TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

I could send any text message from Indian government IDs

136 pointsby winchester6788about 4 years ago

13 comments

bellyfullofbacabout 4 years ago
I like that in the middle of that, a wild "block-chain" appeared. Congrats to whichever consulting company managed to sell that bullshit to the government.
the-dudeabout 4 years ago
I think the author went way over the line here and should probably retract ASAP for his own well being.
评论 #27128790 未加载
megousabout 4 years ago
&gt; You would likely believe it, given the sender ID, wouldn’t you?<p>No. I absolutely don&#x27;t believe anyone unknown calling me, no matter who he claims to be, or what the CLIP says, unless I can call back to a public number of the institution he claims to represent. CLIP just isn&#x27;t secure.<p>I choose to risk believing for non-essential things, because security is just not convenient. But banks, government, anything where there&#x27;s well reported fraud going on regularly,... no way.<p>Calling back is also good, because outgoing calls are automatically recorded by my operator and sent to my email, so if I&#x27;m to enter into any agreement, it&#x27;s better to do it on an outgoing call.
评论 #27129700 未加载
woliveirajrabout 4 years ago
&gt; Essentially, anyone can’t send arbitrary messages using the above-mentioned loophole anymore. TRAI’s new system fixed that loophole. &gt; One can still send any message that fits in the template. But this largely restricts the possibilities of scams and misuse.<p>Seems to be fixed and that it was fixed during the time he did _nothing_ and just waited. Perhaps there was a responsible disclosure but he didn&#x27;t said how he did it.
评论 #27131050 未加载
fareeshabout 4 years ago
Brave post - the government has jailed people for far less
评论 #27128967 未加载
yeshokabout 4 years ago
It appears that he got the credentials from github, and this was critical for his exploit to work.
评论 #27129748 未加载
评论 #27128868 未加载
mschuster91about 4 years ago
The Indian Government should have asked Github for their &quot;Secret Scanning&quot; service (<a href="https:&#x2F;&#x2F;docs.github.com&#x2F;en&#x2F;code-security&#x2F;secret-security&#x2F;about-secret-scanning" rel="nofollow">https:&#x2F;&#x2F;docs.github.com&#x2F;en&#x2F;code-security&#x2F;secret-security&#x2F;abo...</a>).<p>That would have prevented the author just randomly stumbling on the credentials.
garaetjjteabout 4 years ago
&gt;These Sender IDs are reserved by companies and government organisations. Receiving a message from these Sender IDs is meant to be authentic.<p>No, it&#x27;s not. Caller ID is not authenticated and shouldn&#x27;t be depended for anything sensitive.
jaytaylorabout 4 years ago
Archive link, in case there is a takedown: <a href="https:&#x2F;&#x2F;archive.is&#x2F;iKzjh" rel="nofollow">https:&#x2F;&#x2F;archive.is&#x2F;iKzjh</a>
swileyabout 4 years ago
Shared secret authentication is pretty much always a bad idea. I&#x27;m continually shocked people still use it.
评论 #27132615 未加载
privacykingabout 4 years ago
You don&#x27;t need to hack their website to do this. SMS spoofing has been possible for decades and still is.
评论 #27129611 未加载
belatwabout 4 years ago
He should use this to tell everybody in India to stay hime, wear masks and stop going to mass worship ceremonies that are causing this devastating covid spike.
评论 #27129957 未加载
评论 #27129412 未加载
2Gkashmiriabout 4 years ago
meh. i tried to use it, i got the credentials alright but seems my POST skills with jsfiddle are ancient now, couldnt get it up and running.