Note

A local LLM was used to rephrase this content.

via GIPHY

Another Rant Post? Yes.

A lot of Indian companies can deal with any security bug report by just closing their eyes. I still do not understand if responsible disclosure reports are even being read. All I have ever seen is an automated response. One thing I have seen firsthand is the engineer’s ego. If I could bet money on ego before submitting a report, I might become richer than Musk. The tight terms and conditions basically allow these companies to dodge all accountability. What are you going to do, make the bug public? Enjoy jail time. Even if you get public support on social media, they will act like they care in the replies, but the moment a private conversation starts, it is the same cold shoulder. They act like Asian parents.

My personal experiences, in chronological order:

1. Tata Power Delhi Distribution Limited is an electricity distribution company in Delhi. I found a bug that let anyone forge electricity bills through their payment portal and print them. I had such a hard time contacting them that I had to reach out to a journalist from Hyderabad to act as an intermediary. They finally fixed it.

2. Delhi Metro Rail Corporation has a transit card that I hacked to get free travel and infinite money, both real cash (this was possible with one-way transit tokens) and virtual transit balance. I contacted them over email. The automated response said they would get back to me in five working days. I am pretty sure those five days are orbiting a black hole, and NASA should study their calendar. It has been over four years. They recently stopped selling these cards and shifted to NCMC cards, with Airtel as the tender holder. I will see if I can hack those as well.

3. Yulu is a really nice ebike service that they copy-pasted from China. The locking system, the BLE command set, everything. Yes, these are Bluetooth-controlled bikes. What can go wrong? Oh, maybe anyone can mimic those Bluetooth packets. These guys stored their cryptographic keypairs in plain text. It took me about a week to exploit it. I wrote a Raspberry Pi based exploit to start all Yulus within its BLE range. I posted about it on Twitter and asked Yulu where I could submit a bug report. They replied to my tweet asking me to DM them the report. I messaged them asking for their email so I could send the details, and that was it. That was 2023. No replies since. They rolled out the exploitable Yulus and then rolled in a newer, “secure” version of bikes, again Chinese clones. The only thing secure about these new bikes is that the BLE communication is now encrypted. But the keypair is still in the app and can be extracted at runtime.

4. Third Wave Coffee: I think they just vibe-coded their app because there is no way a human is committing the errors I am about to describe. They use GraphQL for everything because of course ordering coffee requires that. Their GraphQL endpoint has introspection turned off, but it still tells you what you might mean when you enter a wrong mutation or query name, and it helpfully reveals the arguments and response types. It took me two days of trial and error to find an endpoint that gives free wave coins. I also made myself an admin. I can order coffee on other people’s accounts, give them wave coins, and so on. They never replied to any of my posts. The bug is still there, which probably shows that they do not care enough.

There are more stories like this that I have dealt with and seen others deal with.

What I have heard from some tech leads and managers is that they do not want to fix these bugs, or they silently fix them without giving credit because they do not want to pay out a bounty. This is insane. First off, not all of us ask for money. A credit on an appreciation page or a hall of fame is enough. Second, why not pay them? You can pay your engineers who introduce these errors without thinking twice, and this problem is only growing in the LLM age. But you cannot pay the random person who found the bug and saved your codebase from what might already be getting exploited. To be clear, this behavior is only true for a lot of Indian companies. Chindipana behavior.

Curb your ego and do not be shy about paying bounties. Treat security as a baseline, not an afterthought. Have an email hotline for bug reports and an actual human reading them. You can always choose to block people who abuse the system. Circling back to the title: open your eyes. The bugs are there. People are willing to help you. Take the help.