Live data from Hacker News

Hacking India's largest automaker: Tata Motors

eaton-works.com

11–20 of 108 posts

Re: Hacking India's largest automaker: Tata Motors

#11
Related: Jaguar Land Rover hack cost UK economy an estimated $2.5 billion, report says: https://news.ycombinator.com/item?id=45668008

The 'tech' for both these is by guess who? TCS!

Edit: For those who don't know the relation. Tata[1] is a conglomerate, which owns both Tata Motors (Jaguar, Land Rover) and also TCS (Tata Consultancy Services)

[1] https://en.wikipedia.org/wiki/Tata_Group

Re: Hacking India's largest automaker: Tata Motors

#12
post #4

Security for most Indian companies - even conglomerates is a joke. Look at the websites - most look like they've not been upgraded since the 90s, with endless popups

It's a side effect of pay. Like every other company, you get what you pay for, and for organizations that view web security as a [edit:] Cost Center (eg. Tata Motors) there's no incentive to pay market rate for a Security Engineer - who in India can now demand $60k-100k TCs.

Heck, firms that provide offensive security capabilities to Indian PDs can pay $40k-50k after poaching a junior pentester or exploit developer from a PD.

Re: Hacking India's largest automaker: Tata Motors

#13
> October 23, 2023: They confirm receipt and are working on taking action. After this date and up until January 2, 2024, there were various back and forth emails trying to get Tata Motors to revoke the AWS keys. I am not sure if something was lost in translation, but it took a lot of pestering and specific instructions to get it done.

Wow, they had to go out of their way and plead with Tata Motors to fix their own shit. I can only admire their patience. Can't say I would be that patient.

Re: Hacking India's largest automaker: Tata Motors

#14
post #4

Security for most Indian companies - even conglomerates is a joke. Look at the websites - most look like they've not been upgraded since the 90s, with endless popups

It's a side effect of pay. Like every other company, you get what you pay for, and for organizations that view web security as a [edit:] Cost Center (eg. Tata Motors) there's no incentive to pay market rate for a Security Engineer - who in India can now demand $60k-100k TCs. Heck, firms that provide offensive security capabilities to Indian PDs can pay $40k-50k after poaching a junior pentester or exploit developer f…

Sorry to be pedantic but I think you mean 'cost center', not loss leader (something sold at a loss to attract customers into your ecosystem/store). You are entirely right otherwise.

Re: Hacking India's largest automaker: Tata Motors

#17

Related: Jaguar Land Rover hack cost UK economy an estimated $2.5 billion, report says: https://news.ycombinator.com/item?id=45668008 The 'tech' for both these is by guess who? TCS! Edit: For those who don't know the relation. Tata[1] is a conglomerate, which owns both Tata Motors (Jaguar, Land Rover) and also TCS (Tata Consultancy Services) [1] https://en.wikipedia.org/wiki/Tata_Group

TCS also contracts for Marks & Spencer, and the Co-op, both of which were also taken offline by hacking earlier this year.

Re: Hacking India's largest automaker: Tata Motors

#19
post #17

Related: Jaguar Land Rover hack cost UK economy an estimated $2.5 billion, report says: https://news.ycombinator.com/item?id=45668008 The 'tech' for both these is by guess who? TCS! Edit: For those who don't know the relation. Tata[1] is a conglomerate, which owns both Tata Motors (Jaguar, Land Rover) and also TCS (Tata Consultancy Services) [1] https://en.wikipedia.org/wiki/Tata_Group

TCS also contracts for Marks & Spencer, and the Co-op, both of which were also taken offline by hacking earlier this year.

At what point is it more believable that these are inside jobs done on purpose vs. incompetence? I guess that’s just Hanlon’s Razor though.

Re: Hacking India's largest automaker: Tata Motors

#20
post #14

Earlier quoted context omitted.

It's a side effect of pay. Like every other company, you get what you pay for, and for organizations that view web security as a [edit:] Cost Center (eg. Tata Motors) there's no incentive to pay market rate for a Security Engineer - who in India can now demand $60k-100k TCs. Heck, firms that provide offensive security capabilities to Indian PDs can pay $40k-50k after poaching a junior pentester or exploit developer f…

Sorry to be pedantic but I think you mean 'cost center', not loss leader (something sold at a loss to attract customers into your ecosystem/store). You are entirely right otherwise.

Doh! You are correct! Crossed wires during a meeting
Post reply on HN