Best printers for Home

Best Mixer Grinder

Best wired Earphones

Best 43 Inch TV in India

Best Wi Fi Routers

Best Home Theatre in India

Smart Watch under 5000

Best Laptops for Education

Best Laptop for Students

It is raining bug bounties for Indian ethical hackers and cybersecurity researchers as now, an Ahmedabad-based security researcher Bipin Jitiya has won ₹23.8 lakh ($31,500) from <keyword id="6354576" type="UNKNOWN" weightage="20" keywordseo="facebook">Facebook</keyword> for identifying a bug in its social networking platform and a third-party business intelligence portal. Jitiya, 26, identified the web security vulnerability in internal blind Server-Side Request Forgery (SSRF) in the source code of a publicly accessible endpoint, built using tools from MicroStrategy, that performed custom data collection and content generation. MicroStrategy has partnered with Facebook on data analytics projects for several years. Jitiya reported the bug to the MicroStrategy's security team, who acknowledged it, saying the issue has been mitigated. "I have always aimed in finding bugs in Facebook because it is the biggest social network on Earth with best-in-class security features in place. This time, they have awarded me with $31,500 for finding a critical bug. I have identified bugs in their systems in the past too," Jitiya told IANS on Monday. In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. In typical SSRF attacks, the attacker might cause the server to make a connection back to itself, or to other web-based services within the organization's infrastructure, or to external third-party systems. "I created a scenario that shows how the sensitive information leakage may be useful for launching specific attacks like path traversal and Server Side Request Forgery (SSRF). If an attacker is able to learn the internal IP addresses of the network, it is much easier for him/her to target systems in the internal network," explained Jitiya. The bug has now been fixed. "When I first got this bug on Facebook server I tried to convert it to RCE (remote code execution) but, unfortunately, they implemented good security measures. However, I made a total of $31500 ($1,000 + $30,000 + $500) from this vulnerability," he informed. On a question whether he would join Facebook cybersecurity research team if given an offer, Jitiya told IANS: "I would like to stay in India and work as a security researcher for Indian firms. I am not a bug bounty hacker". Last month, a 27-year-old Indian security researcher Bhavuk Jain grabbed $100,000 (over Rs 75.5 lakh) from Apple for discovering a now-patched Zero Day vulnerability in the Sign in with Apple account authentication. The Zero Day vulnerability could have allowed a hacker to break into an Apple user's account who log into third-party apps like like Dropbox, Spotify, Airbnb and Giphy (now acquired by Facebook) and more. "Indian ethical hackers and security researchers have come of age, and are now creating headlines the world over with their unmatched skills," said Jitiya.

Facebook pays ₹23.8 lakh to Indian security researcher for finding a bug

OYO Hotels &amp; Homes, the world's leading hospitality chain, today announced that it will continue to ramp up efforts to improve its information security framework as well as roll-out stronger ethical hacking and bug bounty programs to encourage continuous improvement and collaboration with ethical hacking experts. This development is in line with the company's commitment towards ensuring data privacy and building a robust cybersecurity network. According to Jagbir Singh, Engineering Manager - DevOps and InfoSec, OYO Hotels &amp; Homes, "One of our biggest assets is the trust our customers, partners and employees place in us. We understand that trust is hard to earn and easy to lose. One key responsibility in earning this trust is protecting the data our customers and other stakeholders have with us from any unauthorised use. Our team of 1100+ world-class security, network and software engineers and external partners across multiple geographies is at work 24x7 ensuring the protection of this data, so our customers and stakeholders can rest easy." The Bug Bounty program that the company aims to introduce is towards ensuring that there is a credible and continuous flow of positive feedback from independent security groups and individual researchers to mitigate against any bug or shortfall in the company's systems. This is in line with the established practice of recognition and reward for ethical hackers who help responsibly investigate shortfalls within the tech architecture of several tech companies including the likes of Silicon Valley giants like Facebook, Google etc. OYO has accordingly developed an improved responsible disclosure policy to encourage honest and responsible reporting of any potential risks. Additionally, OYO has partnered with a specialized cybersecurity startup, AppSecure/Hackerhive, that connects companies and ethical hackers to help the former discover and fix security vulnerabilities and is in the process of developing a full-fledged bug bounty program. Security a priority Security is an integral part of any process at OYO; beginning from the collection of data, during transfer and processing to storage at rest. We follow a comprehensive information security framework based on NIST (National Institute of Standards and Technology, USA), ISO 27001 and other stringent industry standards. Our commitment also extends to employee training and sensitization at every step. All new joiners at OYO go through information security training as part of the New Employee Orientation. The company's software developers and other Information Security personnel also attend a mandatory quarterly refresher since the technology in this space is dynamic and evolving very quickly. There is also an annual mandatory refresher training for all existing employees. Commenting on this announcement, Anil Goel, Group Chief Technology and Product Officer, said, "We have a robust and world-class security team comprising of in-house and external experts employing best in class security techniques including virtual private networks/cloud, firewalls, intrusion prevention and detection devices (IPS and IDS), security trainings for all engineers, static and dynamic code analysis, regular vulnerability assessments and network penetration tests. In today's digital world, a cyberattack is a real concern. Hence, in line with our efforts to continually improve, we are investing in ethical hacking programs as well." OYO also joined hands with other technology companies to address the issue of increasing online frauds and save guests from cybercrimes. Along with other companies, OYO met the Reserve Bank of India (RBI) representatives and made a joint representation on the issue that also addressed the plan on how to curb these online frauds followed by a meeting with other stakeholders in the telecom industry. The company has a long way to go and as it continues to amplify investments in this ever-evolving space, it aims to continually improve. About OYO Hotels and Homes Opening its doors in 2013, OYO Hotels &amp; Homes, a young hotel startup, today is the world's leading chain of hotels and homes. The portfolio combines fully operated real estate comprising more than 43,000 hotels with over 1 million rooms. Through its vacation homes business, the company offers travellers and city dwellers access to over 130,000 homes around the world under OYO Home, Belvilla, Danland, Dancenter and Germany-based Traum-Ferienwohnungen brands. OYO today operates in over 800 cities in 80 countries, including the U.S., Europe, U.K., India, Middle East, Southeast Asia, and Japan.

OYO to roll out comprehensive ethical hacking and bug bounty programs

<keyword id="2505279" type="UNKNOWN" weightage="100" keywordseo="bug-bounties">Bug bounties</keyword> is the term used for monetary rewards that tech firms offer to geeks for spotting bugs, errors and security flaws that could lead to severe problems in case hackers spot them. 
 
Off lately, several Indian techies are getting more and more interested in these bug bounties. As per a report by one of the earliest crowd-sourcing companies called Bugcrowd, 28.2% of the hackers that signed up for bug bounty programmes until March were Indians, followed by US (24.4%), the UK (3.9%), Pakistan (3.5%) and Australia (2.4%). 
 
Bug bounties started in 1995, with Netscape announcing rewards to hackers who found bugs in its web browser. Since then, almost all the tech giants, be it Facebook, Google, Apple, Twitter or Yahoo!, have either launched their own programmes or hired with third-party companies to reward hackers who find bugs in their programmes. 
 
Not only IT companies, companies like General Motors, Khan Academy, Starbucks and United Airlines have also run bug bounty programmes, but these are rarely run by Indian companies, fearing security breach in case they have an inside look at their codes. 
 
Paytm, one of the few Indian companies that have run bug bounty programmes, says that open-sourcing security has resulted in more 'hack-proof ' systems. 
 
"While our internal testing teams are always on high alert, bug bounty programmes help us identify sporadic loopholes in our system, and fix them immediately," Sourabh Sharma, assistant vice-president at Paytm, told <a href="http://economictimes.indiatimes.com/tech/software/indians-top-league-of-nerds-in-spotting-bugs-for-tech-companies/articleshow/53730568.cms">ET</a>. 
 
While bounties vary from $100 to $200,000 on the international front, Indian companies are very finicky when it comes to these rewards. "Instead of money payments, they send certificates or goodies - CDs, pen drives, T-shirts, etc. These are not lucrative enough," said Vikram Karthik, a Chennai-based ex-security researcher. "Some companies delay the payment and inform a week later that the specific vulnerability has already been reported," he added. 
 
<a href="https://cdn3.vox-cdn.com/thumbor/dOTSbh28VvCfhwXERInIvr4g03Q=/0x111:1200x786/1600x900/cdn0.vox-cdn.com/uploads/chorus_image/image/45809074/bug_bounty.0.0.jpg">Image source</a>

Bug bounties attracting Indians like never before companies

<ul><li>The Indian government has announced a ₹3 lakh bounty for anyone who can find a vulnerability with its COVID-19 tracking app, <keyword id="8995296" type="UNKNOWN" weightage="20" keywordseo="aarogya-setu">Aarogya Setu</keyword>. </li><li>You can also win a reward of ₹1 lakh if you make a valid suggestion for how the app can be improved. </li><li>Aarogya Setu’s open-source code is up for analysis on GitHub for developers to grab — and it’s a way for the government to lay to rest any privacy concerns that people may have. </li></ul>There’s a ₹1 lakh reward up for grabs for anyone who can find a valid way to improve the Indian government’s COVID-19 tracking app, Aarogya Setu. Another ₹3 lakh is up for grabs if someone can point out a security vulnerability. The government wants to lay to rest any acquisitions or claims about how the data its take from users’ phone can be misappropriated. The open-source code for the contact tracing app has been released on Github and developers are being encouraged to track down any loopholes that they can find — something that many privacy activists have been advocating ever since Aarogya Setu made its way into the limelight. <div type="Article" hostid="261" msid="76011848" title="Amid privacy concerns, Centre makes Aarogya Setu app open source" mstype="2" mssubtype="0"></div> The ‘bug bounty’ programme is open to Indians as well as foreign nationals. However, only Indians are eligible to claim the money reward offered under the scheme. “This is a unique thing to be done. No other government product anywhere in the world has been open-sourced at this scale,” announced Amitabh Kant, chief executive of NITI Aayog. The government has also promised that any updates to the app will also be made open-source through the same repository. The question of privacy The Indian government’s COVID-19 tracking app has repeatedly been under the lens during the lockdown. With Aarogya Setu asking for permission to access users’ data, people are concerned that they may be offering up more than they had bargained for — especially since the government of India made it mandatory for everyone to have it on their phones. “You want to make sure that you have the right protection in your application and that equitable data is being collected. It opens up the doors for attackers. From a government’s perspective, you want to make sure that the agencies are taking the right protection,” Yuval Wollman, the President of Cyberproof and former Director-General of Israeli Intelligence told Business Insider. <div type="Article" hostid="261" msid="75569270" title="Aarogya Setu denies privacy breach, contradicts ethical hacker’s claims" mstype="2" mssubtype="0"></div> Aarogya Setu has had a tough go of it ever since Twitter’s famed Elliot Alderson — real name, Robert Baptiste — pointed out that there is a security issue with the app earlier this month. “The privacy of 90 million Indians is at stake,” he wrote. The makers of Aarogya Setu hit back saying, “No personal information of any user has been proven to be at risk by this ethical hacker. We are continuously testing and upgrading our systems.” “Developing countries, with their limited budgets and resources, need to consider the costs versus the outcomes in tracing exposed individuals in a privacy preserving way,” said <a href="https://medium.com/@rameshboston/going-open-source-for-aarogya-setu-will-help-covid19-efforts-and-drive-innovation-58f97042367c">Ramesh Raskar</a>, an MIT Media Lab professor. According to him, an app like Aarogya Setu runs the risk of exposing private data, which is especially risky considering the large data stores that a population like India has up for grabs. SEE ALSO: <a href="https://www.businessinsider.in/tech/news/experts-explain-the-legal-and-moral-pitfalls-in-aarogya-setu-app-despite-the-governments-insistence-that-a-protocol-has-been-put-in-place/articleshow/75690239.cms">Experts explain the legal and moral pitfalls in Aarogya Setu app ⁠— despite the government’s insistence that a protocol has been put in place</a> <a href="https://www.businessinsider.in/tech/news/amid-privacy-concerns-centre-makes-aarogya-setu-app-open-source/articleshow/76011848.cms">Amid privacy concerns, Centre makes Aarogya Setu app open source</a> <a href="https://www.businessinsider.in/india/news/govt-likely-to-make-aarogya-setu-app-mandatory-for-flyers-post-lockdown/articleshow/75680125.cms">Govt likely to make Aarogya Setu app mandatory for flyers post lockdown</a>

Hacking Aarogya Setu can win you ₹1 lakh to ₹3 lakh through the Indian government’s ‘bug bounty’ programme

Indian security researcher Bhavuk Jain has grabbed $100,000 (over Rs 75.5 lakh) from Apple for discovering a now-patched Zero Day vulnerability in the Sign in with <keyword id="9320578" type="UNKNOWN" weightage="20" keywordseo="apple-account-authentication">Apple account authentication</keyword>. The Zero Day vulnerability could have allowed a hacker to break into an Apple user's account who log into third-party apps like like Dropbox, Spotify, Airbnb and Giphy (now acquired by <keyword id="6354576" type="COMPANY" weightage="20" keywordseo="facebook">Facebook</keyword>) and more. Jain who holds a bachelor's degree in electronics and communication discovered Zero Day bug in 'Sign in with Apple' that affected third-party applications which were using it, and didn't implement their own additional security measures. "This bug could have resulted in a full account takeover of user accounts on that third party application irrespective of a victim having a valid Apple ID or not," Jain said in a statement on Saturday. "For this vulnerability, I was paid $100,000 by Apple under their <keyword id="9320577" type="UNKNOWN" weightage="20" keywordseo="apple-security-bounty-programme">Apple Security Bounty programme</keyword>," he announced. Jain is a full-stack developer interested mostly in mobile app development using React Native. He is currently a full-time bug bounty hunter "trying to make the internet a safer place for everyone". Launched in 2019, 'Sign in with Apple' is aimed to be a more privacy-focused alternative to third-party logins. Jain disclosed the flaw to Apple which led to an award from Apple's bug bounty programme. Apple has since patched the bug. According to Jain, the 'Sign in with Apple' works similarly to 'OAuth 2.0'. "There are two possible ways to authenticate a user by either using a JWT (JSON Web Token) or a code generated by the Apple server. The code is then used to generate a JWT," he explained. In the second step, while authorizing, Apple gives an option to a user to either share the Apple Email ID with the third party app or not. If the user decides to hide the Email ID, Apple generates its own user-specific Apple relay Email ID. "Depending upon the user selection, after successful authorization, Apple creates a JWT which contains this email ID which is then used by the 3rd party app to login a user," said Jain. He found that he could request JWTs for any email ID from Apple and when the signature of these tokens was verified using Apple's public key, they showed as valid. "This means an attacker could forge a JWT by linking any Email ID to it and gaining access to the victim's account," Jain noted. The impact of this vulnerability was quite critical as it could have allowed full account takeover. A lot of developers have integrated Sign in with Apple since it is mandatory for applications that support other social logins. Before patching the bug, Apple did an investigation of their logs and determined there was no misuse or account compromise due to this vulnerability. SEE ALSO: <a href="https://www.businessinsider.in/science/news/spacex-just-launched-its-historic-mission-to-fly-nasa-astronauts-to-space/articleshow/76114304.cms" data-type="tilCustomLink">MUSK MAKES HISTORY: SpaceX just launched 2 people into orbit for the first time, kicking off the rocket company's most important mission since its founding 18 years ago</a> <a href="https://www.businessinsider.in/india/news/covid-19-india-records-highest-single-day-spike-of-8380-cases-death-toll-climbs-to-5164/articleshow/76116076.cms" data-type="tilCustomLink">India records highest single-day spike of 8,380 coronavirus cases— death toll climbs to 5,164</a>

A 27-year-old Indian developer bags ₹75 lakh for reporting a critical flaw in ‘Sign in with Apple’

New Delhi, A bug during a <keyword id="8601386" type="UNKNOWN" weightage="20" keywordseo="Facebook-test">Facebook test</keyword> recently exposed the <keyword id="74417" type="PERSON" weightage="20" keywordseo="personal-information">personal information</keyword> like email addresses and birthdays of <keyword id="1487422" type="PERSON" weightage="20" keywordseo="Instagram-users">Instagram users</keyword>, the media reported. Saugat Pokharel, an experienced bug hunter from Nepal, discovered the bug. The attack used <keyword id="6354576" type="UNKNOWN" weightage="20" keywordseo="facebook">Facebook</keyword>'s Business Suite tool, available to any Facebook business account, reports The Verge. Pokharel found that the attack worked on accounts that were set to <keyword id="6356430" type="UNKNOWN" weightage="20" keywordseo="private">private</keyword> and accounts that were set to not accept DMs from the public. "If an account did not accept DMs, the user potentially would not receive any notification indicating their profile may have been viewed," the report said on Friday. Facebook patched the vulnerability after being reported. According to a Facebook spokesperson, the bug was only accessible for a short period of time during a small test. "A researcher reported an issue where, if someone was a part of a small test we ran in October for business accounts, personal information of the person they were messaging could have been revealed," the company spokesperson was quoted as saying. "This issue was resolved quickly, and we discovered no evidence of abuse. Through our Bug Bounty Program we rewarded this researcher for his help in reporting this issue to us". Pokharel earlier found another bug in <keyword id="819905" type="COMPANY" weightage="20" keywordseo="Instagram">Instagram</keyword> and awarded a $6,000 bug bounty payout. He found that Instagram retained photos and private direct messages on its servers long after he deleted them. The company fixed the bug and allowed Pokharel to disclose the bug issue. SEE ALSO: <a href="https://www.businessinsider.in/stock-market/news/heres-what-analysts-say-if-you-should-subscribe-or-not-to-the-300-crore-ipo-of-antony-waste-handling-cell/articleshow/79790998.cms">Antony Waste Handling Cell ₹300-crore IPO will open on Monday— these are the risks and opportunities</a> <a href="https://www.businessinsider.in/business/news/ikea-india-cfo-says-she-still-has-3500-crore-to-be-spent-in-india-the-pandemic-has-changed-targets-but-not-the-investment-plan/articleshow/79790938.cms">INTERVIEW: Ikea CFO says she still has ₹3,500 crore to be spent in India⁠— the pandemic has changed targets but not the investment plan</a> <a href="https://www.businessinsider.in/science/health/news/india-will-produce-300-million-doses-of-the-russian-sputnik-v-covid-19-vaccine-next-year/articleshow/79795341.cms">India will produce 300 million doses of the Russian Sputnik V COVID-19 vaccine next year</a>

Facebook fixes bug that exposed Instagram users' personal information

<ul><li>Herd Immunity is a benchmark which is reached when the majority of the population develops resistance to a contagious disease </li><li>There are more experts chiming in and pointing to the fact that countries should not bank on the development of herd immunity to fight coronavirus — especially young countries like India. </li><li><keyword id="3995775" type="PERSON" weightage="20" keywordseo="ashish-jha">Ashish Jha</keyword>, a Harvard Professor, told <keyword id="5268" type="PERSON" weightage="20" keywordseo="Rahul-Gandhi">Rahul Gandhi</keyword> that herd immunity is a terrible idea. </li><li>Previously, WHO Executive Director for Health Emergencies Mike Ryan has also warned that <a href="https://www.businessinsider.in/science/news/the-who-made-a-thinly-veiled-dig-at-swedens-loose-coronavirus-lockdown-saying-humans-are-not-herds-and-old-people-are-not-disposable/articleshow/75685574.cms">it is “dangerous” to believe </a>that countries which did not implement strict measures to control the virus will develop herd immunity. </li></ul>As the number of coronavirus infections increases rapidly, scientists and health experts are clear that herd immunity isn’t going to bail the world from this deadly pandemic. Herd Immunity is a benchmark which is reached when the majority of the population develops resistance to a contagious disease — thereby developing antibodies that can immune the humans and prevent spread of the virus. There are more experts chiming in and pointing to the fact that countries should not bank on the development of herd immunity to fight coronavirus — especially young countries like India. “We are finding that even healthy and young people are getting very ill. We can’t be cavalier about this. We have to protect these people. Herd immunity in India is a terrible idea as millions will die, even young people,” Ashish Jha, professor of Global Health at the TH Chan School of Public Health and Director, Harvard Global Health institute told Congress leader Rahul Gandhi during a live chat. Jha said COVID-19 is here to stay for more than a year and called for aggressive testing to prevent its spread. However, he exuded confidence that a vaccine for coronavirus will be available by 2021. Previously, WHO Executive Director for Health Emergencies Mike Ryan has also warned that <a href="https://www.businessinsider.in/science/news/the-who-made-a-thinly-veiled-dig-at-swedens-loose-coronavirus-lockdown-saying-humans-are-not-herds-and-old-people-are-not-disposable/articleshow/75685574.cms">it is “dangerous” to believe </a>that countries which did not implement strict measures to control the virus will develop herd immunity. Yet another WHO scientist Soumya Swaminathan cited global data to warn that the <a href="https://www.hindustantimes.com/india-news/herd-immunity-is-still-far-global-data/story-YC1wm9ctrOcziPyKVwCAcM.html">population immune to coronavirus is too low to be called herd immunity</a>. “Based on data from many countries that have done sero surveys, it is clear that only a small proportion of 5%-10% people have been exposed to this virus. It will be difficult to achieve herd immunity without a vaccine, the number of people who get ill or die may be unacceptably high,” s<a href="https://www.hindustantimes.com/india-news/herd-immunity-is-still-far-global-data/story-YC1wm9ctrOcziPyKVwCAcM.html">aid Dr Soumya Swaminathan, chief scientist, World Health Organization. </a> According to experts including Ashish Jha aggressive testing is the only solution which can help India contain coronavirus — as it will identify the most vulnerable ones in the country. SEE ALSO: <a href="https://www.businessinsider.in/business/startups/news/french-president-emmanuel-macrons-residence-gets-bengaluru-startups-coronaoven-which-sanitizes-everything-in-10-minutes/articleshow/76034831.cms">French President Emmanuel Macron’s residence gets Bengaluru startup’s CoronaOven – which sanitizes everything in 10 minutes</a> <a href="https://www.businessinsider.in/tech/apps/news/hacking-aarogya-setu-can-win-you-1-lakh-to-3-lakh-through-the-indian-governments-bug-bounty-programme/articleshow/76030048.cms">Hacking Aarogya Setu can win you ₹1 lakh to ₹3 lakh through the Indian government’s ‘bug bounty’ programme</a>

Herd immunity in India is a terrible idea, says Harvard Professor

<ul><li>Three departments of the Indian government have been issued a show-cause notice to explain the development of India’s contact tracing app — <keyword id="8995296" type="UNKNOWN" weightage="20" keywordseo="aarogya-setu">Aarogya Setu</keyword>. </li><li>The <keyword id="6373306" type="ORGANIZATION" weightage="20" keywordseo="national-informatics-centre">National Informatics Centre</keyword> (NIC), the <keyword id="3428254" type="PERSON" weightage="20" keywordseo="ministry-of-electronics-and-information-technology">Ministry of Electronics and Information Technology</keyword> (MeitY), and the National e-Governance Division (NeGD) have been asked to appear before the bench on November 24 by the Central Information Commission (CIC).</li><li>The NIC, in particular, as the app’s developer needs to explain how Aarogya Setu was created. </li></ul> India’s contact tracing app Aarogya Setu, which boasts of over 162 million downloads, is caught in the crosshairs of controversy again — this time over its origin story. A petition was filed by Saurav Das with the Central Information Commission (CIC) when three bodies within the government refused to answer Right to Information (RTI) requests asking about the creation of Aarogya Setu. “It is surprising that the National Informatics Centre (NIC) doesn’t have any information about Aarogya Setu since it is the app’s developer,” said the petition. The CIC, India’s transparency watchdog, has now served a show-cause notice to the three bodies — NIC, the Ministry of Electronics and Information Technology (MeitY), and the National e-Governance Division (NeGD) — to explain their role in the development of Aarogya Setu within the next two months. NIC, in particular, needs to explain how the <keyword id="8995298" type="UNKNOWN" weightage="20" keywordseo="aarogya-setu-app">Aarogya Setu app</keyword> was created. "None of the CPIOs were able to explain anything regarding who created the App, where are the files — and the same is extremely preposterous", said the CIC interim order. Central Public Information Officers (CPIOs) of the departments have also been asked to appear before the bench on November 24 to explain why they should not be penalised under Section 20 of the RTI Act for obstruction of information. A copy of any and all supporting documents that may be relevant to the hearing should be submitted five days prior to the hearing. The government has issued a clarification stating, "Aarogya Setu was developed in a transparent manner in collaboration with industry and academia." <div type="twitter" handle="SetuAarogya" handlename="Aarogya Setu" image="http://pbs.twimg.com/profile_images/1246377580594266113/wMJonS1Z_normal.jpg" favoritecount="149" retweetcount="37" status="Clarification issued on Aarogya Setu App. Aarogya Setu App is a product of Government of India built in collaborati… https://t.co/8YUSBVAnSd" createdat="1603891530000" id="1321442970424410112"></div> Other troubling signs around Aarogya Setu French security researcher Robert Baptiste, who goes by Elliot Alderson on Twitter, first claimed that the Aarogya Setu app showed <a href="https://www.businessinsider.in/tech/apps/news/these-are-the-privacy-issues-in-aarogya-setu-indias-covid-19-tracker-app-alleged-by-french-hacker-elliot-alderson/articleshow/75592800.cms">security flaws</a> back in May. At the time, the government thanked him for his concern but <a href="https://www.businessinsider.in/tech/apps/news/aarogya-setu-claims-its-app-is-secure-denies-privacy-breach/articleshow/75569270.cms">dismissed the accusations</a>. They asserted that tracking the location of users is a documented feature of the app, not a flaw. As the reins around the app tightened, former Supreme Court judge Justice BN Srikrishna called the government’s move to make Aarogya Setu <a href="https://www.businessinsider.in/india/news/covid-19-smartphone-without-aarogya-setu-app-will-draw-punishment-for-user-in-gautam-buddh-nagar/articleshow/75540878.cms">mandatory</a> for all citizens ‘<a href="https://www.businessinsider.in/tech/news/experts-explain-the-legal-and-moral-pitfalls-in-aarogya-setu-app-despite-the-governments-insistence-that-a-protocol-has-been-put-in-place/articleshow/75690239.cms">utterly illegal</a>.’ Another analysis by the renowned <a href="https://www.deccanchronicle.com/technology/in-other-news/270520/after-mit-tech-review-downgrades-aarogya-setu-rating-source-code-for.html">MIT Technology Review</a> gave Aargoya Setu only 2 out of 5 stars in its analysis of 25 contact tracing apps around the world. It highlighted that India is the only democracy that is making such an app mandatory. The rating was later <a href="https://www.deccanchronicle.com/technology/in-other-news/270520/after-mit-tech-review-downgrades-aarogya-setu-rating-source-code-for.html">further chopped</a> to just one star when the researchers discovered that the app was collecting more information than it needed to function. It was only after the review that MietY <a href="https://www.businessinsider.in/tech/news/amid-privacy-concerns-centre-makes-aarogya-setu-app-open-source/articleshow/76011848.cms">released Aarogya Setu’s source code</a> on GitHub and initiated a ‘<a href="https://www.businessinsider.in/tech/apps/news/hacking-aarogya-setu-can-win-you-1-lakh-to-3-lakh-through-the-indian-governments-bug-bounty-programme/articleshow/76030048.cms">bug bounty program</a>’ for anyone who could find an issue with the app. SEE ALSO: <a href="https://www.businessinsider.in/science/space/news/building-blocks-of-life-discovered-in-titans-atmosphere-nasa-discovers-a-weird-molecule-on-saturns-largest-moon/articleshow/78909286.cms">Building blocks of life discovered in Titan’s atmosphere — NASA discovers a ‘weird’ molecule on Saturn’s largest moon</a> <a href="https://www.businessinsider.in/finance/banks/news/ajay-piramal-believes-that-if-banks-wont-lend-to-long-term-projects-india-will-need-to-revive-the-likes-of-idbi-and-ifci/articleshow/78906135.cms">EXCLUSIVE: Ajay Piramal believes that if banks won't lend to long-term projects, India will need to revive the likes of IDBI and IFCI</a> <a href="https://www.businessinsider.in/science/space/news/apophis-the-god-of-chaos-asteroid-is-speeding-up-increasing-the-likelihood-of-it-hitting-earth-in-2068/articleshow/78895818.cms">Apophis, the ‘God of Chaos’ asteroid is speeding up — increasing the likelihood of it hitting Earth in 2068</a>

India's contact tracing app Aarogya Setu comes under the scanner again — three departments fail to explain their role in its development

<ul><li>An 'unauthorised party' was able to access OnePlus customers' order information and might have stolen users' names, shipping addresses, contact numbers and email IDs.</li><li>If you are one of the affected users, OnePlus has sent an email to registered ID to inform you of the breach.</li><li>The company has not disclosed how many users were affected but claims that the most that can happen is a little more spam in your inbox.</li></ul>Two years, two data breaches for OnePlus — but this time around it isn't that serious, <a href="https://www.oneplus.com/uk/support/faq22119102?awc=10855_1574672963_f0477d6fa82d76221305528879af4fb4&amp;utm_source=aw&amp;utm_medium=affiliate&amp;utm_campaign=Sub+Networks&amp;utm_term=78888&amp;utm_content=0">according</a> to the company. The most that can happen is that you'll get extra spam in your inbox, if you're one of the affected users. In case you were one of the victims, the company will be notifying you by email. Last time around, in January 2018, the credit card information of around 40,000 customers was stolen. OnePlus has not disclosed who many customers were affected this time but claims that all payment information, passwords and accounts are safe — only names, contact numbers, email IDs and shipping addresses 'may have been exposed'. This means the hacker only has the power to send phishing emails and spam your way. They don't have enough information to hack into your accounts or access any of your financial services. But, it does put you at risk. Here's how phishing emails work <a href="https://www.businessinsider.in/even-this-expert-on-hackers-got-tricked-into-clicking-a-scam-email/articleshow/53625920.cms">Phishing</a> is like carrying out a con — only it's online. Users usually receive an <a href="https://www.businessinsider.in/people-are-being-victimized-by-a-terrifying-new-email-scam-where-attackers-claim-they-stole-your-password-and-hacked-your-webcam-while-you-were-watching-porn-heres-how-to-protect-yourself/amp_articleshow/65126033.cms">authentic-looking </a>email that seems as though it's from a <a href="https://www.businessinsider.in/the-11-most-sophisticated-online-scams-right-now-that-the-average-person-falls-for/articleshow/68568477.cms">legitimate company</a>. The email usually asks the recipient to click on a link or provide sensitive information. So, as a general rule, never provide any sensitive information by clicking on third party links. Not just over emails, but even forwarding links in messages or from secondary websites. And, whenever you are entering any sensitive information online, always double-check the URL. Better yet, use your own link. Moreover, activate a plug-in or web tool that can <a href="https://www.businessinsider.in/think-you-can-spot-a-hackers-phishing-email-take-googles-quiz-and-find-out/articleshow/67648969.cms">flag off</a> malicious links and warn you before you click on anything risky. How is OnePlus going to fix this? "We took immediate steps to stop the intruder and reinforce security, making sure there are no similar vulnerabilities," said OnePlus in a <a href="https://www.oneplus.com/uk/support/faq22119102?awc=10855_1574672963_f0477d6fa82d76221305528879af4fb4&amp;utm_source=aw&amp;utm_medium=affiliate&amp;utm_campaign=Sub+Networks&amp;utm_term=78888&amp;utm_content=0">statement</a>. According to the company, it will be partnering with a 'world-renowned' security platform — ye to be disclosed — next month. And, in collaboration, they will launch an official bug bounty program by the end of December. Even though the company revealed the data breach on their official company website, they did not report it to CERT-IN — India's nodal agency for cybersecurity — as per the IT Act. Business Insider has reached out to OnePlus for more information and awaiting their response. See also: <a href="https://www.businessinsider.in/wipro-phishing-attack-computer-system-hacked/articleshow/68918449.cms">Wipro confirms phishing attack on its system — 11 other companies unknown</a> <a href="https://www.businessinsider.in/tech/apps/news/whatsapp-data-breach-hits-downloads-in-its-biggest-market-opens-it-up-to-telegram-and-signal/articleshow/71936801.cms">WhatsApp data breach hits downloads in its biggest market — opens it up to Telegram and Signal</a> <a href="https://www.businessinsider.in/tech/apps/news/how-to-stay-safe-on-whatsapp-and-protect-your-data/articleshow/71837738.cms">How to stay safe on WhatsApp and protect your data</a>

One Plus has not disclosed how many users were affected by data breaches

In a bid to allay the <keyword id="113022" type="PERSON" weightage="20" keywordseo="Privacy-concerns">privacy concerns</keyword> regarding the <keyword id="8995298" type="PERSON" weightage="20" keywordseo="aarogya-setu-app">Aarogya Setu app</keyword>, the Centre on Tuesday announced it was making the <keyword id="9295766" type="UNKNOWN" weightage="20" keywordseo="mobile-application-open-source">mobile application open source</keyword>, allowing researchers, experts and developers to understand how it works and the personal data processed through it. The source code for the Android version of the application is available for review and collaboration on Github. The iOS version of the application will be released as open source within the next two weeks and the server code will be released subsequently, an official statement said. Almost 98 per cent of Aarogya Setu users are on Android platform, it added. "The key pillars of Aarogya Setu have been transparency, privacy and security and in line with India's policy on <keyword id="201540" type="COMPANY" weightage="20" keywordseo="Open-Source-Software">Open Source Software</keyword>, the source code of Aarogya Setu has now been made open source," said <keyword id="9295765" type="COMPANY" weightage="20" keywordseo="the-electronics-it-ministry">the Electronics &amp; IT Ministry</keyword> statement. It said that opening the source code to the developer community signifies the government's continuing commitment to the principles of transparency and collaboration. "With the release of the source code in the public domain, we are looking to expanding collaboration and to leverage the expertise of top technical brains amongst the talented youth and citizens of our nation and to collectively build a robust and secure technology solution to help support the work of frontline health workers in fighting this pandemic together," the statement said. The government has also announced a bug bounty program for the app, whereby the government will pay a cash price of Rs 1 lakh to any developer who finds bugs or loopholes in the application. SEE ALSO:<a href="https://www.businessinsider.in/tech/news/experts-explain-the-legal-and-moral-pitfalls-in-aarogya-setu-app-despite-the-governments-insistence-that-a-protocol-has-been-put-in-place/articleshow/75690239.cms" data-type="tilCustomLink"> Experts explain the legal and moral pitfalls in Aarogya Setu app ⁠— despite the government’s insistence that a protocol has been put in place</a>

Amid privacy concerns, Centre makes Aarogya Setu app open source

A cybercriminal group with the alias ‘John Wick on Thursday said in a tweet that it did not hack <keyword id="4225623" type="PERSON" weightage="20" keywordseo="Paytm-Mall">Paytm Mall</keyword>, even as the group claimed responsibility for briefly hacking the Twitter account linked to Prime Minister Narendra Modi's personal website. <div type="Article" hostid="261" msid="77902203" title="Twitter account of PM Modi's personal website hacked — asks followers for Bitcoin and Ethereum donations" mstype="2" mssubtype="0"></div> "This account is hacked by John Wick (hckindia@tutanota.com), We have not hacked Paytm Mall," John Wick posted after taking over the Twitter account. The authenticity of the claims could not be immediately verified. The development comes after cyber-risk intelligence firm Cyble on August 30 wrote in a blog post that "John Wick" was able to upload a backdoor/Adminer on Paytm Mall application/website. The group gained unrestricted access to the entire databases of Paytm Mall, Cyble said in the blog post. "According to the messages forwarded to us by the source, the perpetrator claimed the hack happened due to an insider at Paytm Mall. The claims, however, are unverified, but possible," Cyble said. Paytm Mall said that the claims are "absolutely false". "We would like to assure that all users, as well as company data, is completely safe and secure. We invest heavily in our data security, as you would expect," a Paytm Mall spokesperson said in a statement. "We have been investigating the claims of a possible hack and data breach, and haven't found any security lapses yet. "We also have a Bug Bounty programme, under which we reward responsible disclosure of any security risks. We extensively work with the security research community and safely resolve security anomalies," the spokesperson said. SEE ALSO: <a href="https://www.businessinsider.in/india/news/pm-modi-twitter-account-hacked-heres-what-the-hacker-had-tweeted/articleshow/77902203.cms">Twitter account of PM Modi's personal website hacked — asks followers for Bitcoin and Ethereum donations</a> <a href="https://www.businessinsider.in/tech/enterprise/news/rise-in-work-from-anywhere-will-lead-to-more-outsourcing-thats-an-opportunity-for-tcs-infosys-and-hcl-tech/articleshow/77864248.cms">TCS, Infosys and HCL Tech have the most to gain from post COVID wave of outsourcing</a> <a href="https://www.businessinsider.in/tech/apps/news/india-bans-pubg-wechat-and-118-other-mobile-applications/articleshow/77890776.cms">India bans PUBG, Ludo World, and 116 other Chinese mobile applications</a>

'John Wick' hacked PM Modi's Twitter handle to say they didn't hack Paytm Mall

When it comes to hacking, most of us think about a geek sitting infront of a super cool laptop and he can steal a lot of money from banks. It’s not entirely our fault that we think of it like that but we have grown up watching movies and this is what happens in them. Apart from such hackers there are hackers which are good people and go for ethical hacking or white caller hacking and recently, there demand has increased exponentially in India. 
 
White hat hackers, or ethical hackers, who scope out and report bugs in software are in high demand globally. Tech giants spends a hefty amount on bug-bounty programmes every year rewarding lone-wolf white hat hackers for finding weaknesses in their applications. Companies also specifically hire these hackers to probe their apps and websites. 
 The trend has hit India too and <keyword id="205343" type="PERSON" weightage="20" keywordseo="Shashank-Kumar">Shashank Kumar</keyword>, a second-year engineering student, has been swamped this winter break. As a freelance white hat hacker, he has been spending most of his vacation scanning payment applications and ecommerce websites for security vulnerabilities. 
 
"Indian companies have now woken up to cybersecurity," 22-year-old Kumar, who has been approached by several Indian firms post the government's recent demonetisation decision and embrace of cashless transactions, told ET. 
 
Kumar, who has signed nondisclosure agreements with these companies, says he has earned about Rs 1.2 lakh in the past two months alone. The spike in online transactions since November has put digital payment companies under severe scrutiny, with users and experts questioning their readiness against sophisticated cyberattacks. And what better approach to safeguard systems than to put them under attack by the good guys? 
 Another white hacker, <keyword id="4027565" type="UNKNOWN" weightage="20" keywordseo="prakhar-prasad">Prakhar Prasad</keyword>, is a student of computer application. During the past two months, he has been busy on assignments for big payment companies trying to worm his way into their payment gateways to find leaks. Prasad gets paid by the severity of the bug he discovers. A few companies also pay him on a monthly contract, in the range of $500 to $600 a month.Overall, he's made up to Rs 4 lakh since November. 
 
Prasad, now 22, has been participating in bug-bounty programmes since he was 16. But this is the first time he is working for Indian companies. 
 "Security is a new concept for Indian companies," Prasad, who has found bugs for <keyword id="6355629" type="CITY" weightage="20" keywordseo="Google">Google</keyword>, <keyword id="6354576" type="CITY" weightage="20" keywordseo="Facebook">Facebook</keyword>, Twitter and <keyword id="6357940" type="CITY" weightage="20" keywordseo="Paypal">PayPal</keyword>, among others, told ET. 
 
Indian online payment companies have been announcing various measures, including hiring ethical hackers, to beef up security against online frauds and attacks. 
 Globally, security platforms such as <keyword id="2464896" type="UNKNOWN" weightage="20" keywordseo="HackerOne">HackerOne</keyword> also facilitate bug-bounty programmes, connecting white hat hackers with companies. 
 In India, however, white hat hackers are discovered by virtue of their online profiles, says <keyword id="106130" type="PERSON" weightage="20" keywordseo="Anand-Prakash">Anand Prakash</keyword>, bug-bounty hunter who got famous for finding a vulnerability in Facebook and earning $15,000 for it. 
 
"In most cases, it is the chief technology officer or director of a company who emails you asking if you'd be interested in an assignment," Prakash, 24, who has taken up three assignments in the past two months, told ET

Post demonetisation, payment apps are turning to ethical hackers. Here’s why

<div class="KonaFilter image-container display-table float_right"><div><div class="image on-image">GettyImages/Manjunath Kiran</div></div></div>For about 72 hours, Anand Prakash had the ability to get into any Facebook account he pleased.Luckily Prakash, a hacker who lives in India, reported the scary vulnerability to Facebook directly in return for a $15,000 payout. In <a href="http://www.anandpraka.sh/2016/03/how-i-could-have-hacked-your-facebook.html">a blog post on Monday</a>, he outlined how he "could have hacked all Facebook accounts."Here's how he did it.When you forget your Facebook account password, you're able to request a reset by entering your email address or phone number on the social network's website. A 6-digit temporary login PIN is then sent to the email address or phone number you entered to let you reset the password.Prakash tried to keep guessing the temporary 6-digit PIN on Facebook's website, but he was blocked after 10-12 attempts. Then he tried the same thing on Facebook's beta site, which is used by developers to test apps on the platform.Because you can still log into any account on beta.facebook.com, Prakash tried to guess the 6-digit PIN and discovered that there was no max attempt number set like on Facebook's normal website. That allowed him to brute force hack the PIN by quickly entering every possible number combination on his computer."I tried to takeover my account (as per Facebook's policy you should not do any harm on any other users account) and was successful in setting new password for my account," he wrote on his blog. "I could then use the same password to login in the account."Prakash immediately reported his findings to Facebook and was awarded a $15,000 bounty for discovering the bug. It's common practice for major tech companies to pay bounties like that when hackers discover critical bugs and report them to the proper people."One of the most valuable benefits of bug bounty programs is the ability to find problems even before they reach production," A Facebook spokesperson told Tech Insider. "We're happy to recognize and reward Anand for his excellent report." <div class="margin-top"> <h3>NOW WATCH: <a href="http://www.businessinsider.com/facebook-emoji-reactions-like-love-haha-wow-angry-sad-2016-2">Facebook just made a massive change to its entire site</a></h3> <div> <div> <div class="ooyala-video-player" data-video-autoplay="false" data-video-id="o3NGo5MTE6UAi-4L12AeSCAprOnLqx9s" data-player-variable="ooyalapopvideo" id="ooyalaplayer_popvideo" style="width:1280px;height:720px"></div> </div> </div> </div>

You Searched For "india bug bounty" and got 13 results

Facebook pays ₹23.8 lakh to Indian security researcher for finding a bug

IANS

OYO to roll out comprehensive ethical hacking and bug bounty programs

PTI

Bug bounties attracting Indians like never before companies

BI India Bureau

Hacking Aarogya Setu can win you ₹1 lakh to ₹3 lakh through the Indian government’s ‘bug bounty’ programme

Prabhjote Gill

A 27-year-old Indian developer bags ₹75 lakh for reporting a critical flaw in ‘Sign in with Apple’

IANS

Facebook fixes bug that exposed Instagram users' personal information

IANS

Herd immunity in India is a terrible idea, says Harvard Professor

Preeti Soni

India's contact tracing app Aarogya Setu comes under the scanner again — three departments fail to explain their role in its development

Prabhjote Gill

One Plus has not disclosed how many users were affected by data breaches

Prabhjote Gill

Amid privacy concerns, Centre makes Aarogya Setu app open source

IANS

'John Wick' hacked PM Modi's Twitter handle to say they didn't hack Paytm Mall

IANS

Post demonetisation, payment apps are turning to ethical hackers. Here’s why

BI India Bureau

This hacker discovered a way break into any Facebook account

Alex Heath

Popular Keywords

Buying Guides