Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • If there any any TCS employees on Hackernews, please show this post to your management. This is beyond embarrassing on so many levels.
    by pkphilip
  • So the author got nothing but a thank you out of it? That's a shame.
    by ksynwa
  • This shouldn't be a surprise for anyone who has worked with TCS contractors in the past.
    by paxys
  • Security for most Indian companies - even conglomerates is a joke.

    Look at the websites - most look like they've not been upgraded since the 90s, with endless popups

    by sharadov
  • The fact that they put their AWS secret keys on their website is incredible.
    by speckx
  • > October 23, 2023: They confirm receipt and are working on taking action. After this date and up until January 2, 2024, there were various back and forth emails trying to get Tata Motors to revoke the AWS keys. I am not sure if something was lost in translation, but it took a lot of pestering and specific instructions to get it done.

    Wow, they had to go out of their way and plead with Tata Motors to fix their own shit. I can only admire their patience. Can't say I would be that patient.

    by rdtsc
  • Related: Jaguar Land Rover hack cost UK economy an estimated $2.5 billion, report says: https://news.ycombinator.com/item?id=45668008

    The 'tech' for both these is by guess who? TCS!

    Edit: For those who don't know the relation. Tata[1] is a conglomerate, which owns both Tata Motors (Jaguar, Land Rover) and also TCS (Tata Consultancy Services)

    [1] https://en.wikipedia.org/wiki/Tata_Group

    by thelastgallon
  • > As recently seen with Intel, there seems to be a trend where developers will do this pointless client-side decryption. When the client has the key, it’s strange that anyone would think that would be secure.

    I stay and work in India. Yesterday, as part of a VAPT audit by a third party auditor, the auditors "recommended" that we do exactly this. I wonder if this directive comes as part of some outdated cyber security guidelines that are passed around here? Not entirely sure.

    When I asked them about how I'd pass the secret to the client to do the client side encryption/decryption without that key being accessible to someone who is able to MITM intercept our HTTPS only API calls anyway, the guy basically couldn't understand my question and fumbled around in his 'Burp' suite pointing exasperatedly to how he is able to see the JSON body in POST requests.

    Most of the security people we've met here, from what I can tell are really clueless. Internally, we call these guys "burp babies" (worse than "script kiddies") who just seem to know how to follow some cookie cutter instructions on using the Burp suite.

    by hannofcart

Explore Birbla archives