We have discovered the Bug on 14-Feb-2009, Till yesterday BharatMatrimony.com did not taken enough care to update their login page completely... But when we had disclosed How we have done this...and couple of blogger's had put the posts regarding this.... within less than 24hr, these folks has changed the login page.
The stuff, BM did not taken care to do in 3 months... is done by less than 24hr !
Normally Security Folks follow the ethical practice, not to disclose the loophole till they completly fix it, even in past During Myntra Hack we have waited for 2-3 days, till their tech team will fix it. However Incase of Myntra, their team is active, when we reported the issue within next 6hr they called us, However in this case, since last 3 month looks like they stay dumb, with hope We will not going to publish it ! None will know it ! and kind of Lazy !!!
As per my understanding, No system is secure, however when someone will report you Security Loophole, atlest for the sake of your users... you should try to understand it and if possible fix it, or put practical workaround ! the work you have done in last 24 hr, you might have done in last 3 months ! But who cares ??? :)
Just Chill
Raxit Sheh
Showing posts with label hackday. Show all posts
Showing posts with label hackday. Show all posts
Tuesday, May 12, 2009
Monday, December 22, 2008
Hacking --- Was it Myntra !!! ?? Yes !
Hi,
Some of you following me on Twitter already had some smell of the stuff and hack!
We wanted to have few T-shirts for MyKavita.com (which is India's leading Poetry website) and Mobile 4 Mumbai (which is first ever city bus search on mobile still in private beta).
Somehow we found that Myntra is leading provider of personalized stuffs like T-shirt, Keychain, Mug etc and we put the order for few T-shirts !
As always, i was in hacky mind and found that Myntra is open system ! Anyone (even non-authorized) user can get some of the very imp and personal information of Myntra's users like Mobile Number, E-mail, Postal Address, Order amount etc !
Additional to that it was fun (although accidently !) to place the order and get invoice without paying any money :)
Here is few sample screenshots which clearly shows your personal information [your name, id, cell no, phone number, E-mail, Postal Address, Order amount and details etc]
We have reported the issue to Myntra on 21st Dec, Sunday around 5:30 IST.
Myntra's team had called me, got explaination and confirmed the security/Privacy loophole within next 4 hr of reporting.
While publishing this post, Ashutosh from Myntra has taken active roll in managing the fix.
Overall impression:
Still its my first shopping experience, they are quick to revert and slow to act upon. After reporting the issues we do have around 3-4 phone calls etc.
Hope, they deliver the stuff on time [even i had not make payment till. :) ]
Disclaimar :
Offer of free T-shirt for not posting this post is rejected :)
Myntra is knowing that we had not make payment, we asked them we will pay full amount as soon as they provide the account details.
Do not worry for creditcard/netbanking information, it was not accessible !
Suggestion to Myntra to have strict auditing of their system
Update 1 :
-------
me: have look at,
--------
Update 2:
Ashutosh from Myntra has called me on 26 Dec around 12:00 am [Or 25 dec around 11:55 pm]. He explained me that normally it is not offered in bribing sense, but it is in customer friendly sense. Whatsoever it is he is feeling shame and sorry for the same stuff.
below is the part of E-mai reply,
"We at Myntra are committed for best user experience. We are very serious about for customer data security.We will have complete security audit of our website and fix if there is any loop hole."
--------
Do you know any other hack ? ping me privately to raxit@m4mum.com !
Happy Hacking :)
Raxit Sheth
www.mykavita.com
www.m4mum.com
Some of you following me on Twitter already had some smell of the stuff and hack!
We wanted to have few T-shirts for MyKavita.com (which is India's leading Poetry website) and Mobile 4 Mumbai (which is first ever city bus search on mobile still in private beta).
Somehow we found that Myntra is leading provider of personalized stuffs like T-shirt, Keychain, Mug etc and we put the order for few T-shirts !
As always, i was in hacky mind and found that Myntra is open system ! Anyone (even non-authorized) user can get some of the very imp and personal information of Myntra's users like Mobile Number, E-mail, Postal Address, Order amount etc !
Additional to that it was fun (although accidently !) to place the order and get invoice without paying any money :)
Here is few sample screenshots which clearly shows your personal information [your name, id, cell no, phone number, E-mail, Postal Address, Order amount and details etc]
We have reported the issue to Myntra on 21st Dec, Sunday around 5:30 IST.
Myntra's team had called me, got explaination and confirmed the security/Privacy loophole within next 4 hr of reporting.
While publishing this post, Ashutosh from Myntra has taken active roll in managing the fix.
Overall impression:
Still its my first shopping experience, they are quick to revert and slow to act upon. After reporting the issues we do have around 3-4 phone calls etc.
Hope, they deliver the stuff on time [even i had not make payment till. :) ]
Disclaimar :
Offer of free T-shirt for not posting this post is rejected :)
Myntra is knowing that we had not make payment, we asked them we will pay full amount as soon as they provide the account details.
Do not worry for creditcard/netbanking information, it was not accessible !
Suggestion to Myntra to have strict auditing of their system
Update 1 :
-------
me: have look at,
just published !
lawania: ok
me: just check if any issue, let me know. will try to correct it.
lawania: see if you can remove the payment thing..as I called you up and asked that you payment is not approved..
me: Hmm. but then how would i get invoice ?
lawania: seems to be unusual cas .. sofar not got such issue..
but we did not get any confirmation mail for payment..
lawania: Since I was there in office on Sunday and I noticed the issue and immdiately called you
me: hmm. i am puting this chat as update ? is it fine ?
it will clearify to reader.
Update 2:
Ashutosh from Myntra has called me on 26 Dec around 12:00 am [Or 25 dec around 11:55 pm]. He explained me that normally it is not offered in bribing sense, but it is in customer friendly sense. Whatsoever it is he is feeling shame and sorry for the same stuff.
below is the part of E-mai reply,
"We at Myntra are committed for best user experience. We are very serious about for customer data security.We will have complete security audit of our website and fix if there is any loop hole."
--------
Do you know any other hack ? ping me privately to raxit@m4mum.com !
Happy Hacking :)
Raxit Sheth
www.mykavita.com
www.m4mum.com
Saturday, October 06, 2007
Hackin with Idli ! Hackin with Vadapav.. ! Yeah I am @ Yahoo Hackday !
Hey There,
Writing this entry from the laptop provided by Yahoo Hack Day Team. Was busy yesterday with Office Work....no no ....BarCampMumbai2 work. ! so missed some session by Yahoo Geeks. And currently Hunting for Idea Search for Hack !
Good internet connection, Good Food, and availability of Tea !
Hey one interesting stuff found is if one has not came with Laptop, is provided here ! really Very co-operative guys of Yahoo ! to help Hacker in Everyway !
So somone
< i forgot the name > has suggested Bangalore hackday is Hacking with Idli,Vada,- South Indian food and Next weeek will Hackin with Vadapav Indian Burger,speciality of Mumbai,Bombay !
Yeah, like that only...See you there....!!!
-Raxit
Writing this entry from the laptop provided by Yahoo Hack Day Team. Was busy yesterday with Office Work....no no ....BarCampMumbai2 work. ! so missed some session by Yahoo Geeks. And currently Hunting for Idea Search for Hack !
Good internet connection, Good Food, and availability of Tea !
Hey one interesting stuff found is if one has not came with Laptop, is provided here ! really Very co-operative guys of Yahoo ! to help Hacker in Everyway !
So somone
< i forgot the name > has suggested Bangalore hackday is Hacking with Idli,Vada,- South Indian food and Next weeek will Hackin with Vadapav Indian Burger,speciality of Mumbai,Bombay !
Yeah, like that only...See you there....!!!
-Raxit
Subscribe to:
Posts (Atom)