Hacking --- Was it Myntra !!! ?? Yes !

Hi,



Some of you following me on Twitter already had some smell of the stuff and hack!

We wanted to have few T-shirts for MyKavita.com (which is India's leading Poetry website) and Mobile 4 Mumbai (which is first ever city bus search on mobile still in private beta).

Somehow we found that Myntra is leading provider of personalized stuffs like T-shirt, Keychain, Mug etc and we put the order for few T-shirts !


As always, i was in hacky mind and found that Myntra is open system ! Anyone (even non-authorized) user can get some of the very imp and personal information of Myntra's users like Mobile Number, E-mail, Postal Address, Order amount etc !

Additional to that it was fun (although accidently !) to place the order and get invoice without paying any money :)


Here is few sample screenshots which clearly shows your personal information [your name, id, cell no, phone number, E-mail, Postal Address, Order amount and details etc]











We have reported the issue to Myntra on 21st Dec, Sunday around 5:30 IST.

Myntra's team had called me, got explaination and confirmed the security/Privacy loophole within next 4 hr of reporting.

While publishing this post, Ashutosh from Myntra has taken active roll in managing the fix.

Overall impression:
Still its my first shopping experience, they are quick to revert and slow to act upon. After reporting the issues we do have around 3-4 phone calls etc.

Hope, they deliver the stuff on time [even i had not make payment till. :) ]








Disclaimar :

Offer of free T-shirt for not posting this post is rejected :)

Myntra is knowing that we had not make payment, we asked them we will pay full amount as soon as they provide the account details.

Do not worry for creditcard/netbanking information, it was not accessible !

Suggestion to Myntra to have strict auditing of their system




Update 1 :

-------

me: have look at,

http://raxitsheth.blogspot.com/2008/12/hacking.html

just published !

lawania: ok

me: just check if any issue, let me know. will try to correct it.

lawania: see if you can remove the payment thing..as I called you up and asked that you payment is not approved..

me: Hmm. but then how would i get invoice ?

lawania: seems to be unusual cas .. sofar not got such issue..

but we did not get any confirmation mail for payment..

lawania: Since I was there in office on Sunday and I noticed the issue and immdiately called you

me: hmm. i am puting this chat as update ? is it fine ?

it will clearify to reader.

--------
Update 2:

Ashutosh from Myntra has called me on 26 Dec around 12:00 am [Or 25 dec around 11:55 pm]. He explained me that normally it is not offered in bribing sense, but it is in customer friendly sense. Whatsoever it is he is feeling shame and sorry for the same stuff.

below is the part of E-mai reply,

"We at Myntra are committed for best user experience. We are very serious about for customer data security.We will have complete security audit of our website and fix if there is any loop hole."
--------


Do you know any other hack ? ping me privately to raxit@m4mum.com !



Happy Hacking :)


Raxit Sheth
www.mykavita.com
www.m4mum.com

Pattern Matching -- Mumbai Bus Stop

Hey



I just finished some initial Hacky Code of Pattern Matching. You may find it useful.,........ Please put your Comment or E-mail me your thoughts !!! How it can be useful ?

On Web ?
On Mobile ?
As Web Service ?

Any other thoughts ???




Its return in Java ! :) :) :) Oh Yeah. Don't get Shocked its Java !


I asked couple of Folks, they told very much good result....

Thanks to Dinesh Soni, Aditi Gupta and Anjali

Below is sample conversation with few folks who got a chance to Try it !!! [thru google chat ! :) ]


mykavita$ java Main

Its Re-Usable and well Re-factored code, In Below High Rank means more matching and low rank is less matching !



-----------Below is chat message ------------

1. Dinesh Soni [this guy always ping me First !!!]

me: prepared a pattern matching program. where you provide few letter of bus stop... It will predict Best Match !!! Working fine so far, but still Experimental !!! Shortly will put it on Web !!!!
Sent at 11:19 PM on Wednesday
Dinesh: cool
Sent at 11:21 PM on Wednesday
me: just tell me 3-4 lettter of any bus stop, My prog will try to predict
Sent at 11:24 PM on Wednesday
Dinesh: chet
me: just tell me 3-4 lettter of any bus stop, My prog will try to predict

cheetacamp:::Rank=20
chakalacigarettefactory:::Rank=17
chakalamarket(up):::Rank=17
chemburstn./dr.ambedkargarden:::Rank=17
chemburstn.roadno1:::Rank=17
kherwadi/chetnacollege:::Rank=16
checknaka(dahisar):::Rank=15
checknaka(ferrywharf):::Rank=15
chemburlevelcrossing/shellbridg:::Rank=15
chemburnaka/swamivivekanandchk:::Rank=15
c&dshed(cottongreen-e):::Rank=14
centraldairy:::Rank=14
centrallabourinstitute(sion):::Rank=14
centralrlygoodsmazgaon:::Rank=14
centraltalkies(up):::Rank=14
chhedanagar:::Rank=14
khetwadi:::Rank=14
sacredheartschool(khar):::Rank=14
High rank means more matching
Was this expected ?
Top Entries are most matched !!!
Sent at 11:28 PM on Wednesday
Dinesh: cool man
:)
Sent at 11:31 PM on Wednesday
me: just finished b4 10 min ! Shortly i will put it on Web !!!
after 10-15 days !! :)
Dinesh: :)
will be waiting
me: :)
Sent at 11:33 PM on Wednesday
me: May i put your name and Result in Blog ??? I am just blogging about it !!!
Dinesh: sure yar
of course u can
Sent at 11:35 PM on Wednesday

------------------------


2. Aditi Gupta

me: give me 3-4 letter of your favourite Bus Stop. My Program will try to Predict the Stop !!!

Its AI Program. Shortly i will put on web !

Aditi: dada

chem

band

me: High rank means more matching

Aditi: and

hmm

me: samurai@raxit-laptop:~/Desktop/Saad/Raxit/backup/NetBeansProjects/PredictStop/src/predictstop$ java Main dada
Raxit Start---
dada
Dummy:::Rank=100
dadarstation-w(s.bapatroad):::Rank=21
damodarhall:::Rank=19
dandpada(khardanda):::Rank=19
dayaldasrd/gujaratsociety(parle):::Rank=18
khodadadcircle:::Rank=18
khodadadcircle(bhavechk)(up):::Rank=18
khodadadcircle(l.t.road):::Rank=18
adarshdairy-chunilalgirdharlalrd:::Rank=17
dadojikondevnagar(chembur-e):::Rank=17
dattapada(magathane):::Rank=17
dattapadamun.school(magathane)(up):::Rank=17
daulatnagar(dahisar-e):::Rank=17
devipada(borivli(e)):::Rank=17
dindoshipada:::Rank=17
gadiadda(reayroad-e):::Rank=17
adarshnagar-(appapadamalad-e):::Rank=16
azadmaidan(m.gandhiroad):::Rank=16
bhavanscollege(dadabhaird-andh(up):::Rank=16
Raxit End-------------
samurai@raxit-laptop:~/Desktop/Saad/Raxit/backup/NetB

samurai@raxit-laptop:~/Desktop/Saad/Raxit/backup/NetBeansProjects/PredictStop/src/predictstop$ java Main chem
Raxit Start---
chem
Dummy:::Rank=100
chemburlevelcrossing/shellbridg:::Rank=21
chemburnaka/swamivivekanandchk:::Rank=21
chemburstn./dr.ambedkargarden:::Rank=21
chemburstn.roadno1:::Rank=21
calicomills(chembur):::Rank=17
cheetacamp:::Rank=17
chitracinema(dadar):::Rank=17
chitracinema(dn):::Rank=17
polychemco.(b.d.patilrd-mahul:::Rank=17
azizbaug(chembur):::Rank=16
basantpark/sukhinivas(chembur):::Rank=16
basanttalkies(chembur):::Rank=16
bhaktibhavan(chembur):::Rank=16
bharatpetroleum(chembur):::Rank=16
bhikajidamajipatilmarg(chembur):::Rank=16
dadojikondevnagar(chembur-e):::Rank=16
dr.ambedkargarden(chembur):::Rank=16
fineartsauditorium(chembur):::Rank=16
Raxit End-------------
samurai@raxit-laptop:~/Desktop/Saad/Raxit/backup/Ne

samurai@raxit-laptop:~/Desktop/Saad/Raxit/backup/NetBeansProjects/PredictStop/src/predictstop$ java Main band
Raxit Start---
band
Dummy:::Rank=100
bandongri:::Rank=21
bandrabusstation(w):::Rank=21
bandracolonybusstn:::Rank=21
bandrakurlacomplex:::Rank=21
bandrareclamationbusstn:::Rank=21
bandrarlycrossing(e):::Rank=21
bandrarlyterminal:::Rank=21
bandrastation(e):::Rank=21
bandratalao(gurunanakroad):::Rank=21
bandratalkies(gurunanakroad):::Rank=21
bandratalkies(s.v.road):::Rank=21
bandratalkies(v.patelroad):::Rank=21
bandrekarwadi(jogeshwaripol.stn:::Rank=21
bandstand(babulnath):::Rank=21
bhandupcomplex:::Rank=20
bhanduppeoplesschool(bhandup-w:::Rank=20
bhanduppumpingcentre(v.naikrd:::Rank=20
bhandupstation(a.p.i.):::Rank=20
Raxit End-------------

Is this Good Result ???? Expected ?

Aditi: why are u sending me all this

me: just to actually compare the result !! Please copy paste in notepad. it ill just take 1 min.... !!!

This program is i am running locally... but soon will be online !!!

Aditi: hmm ok

the results are good

me: Tnx.

just finished coding b4 10 min. Still i think once put on Web, it can learn by itself and improve the result !

And we can have more data set !!!

Aditi: hmm

me: Tnx for trying.

May i put your name and Result in Blog ??? I am just blogging about it !!!

Aditi: go ahead

Sent at 11:35 PM on Wednesday

--------------------


3. Anjali [Note : Not Anjali Rego ]

me: just tell me 3-4 lettter of any bus stop, My prog will try to predict
anjali: 309
me: Bus Stop !!!
anjali: Mahindra
saidham
me: Raxit Start---
MahindraRaxit Start---
Mahindra
Dummy:::Rank=100
mahindraco.gate(bhadcolony):::Rank=41
mgandhividyamandirbandracolony:::Rank=32
mahavirnagar(dahanukarwadi):::Rank=29
mahavirnagarext.(dahanukarwadi):::Rank=29
amarnagar(khindipada):::Rank=28
gandhinagar(bandracolony):::Rank=28
durgamaheshwarimandir(charkop):::Rank=26
jarimaritemple(bandra)(up):::Rank=26
maheshwarinagar(marol):::Rank=26
maroshinaka/picnicpoint:::Rank=26
amarmahal(p.l.lokhanderoad):::Rank=25
machhimarnagar(mahim):::Rank=25
madhurcolony(chincholibunderrd):::Rank=25
municipalcolony(khindipada):::Rank=25
maharanapratapchk(mazgaon):::Rank=24
mandpeshwarindst.(borivli-w):::Rank=24
marathividnyanparishad(a.t.i):::Rank=24
kalamarutimandir(kandivli-w):::Rank=23
Raxit End-------------
samurai@raxit-laptop:~/Desktop/Saad/Raxit/backup
Dummy:::Rank=100
mahindraco.gate(bhadcolony):::Rank=41
mgandhividyamandirbandracolony:::Rank=32
mahavirnagar(dahanukarwadi):::Rank=29
mahavirnagarext.(dahanukarwadi):::Rank=29
amarnagar(khindipada):::Rank=28
gandhinagar(bandracolony):::Rank=28
durgamaheshwarimandir(charkop):::Rank=26
jarimaritemple(bandra)(up):::Rank=26
maheshwarinagar(marol):::Rank=26
maroshinaka/picnicpoint:::Rank=26
amarmahal(p.l.lokhanderoad):::Rank=25
machhimarnagar(mahim):::Rank=25
madhurcolony(chincholibunderrd):::Rank=25
municipalcolony(khindipada):::Rank=25
maharanapratapchk(mazgaon):::Rank=24
mandpeshwarindst.(borivli-w):::Rank=24
marathividnyanparishad(a.t.i):::Rank=24
kalamarutimandir(kandivli-w):::Rank=23
Raxit End-------------
samurai@raxit-laptop:~/Desktop/Saad/Raxit/backup
anjali: pushpa park
me: just tell me 3-4 lettter of any bus stop, My prog will try to predict
Just 3-4 on mobile none wants to enter saidham ! just sai is enough
High rank means more matching
me: May i put your name and Result in Blog ??? I am just blogging about it !!!
anjali: what are u writing? its about what? what do u want to do?
me: its about this program and the result !
anjali: ok
i dont have any prob until and unless its go to wrong hand
are u still doing coding?
@ home too?
me: no now i am blogging :)
anjali: get some rest yr mind
me: I am at home only !!!!
anjali: anyways

----------------


Who know Mobile 4 Mumbai may be powered by this ? :)



Thanks to havocke for giving back my data :)






-Raxit Sheth
www.MyKavita.com

openpls, mykavita , mobile 4 mumbai and other updates !

What we are upto !

Few readers ping us not much "On-Topic" blogpost related to Voip/VoiceXml/IVR etc ???

Let me explain a bit

MyKavita
Some of you already knowing, in January we launched http://www.Mykavita.com [Kavita means poem] a website based on wordpress where people can write their poem. This was interesting idea on my mind. Its going better than expected !. Our host asked to increase RAM/cpu for the server !. There are some more plan ahead, and some competitor also of the site ! Yeah !

If you are interested in update of mkavita,progress of it, and more details, please refer Mykavita blog http://www.mykavita.com/blog

Mobile 4 Mumbai
Additional to that, some of indian friends, barcampers and MoMo people knowing about the project just kickstarted ! Mobile 4 Mumbai http://m4mum.com ! Its basically some useful utility that can help normal people (this application is having indian context)

OpenPLS
Last but not least is, OpenPLS, www.sourceforge.net/projects/openpls
PLS is related to Speech Technology ! Its Java (Yeah dont panic !) based opensource implementation (LGPL License) we are developing. You must be guessing you have read somewhere on www-voice@w3.org , Yes you are correct Dirk www.jvoicexml.org has announced the project.


For openpls we are into requirenment gathering stage for implementation. if you are geek who want to design and code from scratch, drop a note to me or dirk ! You can be part of openpls.


Let me know for any query !

Note :
Mobile 4 mumbai, if you are into mobile gui development (j2me, symbian, nokia any platform any language, and if you think the project is useful and you want to involved. drop a line to me.)

OpenPLS: Contributors/volunteers contact dirk or me.



Cheers,
Raxit