Listen to this Post
Introduction:
The digitization of national tax collection systems, such as Malaysia’s e-Filing portal (myTax) managed by the LHDN, represents a critical intersection of public infrastructure and private financial data. While the backend calculations of PCB, tax relief, and zakat are well understood by accountants, the cybersecurity architecture protecting this data flow is often opaque to the public. This article dissects the security layers surrounding e-Filing systems, moving beyond the tax code to explore the vulnerabilities in web applications, API endpoints, and user authentication that could expose the sensitive financial records of millions.
Learning Objectives:
- Understand the common OWASP Top 10 vulnerabilities present in government financial portals.
- Learn how to audit and secure API endpoints handling Personally Identifiable Information (PII).
- Master the use of OpenSSL and GPG for securing sensitive tax document transmission.
- Identify exploitation vectors in session management and multi-factor authentication (MFA) implementations.
- Implement hardening techniques for web servers hosting financial applications.
You Should Know:
- Reconnaissance on Public Financial Portals (LHDN Case Study)
Before any security assessment, understanding the target’s digital footprint is key. The provided text references the official LHDN portal (hasil.gov.my). Security professionals must conduct passive reconnaissance to map subdomains and exposed services without triggering alarms.
Step‑by‑step guide:
Using `dig` and `nmap` on Linux to enumerate subdomains and open ports related to tax services:
Find authoritative name servers for the target dig ns hasil.gov.my Perform a zone transfer attempt (if misconfigured) dig axfr hasil.gov.my @ns1.hasil.gov.my Scan for open ports on the main web server nmap -sS -sV -p 80,443,8080,8443,21,22 hasil.gov.my Use TheHarvester to find associated emails and subdomains theharvester -d hasil.gov.my -b google,linkedin
Explanation: This initial phase maps the attack surface. Open ports like `8443` might indicate a development portal, while FTP (port 21) could be a legacy file transfer system for tax submissions—often a critical vulnerability if not properly isolated.
2. API Security Testing: Intercepting Tax Calculation Requests
Modern e-Filing platforms rely heavily on AJAX/API calls to calculate tax liabilities (PCB, rebate calculations) in real-time without refreshing the page. These endpoints are prime targets for data scraping and injection attacks.
Step‑by‑step guide:
Using `Burp Suite` and `curl` to test API endpoint security:
1. Configure your browser to route traffic through Burp Suite (127.0.0.1:8080).
2. Navigate to the e-Filing “Kira Cukai” (Tax Calculation) feature.
3. Identify the API endpoint (e.g., https://myhasil.hasil.gov.my/api/v1/tax/calculate`).
4. Use `curl` to replay the request with modified parameters:
curl -X POST https://myhasil.hasil.gov.my/api/v1/tax/calculate \
-H "Content-Type: application/json" \
-H "Authorization: Bearer [bash]" \
-d '{"annual_income": "50000", "relief": "9000", "user_id": "12345"}' \
-v
5. Test for IDOR (Insecure Direct Object References) by changing the `user_id` to12346`. If the system returns another user’s tax data, it indicates a broken access control vulnerability.
6. Test for Mass Assignment by injecting extra parameters like `”is_admin”: true` to see if the API accepts unintended attributes.
3. Data at Rest: Encrypting Sensitive Tax Documents
Taxpayers often store e-Filing verification forms, PCB statements, and zakat receipts locally. These documents are high-value targets for malware. Utilizing strong encryption ensures that even if a machine is compromised, the tax data remains unreadable.
Step‑by‑step guide:
Encrypting a tax folder using `gpg` (GnuPG) on Linux:
Generate a symmetric key (password-based) encryption for a tax PDF gpg --symmetric --cipher-algo AES256 LHDN_2025_Statement.pdf This creates a file LHDN_2025_Statement.pdf.gpg To decrypt the file on another machine gpg --output LHDN_2025_Statement.pdf --decrypt LHDN_2025_Statement.pdf.gpg
For Windows environments (PowerShell), using `SecureString` and `Protect-CmsMessage` (Requires PKI):
Define the content (or read from file) $TaxData = Get-Content .\TaxReturn_2025.txt -Raw Encrypt using a certificate's public key (Document Encryption template) $Encrypted = $TaxData | Protect-CmsMessage -To "cn=Tony Moukbel" $Encrypted | Out-File .\TaxReturn_2025.enc
Explanation: GPG’s AES256 encryption protects files at rest. The Windows CMS method ensures only the intended recipient with the corresponding private key can decrypt the message.
4. Session Management: Hijacking Tokens in Financial Portals
Web sessions for tax portals are often maintained via Cookies or JWT (JSON Web Tokens). If the token is not properly secured (missing HttpOnly, `Secure` flags, or using weak algorithms), an attacker with network access (e.g., on public Wi-Fi) can hijack the session.
Step‑by‑step guide:
Analyzing session security using browser Developer Tools and jwt_tool:
1. Open Developer Tools (F12) in Chrome/Firefox.
2. Navigate to the Application tab > Cookies.
- Check the flags: `Secure` (must be true for HTTPS), `HttpOnly` (true to prevent XSS access), `SameSite` (Lax or Strict).
- If a JWT is present in `localStorage` or as a cookie, copy the token.
- Use `jwt_tool` on Linux to check for vulnerabilities:
Install jwt_tool git clone https://github.com/ticarpi/jwt_tool cd jwt_tool python3 jwt_tool.py [bash] Test for the "None" algorithm attack python3 jwt_tool.py [bash] -X a
Explanation: A vulnerable portal might accept tokens with the `alg: none` header, allowing an attacker to forge arbitrary tokens and bypass authentication entirely.
5. Infrastructure Hardening: Securing the Web Server
If you are responsible for hosting a financial application (or testing one), server headers reveal crucial information. Misconfigurations can lead to data leaks.
Step‑by‑step guide:
Using `curl` to analyze server headers and implement fixes in an Apache/NGINX config:
Check for information disclosure headers curl -I https://hasil.gov.my
Look for headers like Server: Apache/2.2.15 (CentOS). If an outdated version is revealed, it tells attackers exactly which exploits to try.
Apache Hardening Snippet (httpd.conf/.htaccess):
Hide Apache version and OS ServerTokens Prod ServerSignature Off Enable security headers Header always set X-Content-Type-Options "nosniff" Header always set X-Frame-Options "DENY" Header always set Content-Security-Policy "default-src 'self'" Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" Disable directory listing Options -Indexes
NGINX Hardening Snippet:
server {
listen 443 ssl http2;
server_name myhasil.hasil.gov.my;
Hide nginx version
server_tokens off;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
SSL Configuration (TLS 1.3 only)
ssl_protocols TLSv1.3;
}
Explanation: Removing server version information and enforcing strict security headers prevents attackers from fingerprinting your infrastructure and mitigates common clickjacking/MIME sniffing attacks.
- Exploitation Simulation: SQL Injection on Tax Relief Input
The text mentions “Pelepasan cukai” (tax relief). Input fields for relief amounts (e.g., RM9,000) are classic injection points if the backend database queries are poorly constructed.
Step‑by‑step guide (Ethical Testing only):
Using `sqlmap` to automate detection:
Assuming a POST request to the tax relief endpoint saved as 'tax.req' sqlmap -r tax.req -p "relief_amount" --dbs --level=2 --risk=1
Manual Testing with `’` (single quote):
Input `9000’` into the relief field. If the application returns a database error (e.g., “MySQL fetch error” or “Unclosed quotation mark”), the application is vulnerable.
Mitigation: Use Prepared Statements (Parameterized Queries). In PHP (PDO):
$stmt = $pdo->prepare("SELECT FROM tax_relief WHERE amount = :amount");
$stmt->execute(['amount' => $_POST['relief_amount']]);
Explanation: Prepared statements ensure user input is treated as data, not executable code, effectively neutralizing SQL injection.
What Undercode Say:
- Tax Portals are Critical Infrastructure: Just like energy grids, tax systems are national security assets. A breach here doesn’t just steal money; it erodes public trust in the government’s digital capabilities.
- The Human Factor remains the weakest link: While we discuss API hardening and SQLi, the average taxpayer still stores their e-Filing password in a text file named “passwords.txt.” Security awareness must extend to the end-user.
- Defense in Depth is Non-Negotiable: Relying solely on SSL/TLS is insufficient. Financial applications require WAFs, regular penetration testing, strict input validation, and robust logging to detect anomalies like the IDOR attacks described earlier.
Analysis:
The conversation around tax often stops at compliance and rebates. However, from a cybersecurity perspective, the shift to e-Filing centralizes risk. Every relief claim, every PCB deduction, and every zakat payment becomes a data point in a digital dossier. The security of these systems is paramount, not only to prevent financial fraud but to protect against mass surveillance and identity theft. The responsibility lies with developers to secure APIs, sysadmins to harden servers, and users to practice basic digital hygiene. The LHDN portal, like all government financial interfaces, must be treated as a high-value target, audited continuously against the OWASP Top 10, and designed with a zero-trust architecture to ensure that even if one component fails, the data remains compartmentalized and secure.
Prediction:
In the next 3-5 years, we will see a legislative push for “Bug Bounty” programs specifically targeting national tax authorities. As AI-driven attacks become more sophisticated in scraping and aggregating financial data, governments will be forced to move from perimeter-based security to data-centric security models, likely adopting homomorphic encryption to allow tax calculation on encrypted data without ever exposing the raw plaintext. The rise of AI will also automate the discovery of logic flaws in tax calculation algorithms, leading to a new wave of exploits that bypass traditional security controls by manipulating the business logic itself.
▶️ Related Video (80% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Izzmier E – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
