Top
Best
New

Posted by qtqtqt 1 day ago

Hardcoded credentials and other issues in Tata Motors App(www.cert-in.org.in)
87 points | 19 comments
qtqtqt 1 day ago|
Tata says the issue has been fixed and there were no leaks: https://auto.timesofindia.com/news/cars/tata-motors-says-ira...
AdamN 1 day ago|
The problem is that hardcoded credentials is such a bad smell that we can be confident that the code quality is extremely poor.
navigate8310 1 day ago|||
tbh, you can't expect much from them in general
tyrabound 1 day ago||||
[flagged]
tomhow 12 hours ago|||
We've banned this account. Please stop registering accounts to break the guidelines with. It's such a pointless waste of everyone's time. Find something useful to do, really.
ActionHank 1 day ago|||
"Nah it's fine our engineers now keep them in config files now."
tpowell 1 day ago||
I feel like I just got a telegram... love the website.
qtqtqt 1 day ago|
If you want to have more fun, visit the homepage (https://cert-in.org.in/), navigate to the Latest Security Alert section, and right click on any link. The context menu won't show up. If you click on the link and visit the page, your browser's address bar won't change. This happens only if JavaScript is enabled.
axegon_ 1 day ago||
Though I have been critical of LLMs in general, I have to give them credit for being really good digging out stuff that me as a human would find tedious. As such, I have my own LOCAL clanker that I use for two things: as a rubber duck and dump an apk with apktool inside a locked up container and let it go nuts. I've done it on numerous popular apps and it has found countless hardcoded credentials and keys in them. Just about all apps really, so far I think there's only been one that hasn't had THIS particular problem(it did have countless others though).
monster_truck 1 day ago||
As the person who had to rush out an update to MyFordMobile because some enterprising windows phone nerd ganked the hardcoded creds out of their Android app to build a winphone app that allowed you to authenticate against their backend and remotely start/unlock your car, which they _really_ did not like...

Many such cases. And no, I was not the one who did that in the first place

hecturchi 1 day ago||
The developers have probably surrendered their identities and the apps got reviewed, verified, and can be distributed to end users via official stores, so it can't be so bad because they keep users safe.

Funny that the verification step doesn't include scanning for hard coded credentials though. How do they detect malware if they don't decompile?

Titan2189 1 day ago||
Page doesn't load for me
dspillett 1 day ago|
Come on, you can file a better problem report than that. “Doesn't load” can cover a great many issues: link not valid at all (NXDOMAIN, 404), some sort of error from the server (404, 401, 500, 200 but with error in arbitrary text), no connection, looped redirects, …

The best you'll get from just saying “doesn't work for me” is people like me saying “its fine here”, like so: it is working fine for me from here.

denysvitali 1 day ago|||
Times out after the TLS handshake.

https://pastebin.com/raw/mncT5drA

qtqtqt 1 day ago||
Looks like curl doesn't work (same command, same error) but Firefox does.
denysvitali 1 day ago||
Seems like the usual poor JA3 filtering. I use a fork of Chromium on Android and it still doesn't load
ktm5j 1 day ago||||
This isn't really the place to file any kind of report.. saying the page doesn't load is a perfectly valid comment IMO.
muragekibicho 1 day ago|||
The link is clicked but I remain here on Hacker News. It's not loading, like, it's not taking me to the website.
richbell 1 day ago|
Par for the course.

https://eaton-works.com/2025/10/28/tata-motors-hack/