Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Indian Government Breached, Massive Amount of Critical Vulnerabilities

johnjhacking.com

Post reply on HN
Print view View original

11–20 of 74 posts

Re: Indian Government Breached, Massive Amount of Critical Vulnerabilities

#11

Post by smlckz »

> Governments have an obligation to protect the private data of its employees and citizens. In addition, the exposure of proprietary government data can be used for great means of manipulation and for other destructive purposes.

Understandable.

> While the NCIIPC operates a Responsible Vulnerability Disclosure Program, the recklessness and avoidance of communication represents the complete opposite of a responsible program. A failure to release notification of breach to affected citizens and to patch highly-critical vulnerabilities in a timely manner reflects poorly on the state of their Information Security posture. The clock to patch vulnerabilities began immediately when the DC3 contacted the NCIIPC via Twitter, as it is a highly visible space - one which threat actors avidly monitor.

Why did they published anything about the vulnerabilities before they were absolutely sure all of those has been mitigated?

Re: Indian Government Breached, Massive Amount of Critical Vulnerabilities

#12

Post by chrismorgan »

juancb wrote: post #7
deadalus wrote: post #5

Earlier quoted context omitted.

Indian Government Sold Driver Licence Data to 87 Private Companies for Rs 65 Crore - https://www.news18.com/news/auto/government-sold-drivers-lic...

What does RS 65 Croer mean?

Rs means rupees, specifically Indian rupees in this case, which has the symbol ₹ and code INR. (Other countries have rupees as well, but that symbol is specifically for Indian rupees.)

One crore is 10 million in the Indian numbering system, see https://en.wikipedia.org/wiki/Crore.

Re: Indian Government Breached, Massive Amount of Critical Vulnerabilities

#13

Post by Clewza313 »

perryizgr8 wrote: post #6
Clewza313 wrote: post #2

This smells a bit off: why is there no detail whatsoever on what exactly they breached? The "Indian Government" (central, state, other?) is a sprawling octopus that employs on the order of 50 million people, and there's a world of difference between breaching the public site of the Department of Fertilizers ( https://fert.nic.in/ ) vs getting into the internal systems of the Ministry of External Affairs. The only clu…

"Indian government" means central government, not state. Just like "US government" always refers to the federal government.

In Indian usage, yes, but this appears to have been written by a bunch of American teenagers.

Re: Indian Government Breached, Massive Amount of Critical Vulnerabilities

#15

Post by kuschku »

juancb wrote: post #7
deadalus wrote: post #5

Earlier quoted context omitted.

Indian Government Sold Driver Licence Data to 87 Private Companies for Rs 65 Crore - https://www.news18.com/news/auto/government-sold-drivers-lic...

What does RS 65 Croer mean?

Crore is equivalent to 10e6. In this case, that would evaluate to 650'000'000 INR.

Re: Indian Government Breached, Massive Amount of Critical Vulnerabilities

#18

Post by jauer »

smlckz wrote: post #11

> Governments have an obligation to protect the private data of its employees and citizens. In addition, the exposure of proprietary government data can be used for great means of manipulation and for other destructive purposes. Understandable. > While the NCIIPC operates a Responsible Vulnerability Disclosure Program, the recklessness and avoidance of communication represents the complete opposite of a responsible p…

> Why did they published anything about the vulnerabilities before they were absolutely sure all of those has been mitigated?

Because various entities tried to exploit that to defer any publicaton, which lead to things never getting fixed.

An entity may not want to fix things, but at some point their users / constituents have a right to know so they can take their own protective measures.

Re: Indian Government Breached, Massive Amount of Critical Vulnerabilities

#19

Post by perryizgr8 »

juancb wrote: post #7
deadalus wrote: post #5

Earlier quoted context omitted.

Indian Government Sold Driver Licence Data to 87 Private Companies for Rs 65 Crore - https://www.news18.com/news/auto/government-sold-drivers-lic...

What does RS 65 Croer mean?

https://perryizgr8.github.io/crores-to-millions/

Tool I wrote to convert between Indian and American numbers.

65 crore = 650 million

Re: Indian Government Breached, Massive Amount of Critical Vulnerabilities

#20

Post by astatine »

This manner of disclosure seems rather callous and reaching out on twitter to communicate a discovered vuln smacks of attention seeking. The Indian Government sites are a very wide mix with some where there is active consideration of such criticalities and a huge number created by the local enterprising chap who is no longer involved. Its hardly a surprise that lots of sites are vulnerable. Without some info on the sites, this is just scare mongering. NPCI is a critical piece of financial infrastructure but this could very well be the front-facing website and nothing to do with the financial services. Looks like an ad, as many others have pointed out.
Post reply on HN