Are there any open source tools that scans the code and detects such gaffes
TruffleHog: https://trufflesecurity.com/trufflehog
I worked for them a little bit and their product is really impressive and works great.
Hacking India's largest automaker: Tata Motors
81–90 of 108 posts
Re: Hacking India's largest automaker: Tata Motors
#82Are there any open source tools that scans the code and detects such gaffes
trufflehog is a good starting point, then bake in your own simple regex into your github actions or equivalent and make it part of your test suite
Re: Hacking India's largest automaker: Tata Motors
#83Related: Jaguar Land Rover hack cost UK economy an estimated $2.5 billion, report says: https://news.ycombinator.com/item?id=45668008 The 'tech' for both these is by guess who? TCS! Edit: For those who don't know the relation. Tata[1] is a conglomerate, which owns both Tata Motors (Jaguar, Land Rover) and also TCS (Tata Consultancy Services) [1] https://en.wikipedia.org/wiki/Tata_Group
Very realistically, why shouldn't these developers be replaced by AI? The anti-AI argument I've always seen here is that AI is bad at security. But human developers at orgs like TCS don't seem...any better?
The issue with folks like TCS is organizational. They don’t have to be this terrible, they intentionally structure what they are doing so their end product is terrible this way.
And people hire them and pay them for it!
The real issue is the last part. It’s why they can also get away with what they do.
Maybe they’ll replace their line devs with AI, but Indian devs are pretty cheap and are much more satisfying to yell at by Indian managers, so….
Re: Hacking India's largest automaker: Tata Motors
#84> As recently seen with Intel, there seems to be a trend where developers will do this pointless client-side decryption. When the client has the key, it’s strange that anyone would think that would be secure. I stay and work in India. Yesterday, as part of a VAPT audit by a third party auditor, the auditors "recommended" that we do exactly this. I wonder if this directive comes as part of some outdated cyber security…
I am a pretty cookie cutter developer. We just make glorified CRUDs and I have tried to convince the engineering director hundreds of times that "There is no use of encrypting and decrypting localstorage with a key thats sitting right inside the client code." Yet they keep insisting on it in the code-quality checklist.
I guess they think it results in some kind of security by obscurity... Maybe ward off lazy beginner hackers..
Re: Hacking India's largest automaker: Tata Motors
#85[flagged]
Re: Hacking India's largest automaker: Tata Motors
#86Total tangent, but I got to ride in some of these on a recent trip to India and I was really impressed with the build quality and utilitarian usefulness of the design.
Re: Hacking India's largest automaker: Tata Motors
#87Earlier quoted context omitted.
It's a side effect of pay. Like every other company, you get what you pay for, and for organizations that view web security as a [edit:] Cost Center (eg. Tata Motors) there's no incentive to pay market rate for a Security Engineer - who in India can now demand $60k-100k TCs. Heck, firms that provide offensive security capabilities to Indian PDs can pay $40k-50k after poaching a junior pentester or exploit developer f…
I understand why someone might this this is a pay issue, but it's goes beyond that. Culturually, doing something "well"(quality oriented, mindful of end-users) vs. "got it done" (transaction, pragmatic way of looking at things) is the heart of why outsourcing to many different geographical areas (India included) often results in something different than expected. Also condemning every one in one part of the world as…
Everyone is saying it’s about pay, but India is a low trust country (so far as large datasets saying as much can be trusted). Anecdotally I have heard the same from my expat friends as well.
I’m not saying pay has no influence, but saying culture has no influence makes no sense. Even if it was all about pay, wealthy Indians choosing to horde their wealth instead of distribute it (caste system, etc) is a cultural root for the pay problem. The two are so intertwined that it’s impossible to claim it’s black and white.
The current western trend of outsourcing and/or importing labor is the real source of this issue. Western businesses care only for profit, so they employ cheap labor. Western culture is currently much more low trust than it was 50 years ago, and trending worse. If anything, I think culture is the more defining factor - pay is downstream of it.
Re: Hacking India's largest automaker: Tata Motors
#88Earlier quoted context omitted.
I dont think there's much culture when the population is just overloaded with work and traffic and stress
It's absolutely the culture, "Chalta Hai" attitude is the culture. (Take it easy, let it go)
Cyber insurance or the threat of litigation after facing a severe breach will be the biggest driver for better security outcomes organizationally.
For example, both Zerodha and Razorpay have cyber insurance and PhonePe and Paytm both cleaned house after major incidents years ago.
It's also the same reason CapitalOne revamped security after the 2019 breach due to a misconfigured WAF.
Essentially, only the risk of either litigation or inability to secure cyber liability insurance will motivate Tata Motors to better manage security. And based on the JLR incident and their inability to secure sufficient cyber insurance, I think Tata Motors will clean house internally.
Re: Hacking India's largest automaker: Tata Motors
#89Earlier quoted context omitted.
This may look "boring" or "uninspired" but this is what real cybersecurity and "hacking" looks like. In most cases, security and QA are essentially two sides of the same coin - and this is why I get pissed when devs treat testing and QA as bulls**t, becuase even a relatively simple XSS attack or cred misconfig can have a massive impact.
This has nothing to do with testing. This is a lack of training. I would say they need to 'think like an attacker' at least some of the time. But this is still too high of a bar. I think this is really a problem of rewarding people when they finish things. One way or the other. It works, so on to the next project...
As someone who has been a SWE, PM, and VC in the cybersecurity space and constantly meets with CISOs as well as has formerly been a security practitioner (I should get back to using HackerOne again for fun), I can safely say that the overwhelming majority of security incidents are due to some form of misconfig because development and code review are orthogonal to proactive security checks.
Shift-left was supposed to fix that but it failed because the primary persona to sell ended up becoming the CISO again, and not trying to find a way to make security ownership a Dev and QA responsibility as well (this is largely organizational).
Re: Hacking India's largest automaker: Tata Motors
#90He would have had better results if he said "do the needful" in his first email to them.