携程被曝存漏洞 或导致用户信用卡信息泄露
2014年03月23日08:59                         来源：搜狐IT                                                                                                                                                        
顶                                                 
分享
                                         
收藏                                                 购买                                         
                                                                                                           
                         

• 正文
• 我来说两句(3人参与)

Mazda6价格抄底直降4万！
手机客户端 | 扫描到手机

                                         关闭
                                                         
                                                                                                                  　　文/宿艺
　　漏洞报告平台乌云网在其官网上公布了一条网络安全漏洞信息，指出携程安全支付日志可遍历下载，可能导致大量用户银行卡信息泄露，包含持卡人姓名身份证、银行卡号、卡CVV码、6位卡Bin。
　　所谓遍历(Traversal)，是指沿着某条搜索路线，依次对树中每个结点均做一次且仅做一次访问。访问结点所做的操作依赖于具体的应用问题。
　　乌云方面解释称，该漏洞之所以存在，由于携程用于处理用户支付的安全支付服务器接口存在调试功能，将用户支付的记录用文本保存了下来。同时因为保存支付日志的服务器未做校严格的基线安全配置，存在目录遍历漏洞，导致所有支付过程中的调试信息可被任意骇客读取。
　　在拥有以上所泄漏信息的情况下，不法分子可以非常容易的进行信用卡盗刷。目前还不知道多少消费者受到此漏洞的影响。
　　该漏洞在乌云网上的等级被标记为高，该漏洞目前的状况是“厂商已经确认，细节仅向厂商公开”。
　　业内分析人士对此表示，而此次漏洞所泄漏信息显示，携程的确明文保存了用户相关机密信息，这明显已经违反了银联的相关规定。更糟糕的是，这样敏感的信息并没有被安全的存储，虽然目前还无法确认信息泄漏的范围，但信息被泄漏的可能已经被确认。
　　2011年12月22日，黑客在网上公开了知名网站CSDN的用户数据库。当时安全界便指出，明文存在用户密码等核心信息，是安全上非常危险并且业余的做法。时隔2年多，携程在被爆出此漏洞，可以说其安全体系非常脆弱。
　　携程方面于昨日晚间在其官方微博上回应：公司相关部门已经在第一时间展开技术排查并在消息发布两个小时内进行了漏洞弥补工作。
　　同时，携程表示，可能受影响的为3月21日与3月22日的部分交易客户，目前尚没有发现因相关问题导致客户信息泄露及造成损失的情况发生。公司将继续进行网络安全的核查工作，如果有用户因为该漏洞造成财产损失，携程将赔偿损失。

垃圾公司，该倒闭

乌云曝携程支付漏洞　用户小心信用卡安全                                 发布时间：2014.03.23 01:20                                                                     来源：赛迪网                                     作者：子鉃                                 
【赛迪网-IT技术讯】昨日晚些时候，漏洞报告平台乌云网披露了携程网安全漏洞信息，漏洞发现者称由于携程开启了用户支付服务借口的调试功能，支付过程中的调试信息可被任意黑客读取。安全日志包含的信息包括：持卡人姓名、持卡人身份证、所持银行卡类别（比如，招商银行信用卡、中国银行信用卡）、所持银行卡卡号、所持银行卡CVV码以及所持银行卡6位Bin(用于支付的6位数字)。同时被曝光的另一漏洞显示，携程某分站源代码包可直接下载(涉及数据库配置和支付接口信息)，目前该漏洞也已被乌云平台确认。对此，百度手机卫士提醒用户近日需多加注意信用卡信息安全，尤其是最近在携程用过银行卡支付的用户需提高警惕。

据漏洞发现者称由于携程开启了用户支付服务借口的调试功能，支付过程中的调试信息可被任意骇客读取。对此，携程官方表示，可能受影响用户为3月21日与3月22日的部分交易客户，目前并没有用户收到该漏洞的影响而造成相应财产损失的情况发现。携程将对于提供漏洞信息者给与重奖，对于此次漏洞事件如果有新的进展将持续通报。  虽然携程用户目前还未出现账户金钱损失，但为了避免可能出现的安全问题，百度手机卫士在这里还是提醒广大用户，面对已经曝光的安全漏洞不要慌张、保持冷静，并遵循以下建议保证财产安全： 1、首先马上核查是否有在相关网站的信用卡支付经历；如果确认，要第一时间与发卡银行取得联系，对账户进行查询看是否有不明确的交易，必要时，对账户进行相应的安全处理措施； 2、收到无法确认的短信，比如“电子密码失效”，“银行公告”，“更换信用卡”等短信，即使是看似银行官方发布，也应该多方确认，可以拨打官方客服电话确认； 3、使用手机安全软件，比如百度手机卫士具有查杀山寨网银，吸费木马病毒，网络环境监控，支付环境监控，短信加密认证等多想支付安全功能，可以有效避免手机支付安全风险； 4、保证手机系统的安全，不要给手机乱装软件，定期删除手机垃圾和清理缓存； 5、确保浏览的网页的安全性，不要随便点击不确定安全的链接。 除此之外，针对广大民众手机购物过程中遇到的风险，百度手机卫士在3•15期间专门推出了手机支付安全“环形防护”解决方案。据介绍，这一机制包括“应用下载保真、运行环境加固、传输过程加密、验证短信保护”四大模块，针对用户支付前下载支付类、网银类应用，应用安装后，对支付过程中、支付完成后的整个支付链条进行保护。其中传输过程加密、验证短信保护两大功能重点在保护手机支付信息、短信的安全，百度手机卫士将为用户提供单独加密的网络隧道，保证银行卡、支付宝等信息传输过程的安全；同时，还为支付宝、银行的验证短信提供单独存储域，全方位保障手机网购消费者手机的安全。 后继报道： 携程方面在晚些时候称，获知该消息后，携程即展开了相应技术排查，并修复问题。携程表示，尚未发现因相关问题导致客户信息泄露及造成损失的情况发生。 安全建议： 从安全角度考虑，使用信用卡在携程上进行过支付的用户，立即更换相关信用卡，以期将可能出现的损失降低或排除。 另外，对于与信用卡相关的短信提示信息，一定要审慎对待，详加核实。

从安全角度考虑，使用信用卡在携程上进行过支付的用户，立即更换相关信用卡，以期将可能出现的损失降低或排除。 另外，对于与信用卡相关的短信提示信息，一定要审慎对待，详加核实。

以下是米歇尔英文演讲的全部内容。
MRS. OBAMA:  (Applause.)  Thank you.  Well, ni-hao.  (Laughter.)  It is such a pleasure and an honor to be here with all of you at this great university, so thank you so much for having me.

Now, before I get started today, on behalf of myself and my husband, I just want to say a few very brief words about Malaysia Airlines Flight 370.  As my husband has said, the United States is offering as many resources as possible to assist in the search.  And please know that we are keeping all of the families and loved ones of those on this flight in our thoughts and prayers at this very difficult time.

Now with that, I want to start by recognizing our new Ambassador to China, Ambassador Baucus; President Wang; Chairman Zhu; Vice President Li; Director Cueller; Professor Oi, and the Stanford Center; President Sexton from New York University, which is an excellent study abroad program in Shanghai; and John Thornton, Director of the Global Leadership Program at Tsinghua University.  Thank you all for joining us.

But most of all, I want to thank all of the students who are here today.  And I particularly want to thank Eric Schaefer and Zhu Xuanhao for that extraordinary English and Chinese introduction.  That was a powerful symbol of everything that I want to talk with you about today.

See, by learning each other’s languages, and by showing such curiosity and respect for each other’s cultures, Mr. Schafer and Ms. Zhu and all of you are building bridges of understanding that will lead to so much more.  And I’m here today because I know that our future depends on connections like these among young people like you across the globe.

That’s why when my husband and I travel abroad, we don’t just visit palaces and parliaments and meet with heads of state.  We also come to schools like this one to meet with students like you, because we believe that relationships between nations aren’t just about relationships between governments or leaders -- they’re about relationships between people, particularly young people.  So we view study abroad programs not just as an educational opportunity for students, but also as a vital part of America’s foreign policy.

Through the wonders of modern technology, our world is more connected than ever before.  Ideas can cross oceans with the click of a button.  Companies can do business and compete with companies across the globe.  And we can text, email, Skype with people on every continent.  

So studying abroad isn’t just a fun way to spend a semester; it is quickly becoming the key to success in our global economy.  Because getting ahead in today’s workplaces isn’t just about getting good grades or test scores in school, which are important.  It’s also about having real experience with the world beyond your borders –- experience with languages, cultures and societies very different from your own.  Or, as the Chinese saying goes:  “It is better to travel ten thousand miles than to read ten thousand books.”

But let’s be clear, studying abroad is about so much more than improving your own future.  It’s also about shaping the future of your countries and of the world we all share.  Because when it comes to the defining challenges of our time -– whether it’s climate change or economic opportunity or the spread of nuclear weapons -- these are shared challenges.  And no one country can confront them alone.  The only way forward is together.

That’s why it is so important for young people like you to live and study in each other’s countries, because that’s how you develop that habit of cooperation.  You do it by immersing yourself in one another’s culture, by learning each other’s stories, by getting past the stereotypes and misconceptions that too often divide us.  

That’s how you come to understand how much we all share.  That’s how you realize that we all have a stake in each other’s success -- that cures discovered here in Beijing could save lives in America, that clean energy technologies from Silicon Valley in California could improve the environment here in China, that the architecture of an ancient temple in Xi’an could inspire the design of new buildings in Dallas or Detroit.   

And that’s when the connections you make as classmates or labmates can blossom into something more.  That’s what happened when Abigail Coplin became an American Fulbright Scholar here at Peking University.  She and her colleagues published papers together in top science journals, and they built research partnerships that lasted long after they returned to their home countries.  And Professor Niu Ke from Peking University was a Fulbright Scholarship -- Scholar in the U.S. last year, and he reported -- and this is a quote from him -- he said, “The most memorable experiences were with my American friends.”

These lasting bonds represent the true value of studying abroad.  And I am thrilled that more and more students are getting this opportunity.  As you’ve heard, China is currently the fifth most popular destination for Americans studying abroad, and today, the highest number of exchange students in the U.S. are from China.

But still, too many students never have this chance, and some that do are hesitant to take it.  They may feel like studying abroad is only for wealthy students or students from certain kinds of universities.  Or they may think to themselves, well, that sounds fun but how will it be useful in my life?  And believe me, I understand where these young people are coming from because I felt the same way back when I was in college.  

See, I came from a working-class family, and it never occurred to me to study abroad -- never.  My parents didn’t get a chance to attend college, so I was focused on getting into a university, earning my degree so that I could get a good job to support myself and help my family.  And I know for a lot of young people like me who are struggling to afford a regular semester of school, paying for plane tickets or living expenses halfway around the world just isn’t possible.  And that’s not acceptable, because study abroad shouldn’t just be for students from certain backgrounds.  

Our hope is to build connections between people of all races and socioeconomic backgrounds, because it is that diversity that truly will change the face of our relationships.  So we believe that diversity makes our country vibrant and strong.  And our study abroad programs should reflect the true spirit of America to the world.  

And that’s why when my husband visited China back in 2009, he announced the 100,000 Strong initiative to increase the number and diversity of American students studying in China.  And this year, as we mark the 35th anniversary of the normalization of relationships between our two countries, the U.S. government actually supports more American students in China than in any other country in the world.

We are sending high school, college and graduate students here to study Chinese.  We’re inviting teachers from China to teach Mandarin in American schools.  We’re providing free online advising for students in China who want to study in the U.S.  And the U.S.-China Fulbright program is still going strong with more than 3,000 alumni.  

And the private sector is stepping up as well.  For example, Steve Schwarzman, who is the head of an American company called Blackstone, is funding a new program at Tsinghua University modeled on the Rhodes Scholarship.  And today, students from all kinds of backgrounds are studying here in China.  

Take the example of Royale Nicholson, who’s from Cleveland, Ohio.  She attends New York University’s program in Shanghai.  Now, like me, Royale is a first-generation college student.  And her mother worked two full-time jobs while her father worked nights to support their family.  And of her experience in Shanghai, Royale said -- and this is her quote -- she said, “This city oozes persistence and inspires me to accomplish all that I can.”  And happy birthday, Royale.  It was her birthday yesterday.  (Laughter.)  

And then there’s Philmon Haile from the University of Washington, whose family came to the U.S. as refugees from Eritrea when he was a child.  And of his experience studying in China, he said, “Study abroad is a powerful vehicle for people-to-people exchange as we move into a new era of citizen diplomacy.”

“A new era of citizen diplomacy.”  I could not have said it better myself, because that’s really what I’m talking about.  I am talking about ordinary citizens reaching out to the world.  And as I always tell young people back in America, you don’t need to get on a plane to be a citizen diplomat.  I tell them that if you have an Internet connection in your home, school, or library, within seconds you can be transported anywhere in the world and meet people on every continent.  

And that’s why I’m posting a daily travel blog with videos and photos of my experiences here in China, because I want young people in America to be part of this visit.  And that’s really the power of technology –- how it can open up the entire world and expose us to ideas and innovations we never could have imagined.  

And that’s why it’s so important for information and ideas to flow freely over the Internet and through the media, because that’s how we discover the truth.  That’s how we learn what’s really happening in our communities and our country and our world.  And that’s how we decide which values and ideas we think are best –- by questioning and debating them vigorously, by listening to all sides of an argument, and by judging for ourselves.  

And believe me, I know how this can be a messy and frustrating process.  My husband and I are on the receiving end of plenty of questioning and criticism from our media and our fellow citizens.  And it’s not always easy, but we wouldn’t trade it for anything in the world.  Because time and again, we have seen that countries are stronger and more prosperous when the voices of and opinions of all their citizens can be heard.  

And as my husband has said, we respect the uniqueness of other cultures and societies, but when it comes to expressing yourself freely and worshipping as you choose and having open access to information, we believe those universal rights -- they are universal rights that are the birthright of every person on this planet.  We believe that all people deserve the opportunity to fulfill their highest potential as I was able to do in the United States.  

And as you learn about new cultures and form new friendships during your time here in China and in the United States, all of you are the living, breathing embodiment of those values.  So I guarantee you that in studying abroad, you’re not just changing your own life, you are changing the lives of everyone you meet.

And as the great American President John F. Kennedy once said about foreign students studying in the U.S., he said “I think they teach more than they learn.”  And that is just as true of young Americans who study abroad.  All of you are America’s best face, and China’s best face, to the world -- you truly are.

Every day, you show the world your countries’ energy and creativity and optimism and unwavering belief in the future.  And every day, you remind us -- and me in particular -- of just how much we can achieve if we reach across borders, and learn to see ourselves in each other, and confront our shared challenges with shared resolve.

So I hope you all will keep seeking these kinds of experiences.  And I hope you’ll keep teaching each other, and learning from each other, and building bonds of friendship that will enrich your lives and enrich our world for decades to come.

You all have so much to offer, and I cannot wait to see all that you achieve together in the years ahead.

Thank you so much.  Xie-Xie.  (Applause.)

在携程用积分换了一件礼品，几个月都没到。

携程要歇菜了