Bug in 12306.cn helps scalpers use fake ID numbers  

12306网站再现漏洞：“黄牛”持假身份证大量囤票

(ECNS) -- China's official website for booking train tickets, 12306.cn, has been infected by a bug that makes it vulnerable to the speculative activity of ticket scalpers, the Beijing News said on Friday.

According to an insider, there is a website that can generate fake identification numbers by extracting users' personal information, including date-of-birth, gender, and birthplace.

One reporter used the site to acquire 10 counterfeit identification numbers, then used one of them to buy a ticket from Beijing to Langfang, Hebei province, in the false name of "Zhao Dali." The reporter then bought a second ticket with another fake identification number.

Customer service at the website said that because the site hasn't been networked with the public security agency's database, 12306.cn can't verify the authenticity of ticket-buyer information.

Some speculators have taken advantage of the bug and bought large numbers of tickets.

Since the scalpers can't pick up tickets with fake identification numbers, they first buy tickets and then seek buyers. If anyone wants to buy tickets from them, the scalpers return the fraudulently purchased tickets and then repurchase them with a buyer's real personal information, then sell them for a higher price.

By applying such a method, scalpers can buy 1,000 tickets with one computer.

In order to disable browsers that have ticket-purchasing plug-ins, 12306.cn has updated its login verification code.