectural flaws (& vulnerabilities) within Pressmart softwares but the fact is (i don’t find them interesting enough)

Pressmart is a digital publishing service for newspapers, magazines, journals, catalogs and practically any print publication. We help publications deliver their print content on the new media – covering the entire breadth of web, mobile, podcast, RSS, social networking sites and search engines, with integrated revenue and cost-saving capabilities.

Beyond delivery, Pressmart help publications monetize their digital edition through subscriptions and advertisements. Our service platform is eCommerce and advertising ready to generate revenue streams instantly. It includes all the components up to the monetization stage after the pre-press pages are prepared. All the publication has to do is supply their pre-press pages and Pressmart takes care of the rest.

Source: Pressmart Official Website

Internet explorer sucks

Hindustan Times website + ePaper portal says

(Site best viewed in Microsoft Internet Explorer 5.5+ SP1 in 800×600 & 1024×768 resolution)
Click here to download the latest version of internet explorer

I would advise Hindustan Times to download / use Firefox and some other open source tools / codings for their website + ePaper portal instead of stuffing it with junk / heavy / unwanted codings, try to keep it clean / clear / simple

Dedications

I would like to dedicate this hack towards Club Calvin @ http://www.clubcalv.in and all cute kids

I love you Firefox <3 / thank you (Firefox) for being my companion during my pen tests………

Daily News and Analysis (DNA) is a daily English newspaper published from Mumbai / Bengaluru / Pune / Ahmedabad / Surat and Jaipur in India. DNA (Mumbai) launched its first edition on 30th July (2005) targeted at a young readership, DNA is India’s fastest growing English newspaper
(Source: Wikipedia article on DNA – Daily News & Analysis)

Happy 4th Anniversary to DNA

I would like to wish DNA (my favourite newspaper) a very Happy and a Prosperous 4th Anniversary Year

On this Auspicious Occasion, i would like to provide all the Mumbaikars with Free Access to the Complete (digital) Archives of DNA (Daily News and Analysis) – Mumbai Edition

So who’s gonna treat me Vada Pav now ?

Why was DNA (Daily News & Analysis) hacked ?

The information printed in the newspapers, come from public sources (common people), so charging them for the complete archives / back dated issues through subscription is unfair, as a hacker i believe in the saying “All the information should be free” and if anyone tries to deny that access to us OR make us pay for it, then (no wonder) we are definitely gonna hack in there

Currently DNA provides access to only 7 back dated issues from the current day, so i am gonna give out free access to the complete archives for DNA (Mumbai Edition); i have been using this special access since the year 2006 ( though never abused the server resources) i used it (only) whenever i needed a issue or page (when i couldn’t get a hard copy)

I could have broken (some) more security layers in order to steal all the existing user account details containing email IDs / passwords / cell numbers / other information on the epaper portal and could have sold it to marketing / rival companies, but i haven’t done anything like that, its because doing something like that wouldn’t suit me a true hacker and its totally against my ethics

After the launch, DNA (Mumbai Edition) used to publish a lot of Indian tech articles written by Indian journalists (reporters) related to (Indian Scenario On) Cyber Warfare / Hackers / Hacking Incidents / New Improvements in Technology Field / Security Stuffs / etc…….

Year by year, the number of (Indian) tech articles kept going down as the newspaper went progressing too much, maybe they wanted to maintain their current position and the greed to reach the top, since then DNA started publishing tech articles written by foreign journalists / reporters (outside India) into the backpages of (Mumbai) Edition

Mid-Day and DNA have been my favourite newspapers since it launced and i read both of them anxiously; i enjoy reading them as they have at least something (worth nice) to read sometimes

Its sad to say, but some of the tech articles are simply outdated and published late in DNA (Mumbai Edition); most of the articles (any) written by journalists doesn’t contain their email IDs; silly errors in some of the articles (the below picture was published on July 28, 2009 – Page 22)

Your Free Access to Complete (digital) Archives of DNA (Mumbai Edition)

Change the date / month / year and the page numbers in the below URLs to gain access for the back dated issues of your choice

Please do not abuse the server resources; use the hacks only when you need any issue / page (digital copy) to save the scanning charges (for hard copies)

Take a Sneak Peak @ the First (Mumbai) Edition of DNA (Daily News and Analysis) which was published on 30th July, 2005

DNA – Main Paper (Select any mirror below)
MediaFire / RapidShare / HotFile / MegaUpload

DNA – After hrs. (Select any mirror below))
MediaFire / RapidShare / HotFile / MegaUpload

DNA – Money (Business) (Select any mirror below)
MediaFire / RapidShare / HotFile / MegaUpload

DNA – Sport (Select any mirror below)
MediaFire / RapidShare / HotFile / MegaUpload

First Independence Day Issue by DNA – 15th August 2005 (Mumbai Edition – PDF Format)

DNA – Main Paper
Page 1 / Page 2 / Page 3 / Page 4 / Page 5 / Page 6 / Page 7 / Page 8 / Page 9
Page 10 / Page 11 / Page 12 / Page 13 / Page 14 / Page 15 / Page 16 / Page 17
Page 18

DNA – After hrs.
Page 1 / Page 2 / Page 3 / Page 4 / Page 5 / Page 6 / Page 7 / Page 8

DNA – Money (Business)
Page 1 / Page 2 / Page 3 / Page 4 / Page 5 / Page 6 / Page 7 / Page 8

DNA – Sport
Page 1 / Page 2 / Page 3 / Page 4 / Page 5 / Page 6

Bio – DNA (Job Smart)
Page 1 / Page 2 / Page 3 / Page 4

Weekly Editions – (PDF Format)

DNA Daily (Main Edition) (Monday to Saturday)
http://digital.dnaindia.com/epaperpdf/1582005/14main edition-pg1-0.pdf
http://digital.dnaindia.com/epaperpdf/1582006/14main edition-pg1-0.pdf
http://digital.dnaindia.com/epaperpdf/15082007/14main edition-pg1-0.pdf
http://digital.dnaindia.com/epaperpdf/15082008/14main edition-pg1-0.pdf

DNA Money – Supplement (Monday to Saturday)
http://digital.dnaindia.com/epaperpdf/1292005/11business-pg1-0.pdf
http://digital.dnaindia.com/epaperpdf/1292006/11business-pg1-0.pdf
http://digital.dnaindia.com/epaperpdf/12092007/11business-pg1-0.pdf
http://digital.dnaindia.com/epaperpdf/12092008/11business-pg1-0.pdf

DNA Sport – Supplement (Monday to Saturday)
http://digital.dnaindia.com/epaperpdf/16112005/15sports-pg1-0.pdf
http://digital.dnaindia.com/epaperpdf/16112006/15sports-pg1-0.pdf

DNA After hrs. (Entertainment) – Supplements (Monday to Saturday)
http://digital.dnaindia.com/epaperpdf/26122005/25entertainment-pg1-0.pdf
http://digital.dnaindia.com/epaperpdf/26122006/25entertainment-pg1-0.pdf
http://digital.dnaindia.com/epaperpdf/26122007/25entertainment-pg1-0.pdf
http://digital.dnaindia.com/epaperpdf/26122008/25entertainment-pg1-0.pdf

Navi Mumbai – Supplement (Monday to Saturday)
http://digital.dnaindia.com/epaperpdf/1392006/12split-pg1-0.pdf

Sunday Editions + Supplements (PDF Format)

DNA – Sunday Edition (Main Paper)
http://digital.dnaindia.com/epaperpdf/3172005/30sunday-pg1-0.pdf
http://digital.dnaindia.com/epaperpdf/2782006/26sunday-pg1-0.pdf
http://digital.dnaindia.com/epaperpdf/09092007/8sunday-pg1-0.pdf
http://digital.dnaindia.com/epaperpdf/28122008/27sunday-pg1-0.pdf

DNA After hrs – Sunday Supplement
http://digital.dnaindia.com/epaperpdf/3172005/30morning after-pg1-0.pdf

Sports – Sunday Supplement
http://digital.dnaindia.com/epaperpdf/1682005/15sports-pg1-0.pdf
http://digital.dnaindia.com/epaperpdf/2782006/26sunsports-pg1-0.pdf
http://digital.dnaindia.com/epaperpdf/19082007/18sunsports-pg1-0.pdf

DNA YA (Young Adults) – Sunday Supplement (Magazine)
http://digital.dnaindia.com/epaperpdf/3172005/30ya-pg1-0.pdf
http://digital.dnaindia.com/epaperpdf/2782006/26ya-pg1-0.pdf
http://digital.dnaindia.com/epaperpdf/09092007/8ya-pg1-0.pdf
http://digital.dnaindia.com/epaperpdf/28122008/27ya-pg1-0.pdf

Weekly Supplements (PDF Format)

Bio – DNA (Job Smart) – Monday
http://digital.dnaindia.com/epaperpdf/182005/31appointment-pg1-0.pdf

dna Academy (Education) – Tuesday
http://digital.dnaindia.com/epaperpdf/282005/1education-pg1-0.pdf

Bollywood – Wednesday
http://digital.dnaindia.com/epaperpdf/1392006/12bollywood-pg1-0.pdf

Rew Up (Auto Mobiles) – Thursday
http://digital.dnaindia.com/epaperpdf/482005/3auto mobile-pg1-0.pdf

Brick n Mortar (Real Estate) – Friday
http://digital.dnaindia.com/epaperpdf/422006/3real estate-pg1-0.pdf

Life 360 (Life Style) – Saturday
http://digital.dnaindia.com/epaperpdf/1382005/12life style-pg1-0.pdf

Destination (Dombivli / Kalyan) – Saturday
http://digital.dnaindia.com/epaperpdf/20062009/19thane-pg8-0.pdf
http://digital.dnaindia.com/epaperpdf/13062009/12thane-pg6-0.pdf

Accessing any DNA epaper issue in Image (JPG) Format

Change the variable (epaperpdf) in URL to (EpaperImages)

Small Image Format
http://digital.dnaindia.com/EpaperImages/27112008/26main edition-pg1-0.jpg

Medium Image Format
http://digital.dnaindia.com/EpaperImages/27112008/26main edition-pg1-0l.jpg

Large Image Format
http://digital.dnaindia.com/EpaperImages/27112008/26main edition-pg1-0ll.jpg

Security issues on the DNA (Daily News and Analysis) epaper Portal

On 6th July2009, i mailed the editor / webmaster / web team / authorized employees, but never got a reply back from any of them, so i think they (don’t care) are not interested in discussing this issue

The epapers / supplements / magazines can be accessed / retrieved directly (in guest mode) without any authentication

Would you like to have a kewl email address login ID on the DNA epaper web portal ?

If yes, then proceed to the registration page @ http://digital.dnaindia.com/registration.aspx

Register with any email address of your choice (you can even type out the email address which doesn’t even exist for real), but it should be in the email ID format

Once you have done that you will get a message box, which will say

Confirmation
Thank you xxx (Your name) for  registering at http://digital.dnaindia.com

This registration will not be activated until you visit the confirmation URL which has been emailed to xxx@xxx.xxx (your email address)

Please click on the link given in the mail

NOTE :If you do not receive a mail immediately also check your bulkmail

So as you don’t have the access to that mailbox or maybe the email ID you used during registration doesn’t really exist, so copy paste the below URL with your email ID in it to activate your kewl email ID login on DNA epaper web portal

http://digital.dnaindia.com/update.aspx?userid=xxx@xxx.xxx

This is a automated weak authentication system implemented by the developer who designed the DNA epaper portal (its usually done by low paid freelancers / inexperienced developer employees)

A small java script has been embedded into the epaper portal in order to protect the users from right clicking and saving the images (onto their computers)

Website issues and other malicious activities (performed on the server) are not monitored by the webmaster / web team (which i believe consists of 12 – 15 people)

Dedications

I would like to dedicate this hack to all the Mumbaikars / Hackers / Small Cute Kids out there………

Below content are stolen from the underground hacker e-zine

Phrack – Volume One, Issue 7, Phile 3 of 10

Source URL – http://www.phrack.org/issues.html?issue=7&id=3&mode=txt

Reference URL – http://en.wikipedia.org/wiki/Hacker_Manifesto

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

File: archives/7/p7_0×03_Hacker’s Manifesto_by_The Mentor.txt

==Phrack Inc.==

Volume One, Issue 7, Phile 3 of 10

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

The following was written shortly after my arrest…

\/\The Conscience of a Hacker/\/

by

+++ The Mentor +++

Written on January 8, 1986

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Another one got caught today, it’s all over the papers. “Teenager

Arrested in Computer Crime Scandal”, “Hacker Arrested after Bank Tampering”…

Damn kids. They’re all alike.

But did you, in your three-piece psychology and 1950’s technobrain,

ever take a look behind the eyes of the hacker? Did you ever wonder what

made him tick, what forces shaped him, what may have molded him?

I am a hacker, enter my world…

Mine is a world that begins with school… I’m smarter than most of

the other kids, this crap they teach us bores me…

Damn underachiever. They’re all alike.

I’m in junior high or high school. I’ve listened to teachers explain

for the fifteenth time how to reduce a fraction. I understand it. “No, Ms.

Smith, I didn’t show my work. I did it in my head…”

Damn kid. Probably copied it. They’re all alike.

I made a discovery today. I found a computer. Wait a second, this is

cool. It does what I want it to. If it makes a mistake, it’s because I

screwed it up. Not because it doesn’t like me…

Or feels threatened by me…

Or thinks I’m a smart ass…

Or doesn’t like teaching and shouldn’t be here…

Damn kid. All he does is play games. They’re all alike.

And then it happened… a door opened to a world… rushing through

the phone line like heroin through an addict’s veins, an electronic pulse is

sent out, a refuge from the day-to-day incompetencies is sought… a board is

found.

“This is it… this is where I belong…”

I know everyone here… even if I’ve never met them, never talked to

them, may never hear from them again… I know you all…

Damn kid. Tying up the phone line again. They’re all alike…

You bet your ass we’re all alike… we’ve been spoon-fed baby food at

school when we hungered for steak… the bits of meat that you did let slip

through were pre-chewed and tasteless. We’ve been dominated by sadists, or

ignored by the apathetic. The few that had something to teach found us will-

ing pupils, but those few are like drops of water in the desert.

This is our world now… the world of the electron and the switch, the

beauty of the baud. We make use of a service already existing without paying

for what could be dirt-cheap if it wasn’t run by profiteering gluttons, and

you call us criminals. We explore… and you call us criminals. We seek

after knowledge… and you call us criminals. We exist without skin color,

without nationality, without religious bias… and you call us criminals.

You build atomic bombs, you wage wars, you murder, cheat, and lie to us

and try to make us believe it’s for our own good, yet we’re the criminals.

Yes, I am a criminal. My crime is that of curiosity. My crime is

that of judging people by what they say and think, not what they look like.

My crime is that of outsmarting you, something that you will never forgive me

for.

I am a hacker, and this is my manifesto. You may stop this individual,

but you can’t stop us all… after all, we’re all alike.

+++ The Mentor +++