HN Explorer

Parth Anand – Projectsadak.in Hacked

2 points by gobountyhunter ↗ HN
Project Sadak (projectsadak.in) has been hacked.

The entire public report layer was deleted. Every pothole report appears to be gone

The founder is yet to reply. He also claims to conduct research at MIT, which makes this Firestore security failure especially painful to watch.

5 comments

[ 1.3 ms ] story [ 17.8 ms ] thread
gobountyhunter
UPDATE: emailed the founder, which is completely legal since I didn't want the site to be further attacked. The founder shows reluctance to cooperate and has issued a notice on the site (firebase quota expired) to hide the vulnerability without fixing it

the data currently sitting in the database is fully accessible to any third party and includes GPS coordinates, photo evidence, device identifiers, and behavioral records tied to every submission. Citizens are submitting under the belief that their data is protected and anonymous. It is neither right now.

This is also a potential breach of India's Digital Personal Data Protection Act, 2023 (DPDPA), as user-submitted location and photographic data is being stored without adequate technical safeguards.

I have a complete technical report documenting everything. I have not modified or exfiltrated any real user data. I'm reaching out before this goes any further. i am also asking for a public disclosure of the breach to the platforms users

gobountyhunter
I am an ethical hacker - who gets platforms secure before unauthorized access and attackers can make changes and affect the platform - I have no affiliation with any organization nor with Parth Anand. I will maintain updates in this thread on hacker news.

best

gobountyhunter
Update: The founder is straight up ignoring me, so I'm going to publish the exact vulnerabilities I found in hopes that they have been patched. I have allowed at least 24 hours for remediation.