Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking India's largest automaker: Tata Motors

eaton-works.com

Post reply on HN
Print view View original

51–60 of 108 posts

Re: Hacking India's largest automaker: Tata Motors

#51

Post by silisili »

thousand_nights wrote: post #43
fencepost wrote: post #28

Earlier quoted context omitted.

Note that M&S dropped TCS in July following the recovery. https://www.ft.com/content/289ec371-2ed4-425a-9bd0-c34e6db39... and elsewhere.

> M&S chair, told MPs that hackers had used “sophisticated impersonation” to gain entry “involving a third party.” 20 bucks says this sophisticated impersonation was social engineering a $5/hour outsourced customer support employee > The attack is expected to lower operating profits by up to £300mn this year. that's not counting the reputation and brand damage. M&S is seen as a premium retailer and this whole hack ma…

> M&S is seen as a premium retailer and this whole hack made them seem utterly incompetent and unreliable

Hiring TCS to begin with made them seem utterly incompetent and unreliable.

Let them fail and be a warning to other companies trying to cheap out on IT.

Re: Hacking India's largest automaker: Tata Motors

#53

Post by UltraMagnus »

connectsnk wrote: post #37

Are there any open source tools that scans the code and detects such gaffes

Not open source, but I have used this before, and they have a very generous free tier: https://www.gitguardian.com/monitor-internal-repositories-fo...

You install their Github app and give them access to your Github repo (private repos are ok too) and they run a Github workflow when each PR is submitted scanning for secrets that should not be in the code. Really happy with how their product works.

Re: Hacking India's largest automaker: Tata Motors

#55

Post by unsungNovelty »

connectsnk wrote: post #37

Are there any open source tools that scans the code and detects such gaffes

If you weren't aware of it... There is a world of static application security tools (SAST) which can help you. Add them to your text editor/ci/cd to use them.

https://owasp.org/www-community/Source_Code_Analysis_Tools

Re: Hacking India's largest automaker: Tata Motors

#56

Post by coldfoundry »

This might be the first time I felt disappointed and sad reading an article like this. The commented username and password felt like something from an early 2000s tv show with the tech guy doing “hacking”.

Wonder how many others stumbled upon this prior, and makes me also wonder how many other sites have things like this hidden in plain sight. Insane.

Re: Hacking India's largest automaker: Tata Motors

#58

Post by hannofcart »

> As recently seen with Intel, there seems to be a trend where developers will do this pointless client-side decryption. When the client has the key, it’s strange that anyone would think that would be secure.

I stay and work in India. Yesterday, as part of a VAPT audit by a third party auditor, the auditors "recommended" that we do exactly this. I wonder if this directive comes as part of some outdated cyber security guidelines that are passed around here? Not entirely sure.

When I asked them about how I'd pass the secret to the client to do the client side encryption/decryption without that key being accessible to someone who is able to MITM intercept our HTTPS only API calls anyway, the guy basically couldn't understand my question and fumbled around in his 'Burp' suite pointing exasperatedly to how he is able to see the JSON body in POST requests.

Most of the security people we've met here, from what I can tell are really clueless. Internally, we call these guys "burp babies" (worse than "script kiddies") who just seem to know how to follow some cookie cutter instructions on using the Burp suite.

Re: Hacking India's largest automaker: Tata Motors

#59

Post by sayamqazi »

hannofcart wrote: post #58

> As recently seen with Intel, there seems to be a trend where developers will do this pointless client-side decryption. When the client has the key, it’s strange that anyone would think that would be secure. I stay and work in India. Yesterday, as part of a VAPT audit by a third party auditor, the auditors "recommended" that we do exactly this. I wonder if this directive comes as part of some outdated cyber security…

I am a pretty cookie cutter developer. We just make glorified CRUDs and I have tried to convince the engineering director hundreds of times that "There is no use of encrypting and decrypting localstorage with a key thats sitting right inside the client code." Yet they keep insisting on it in the code-quality checklist.

Re: Hacking India's largest automaker: Tata Motors

#60

Post by f311a »

alephnerd wrote: post #12
sharadov wrote: post #4

Security for most Indian companies - even conglomerates is a joke. Look at the websites - most look like they've not been upgraded since the 90s, with endless popups

It's a side effect of pay. Like every other company, you get what you pay for, and for organizations that view web security as a [edit:] Cost Center (eg. Tata Motors) there's no incentive to pay market rate for a Security Engineer - who in India can now demand $60k-100k TCs. Heck, firms that provide offensive security capabilities to Indian PDs can pay $40k-50k after poaching a junior pentester or exploit developer f…

> $60k-100k TC

Really? I think your numbers for the local marker are overestimated.

Post reply on HN