TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

I could send any text message from Indian government IDs

136 点作者 winchester6788大约 4 年前

13 条评论

bellyfullofbac大约 4 年前
I like that in the middle of that, a wild "block-chain" appeared. Congrats to whichever consulting company managed to sell that bullshit to the government.
the-dude大约 4 年前
I think the author went way over the line here and should probably retract ASAP for his own well being.
评论 #27128790 未加载
megous大约 4 年前
&gt; You would likely believe it, given the sender ID, wouldn’t you?<p>No. I absolutely don&#x27;t believe anyone unknown calling me, no matter who he claims to be, or what the CLIP says, unless I can call back to a public number of the institution he claims to represent. CLIP just isn&#x27;t secure.<p>I choose to risk believing for non-essential things, because security is just not convenient. But banks, government, anything where there&#x27;s well reported fraud going on regularly,... no way.<p>Calling back is also good, because outgoing calls are automatically recorded by my operator and sent to my email, so if I&#x27;m to enter into any agreement, it&#x27;s better to do it on an outgoing call.
评论 #27129700 未加载
woliveirajr大约 4 年前
&gt; Essentially, anyone can’t send arbitrary messages using the above-mentioned loophole anymore. TRAI’s new system fixed that loophole. &gt; One can still send any message that fits in the template. But this largely restricts the possibilities of scams and misuse.<p>Seems to be fixed and that it was fixed during the time he did _nothing_ and just waited. Perhaps there was a responsible disclosure but he didn&#x27;t said how he did it.
评论 #27131050 未加载
fareesh大约 4 年前
Brave post - the government has jailed people for far less
评论 #27128967 未加载
yeshok大约 4 年前
It appears that he got the credentials from github, and this was critical for his exploit to work.
评论 #27129748 未加载
评论 #27128868 未加载
mschuster91大约 4 年前
The Indian Government should have asked Github for their &quot;Secret Scanning&quot; service (<a href="https:&#x2F;&#x2F;docs.github.com&#x2F;en&#x2F;code-security&#x2F;secret-security&#x2F;about-secret-scanning" rel="nofollow">https:&#x2F;&#x2F;docs.github.com&#x2F;en&#x2F;code-security&#x2F;secret-security&#x2F;abo...</a>).<p>That would have prevented the author just randomly stumbling on the credentials.
garaetjjte大约 4 年前
&gt;These Sender IDs are reserved by companies and government organisations. Receiving a message from these Sender IDs is meant to be authentic.<p>No, it&#x27;s not. Caller ID is not authenticated and shouldn&#x27;t be depended for anything sensitive.
jaytaylor大约 4 年前
Archive link, in case there is a takedown: <a href="https:&#x2F;&#x2F;archive.is&#x2F;iKzjh" rel="nofollow">https:&#x2F;&#x2F;archive.is&#x2F;iKzjh</a>
swiley大约 4 年前
Shared secret authentication is pretty much always a bad idea. I&#x27;m continually shocked people still use it.
评论 #27132615 未加载
privacyking大约 4 年前
You don&#x27;t need to hack their website to do this. SMS spoofing has been possible for decades and still is.
评论 #27129611 未加载
belatw大约 4 年前
He should use this to tell everybody in India to stay hime, wear masks and stop going to mass worship ceremonies that are causing this devastating covid spike.
评论 #27129957 未加载
评论 #27129412 未加载
2Gkashmiri大约 4 年前
meh. i tried to use it, i got the credentials alright but seems my POST skills with jsfiddle are ancient now, couldnt get it up and running.