Indian developers don't care about security unless you explain how to build the software step by step. Many firms got burnt because of this. We stopped working with individuals and teams in 2018. They don't care about security.
Hacking into an insurance company by exploiting their premium calculator
61–70 of 113 posts
Re: Hacking into an insurance company by exploiting their premium calculator
#62I'm curious to know how this person decided to just go looking into the source code of this very specific app. Why this one?
They probably looked at a lot of other ones, but you hear about this one only because they found an issue with it.
Re: Hacking into an insurance company by exploiting their premium calculator
#63Earlier quoted context omitted.
> This is someone who, at a fundamental level, has no grasp of the landscape they are operating in or the challenges they are up against. This is someone who wants you to go away because the jargon you're talking doesn't make any sense to them or their team. Sounds like exactly the kind of someone you wouldn't want to have to trust with your personal information let alone trust to manage your life/property/business/l…
[flagged]
I can’t tell whether or not this is a serious comment.
Re: Hacking into an insurance company by exploiting their premium calculator
#64"Appreciation letter" is why most of these vulnerabilities are not reported or disclosed by whitehats and are actively exploited by hackers. There should be a legal framework that holds companies liable for certain level of security mishandling when it comes to private customer data.
There is one in Europe, it’s called GDPR.
Yes and no. AFAIK it provides controls to ensure a certain level of privacy (with serious flaws IMO).
AFAIK it does not do much, if anything to punish breaches caused by incompetence. I have not heard of of any cases where companies were fined for breaches.
Not the whole of Europe. The EEA and the UK has legislation based on it what has not yet diverged significantly.
Re: Hacking into an insurance company by exploiting their premium calculator
#65There was a car dealer (Honda affiliate) I had the unfortunate "pleasure" of dealing with back in the mid-late 2000s that stored finance applications by numeric incrementing ids. I never did report it, but I was able to pull up a bunch of sensitive info (SSN, DOB, names, addresses) on folks living in NJ. (I didn't report it because bug bounties weren't really a thing back then and the CFAA was).
I managed to get my application removed, but the vulnerability existed for several years until they updated to a new system. The new system also appeared to have some vulnerabilities, but I never invested time to figure it out. I just did not do business with that dealer ever again, and I'm super wary about car dealerships and finance applications these days...I usually get my financing from elsewhere even if it means a bit higher of a payment...thankfully my vehicle is paid off.
Re: Hacking into an insurance company by exploiting their premium calculator
#66Earlier quoted context omitted.
Do you have a… less visceral metaphor? Or some information I can read about? I’m curious.
https://en.wikipedia.org/wiki/Data_Protection_Commissioner#I...
> In January 2023, DPC was forced to increase the fine issued to Meta Platforms after a review by European Data Protection Board found that the initial fine was insufficient.[12] European Data Protection Board determined that DPC has failed to perform its enforcement responsibility with "due diligence". The critics have pointed out that 7 out of 8 decisions handed down by European Data Protection Board were against the Irish DPC, and that the DPC "always choose the most tortuous, lengthy and expensive legal route to a decision rather than a simple application of EU law".[13]
Interesting.
Re: Hacking into an insurance company by exploiting their premium calculator
#67Earlier quoted context omitted.
There is one in Europe, it’s called GDPR.
Yes and no. AFAIK it provides controls to ensure a certain level of privacy (with serious flaws IMO). AFAIK it does not do much, if anything to punish breaches caused by incompetence. I have not heard of of any cases where companies were fined for breaches. Not the whole of Europe. The EEA and the UK has legislation based on it what has not yet diverged significantly.
https://www.enforcementtracker.com/
Here's a long list of them
Re: Hacking into an insurance company by exploiting their premium calculator
#68Earlier quoted context omitted.
There is one in Europe, it’s called GDPR.
Yes and no. AFAIK it provides controls to ensure a certain level of privacy (with serious flaws IMO). AFAIK it does not do much, if anything to punish breaches caused by incompetence. I have not heard of of any cases where companies were fined for breaches. Not the whole of Europe. The EEA and the UK has legislation based on it what has not yet diverged significantly.
I remember this case in France: https://www.lemonde.fr/societe/article/2019/06/18/la-cnil-in...
A GDPR related 400 000€ fine because a company was storing confidential data without authentication using sequential IDs, _and_ they didn’t care when they were warned about the issue.
Re: Hacking into an insurance company by exploiting their premium calculator
#69Indian developers don't care about security unless you explain how to build the software step by step. Many firms got burnt because of this. We stopped working with individuals and teams in 2018. They don't care about security.
I was trying to say this in polite terms, but failed to find the words. I am absolutely not knocking India at all. My all time best manager came from India and he taught me A LOT about software development in the earlier 2000s. He was incredibly smart, and there were 2 other folks at that company from India that also were very smart.
However, I've also had to deal with the reverse. Folks from India and elsewhere that just blindly churn out code according to literal instructions and don't give any thought as to how that code might not be safe/efficient/whatever.
That being said, I blame the company, not the people. You could easily end up in a similar mess here in the states if you don't take some time to vet.
(note: watching someone code on an interview aka pair coding isn't vetting, even take home assignments don't. If you do either of these, you aren't vetting, you are subconsciously looking at speed/accuracy/ability to think quickly, which may also mean you are discriminating based on age/disability -- i.e. people that code slower or think slower tend to be older or have a disability -- which is a violation of federal law here in the states.)
Re: Hacking into an insurance company by exploiting their premium calculator
#70There was a car dealer (Honda affiliate) I had the unfortunate "pleasure" of dealing with back in the mid-late 2000s that stored finance applications by numeric incrementing ids. I never did report it, but I was able to pull up a bunch of sensitive info (SSN, DOB, names, addresses) on folks living in NJ. (I didn't report it because bug bounties weren't really a thing back then and the CFAA was). I managed to get my a…
[dead]