I could send any text message from Indian government IDs

[bellyfullofbac]

I like that in the middle of that, a wild "block-chain" appeared. Congrats to whichever consulting company managed to sell that bullshit to the government.

[the-dude]

I think the author went way over the line here and should probably retract ASAP for his own well being.

[pfortuny]

You are totally right. Hope he gets this thread and removes that page for ever (at least the details), he runs a serious risk.

[megous]

> You would likely believe it, given the sender ID, wouldn’t you?

No. I absolutely don't believe anyone unknown calling me, no matter who he claims to be, or what the CLIP says, unless I can call back to a public number of the institution he claims to represent. CLIP just isn't secure.

I choose to risk believing for non-essential things, because security is just not convenient. But banks, government, anything where there's well reported fraud going on regularly,... no way.

Calling back is also good, because outgoing calls are automatically recorded by my operator and sent to my email, so if I'm to enter into any agreement, it's better to do it on an outgoing call.

[eta-meson]

I absolutely agree with you. I would also do the same. Here I think the author meant not so tech savy normal people.

[woliveirajr]

> Essentially, anyone can’t send arbitrary messages using the above-mentioned loophole anymore. TRAI’s new system fixed that loophole. > One can still send any message that fits in the template. But this largely restricts the possibilities of scams and misuse.

Seems to be fixed and that it was fixed during the time he did _nothing_ and just waited. Perhaps there was a responsible disclosure but he didn't said how he did it.

[canadianfella]

*Say

[fareesh]

Brave post - the government has jailed people for far less

[tinus_hn]

Brave? Or dumb? Using someone else’s credentials is against the law in most jurisdictions.

[yeshok]

It appears that he got the credentials from github, and this was critical for his exploit to work.

[Aeolun]

If he could find 30+ instances before he just gave up I’m not sure if we can count that as a significant barrier.

[jeswin]

And I hope he disclosed it responsibly.

[mschuster91]

The Indian Government should have asked Github for their "Secret Scanning" service (https://docs.github.com/en/code-security/secret-security/abo...).

That would have prevented the author just randomly stumbling on the credentials.

[garaetjjte]

>These Sender IDs are reserved by companies and government organisations. Receiving a message from these Sender IDs is meant to be authentic.

No, it's not. Caller ID is not authenticated and shouldn't be depended for anything sensitive.

[jaytaylor]

Archive link, in case there is a takedown: https://archive.is/iKzjh

[swiley]

Shared secret authentication is pretty much always a bad idea. I'm continually shocked people still use it.

[asaddhamani]

So what is the better option according to you?

[privacyking]

You don't need to hack their website to do this. SMS spoofing has been possible for decades and still is.

[zenexer]

SMS works a little differently in India; it’s more difficult to spoof the IDs the author is discussing.

[belatw]

He should use this to tell everybody in India to stay hime, wear masks and stop going to mass worship ceremonies that are causing this devastating covid spike.

[BiteCode_dev]

See also: mega churches in the US.

[2Gkashmiri]

meh. i tried to use it, i got the credentials alright but seems my POST skills with jsfiddle are ancient now, couldnt get it up and running.