15 ms·

Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

502 points by orf 4y ago

Exuma 4y ago
Lol, I love how he just opted to delete it. Great on ya for having some balls instead of walking on eggshells like most of these security back and forth dialogues.
- SV_BubbleTime 4y ago
  Reading the recent posts about an Android bug and how difficult it was for the researcher to get them to fix and how he was reluctant to disclose or even threaten to disclose reminds me of a time gone past of… harder… type of hackers. It’s like the completely backwards on the wrong foot.
  - viraptor 4y ago
    In good old days you could do a lot without some massive Corp dragging you to court. Are you willing to risk years of self-funded courtroom process which may not turn out well for you, just to show how hard you are as a hacker? I don't think so. We know of cases where even reporting an issue caused lawyers to threaten you without any upside otherwise.
    - SV_BubbleTime 4y ago
      Yea… but I guess I’m from a time that you wouldn’t do any of this under your real name.
crossroadsguy 4y ago
Every taxpayer in India is dealing with Infosys as of today. After years of delays and fucks up you still see texts like “xyzObj.ststus.label” right in the tax portal when you’ve logged in to check your tax return status.
Ava4312 4y ago
dcdc123 4y ago
Their entire cybersecurity page is just a bunch of gibberish. It's like someone slapped together buzzwords and phrases until they filled a word count.
- ununoctium87 4y ago
  Probably GPT-3 generated...
- zikduruqe 4y ago
  Corporate Ipsum. https://cipsum.com https://cipsum.com
- lob_it 4y ago
  - lob_it 4y ago
    Oh gosh... TCP/IP is a resilient protocol and would route around any countr(y/ies) opting for modern standards. The world would continue to spin. I didn't say "puppy mill" regarding infosys... So.... Its just another puppy mill :) https://en.m.wikipedia.org/wiki/Puppy_mill https://en.m.wikipedia.org/wiki/Puppy_mill As you were :p
- lob_it 4y ago
  They could always segment networks to satisfy modern goals :) And puppy mills explain the aptitude with some company cultures :p https://en.m.wikipedia.org/wiki/Puppy_mill https://en.m.wikipedia.org/wiki/Puppy_mill
ticviking 4y ago
I really wish this surprised me. The number of people who completely understand the stack they are working on is shrinking, even as the size of the stack grows. The power of computing is such that every organization on the planet is forced to lower the bar to get people who are marginally competent, even if they lack attention detail and cannot be relied on to solve problems of this sort. This kind of leak is the result.
- pipeline_peak 4y ago
  In a world where all the problems are wrapped in containers and ever increasing bloat, it takes a lot of discipline to understand the stack, if that’s even the proper term anymore.
  - ticviking 4y ago
    Even just understanding "the stack" if you're using a cheap Linux VM and admining it directly is a heavy lift for most devs.
- andrewxdiamond 4y ago
  I don’t think there are any people who understand the full stack. I don’t think anyone like that has existed in computing in a very long time. It’s truly impossible for a single human to actually understand the physics of electronics, the world of CPU micro-architecture, packet shuffling network equipment, the nuance of CSS, and the never ending complexity of UI/UX design. The only way this statement could be accurate is if you arbitrarily start cutting parts of the “stack” out.
  - userbinator 4y ago
    If "full stack" means electronics up to JS, then there are probably quite a few people who can work at all those levels. Although a minority, at least they can understand a "fuller" stack than most, unfortunately.
  - dwheeler 4y ago
    I disagree, it takes lots of time but it is possible. Personal example: I have an electronics engineering degree that was 1 semester short of a physics degree, so I learned quantum mechanics, electromagnetic field theory, transistors, and how to create a CPU (I even created a CPU out of simple gates and way too much wire wrapping). I love computer software, so I learned assembly, how to write compilers and operating systems, and libraries. I have configured network hardware and written network software at various levels. I've also used CSS and implemented UI/UX. I've written code in many programming languages, including JavaScript, Python, C, C++, Java, Ruby, Rust, Common Lisp, and Scheme. I eventually got a Computer Science degree as well. None of these things are magic, and the info is relatively easy to get. You simply have to keep learning and be willing to try new things. It can be fun, too. Yes, today it can be helpful to specialize at any particular time in your life. But I think it's best to use that as a launching pad to branch out.
neathack 4y ago
When do companies finally start adopting the `security.txt` proposal (see https://securitytxt.org https://securitytxt.org). Would have made a big difference! EDIT: That GitHub user is gone for good.
- Akronymus 4y ago
  That site is quite ironic. https://securitytxt.org/security.txt https://securitytxt.org/security.txt 404's As does https://securitytxt.org/well-known/security.txt https://securitytxt.org/well-known/security.txt nvm, I missed a '.' https://securitytxt.org/.well-known/security.txt https://securitytxt.org/.well-known/security.txt
- deadbunny 4y ago
  I'd really like to see a bugs.txt as well. The amount of large sites I have repeatable bugs on with no way to report the is frustrating.
avg_dev 4y ago
Wow. Really crazy. I know it was not right to revoke the key, he touched into their system. He probably broke someone’s production. But it was also absolutely the right thing to do. A god mode key floating around for over a year unrevoked, with real human beings’s medical data on the other side… I am glad the post author revoked the key. It is probably too little too late but they did close that door and maybe saved someone some pain: not the negligent development team, but a real patient and human being, perhaps many of them.
- fragmede 4y ago
  The lesson here is that there are things worse than downtime. Yeah the site being down is bad but hey, what's worse? Leaking PII all over the place.
  - orf 4y ago
    I tried to highlight this in the post, but the key is a personal user one tied to an email, and the worst that I expect would happen would be that some training scripts break. If this was a production key or something that seemed like it would cause financial harm/downtime, I would have never deleted it.
    - OJFord 4y ago
      Honestly, with this level of competence I wouldn't be surprised if the same admin user credentials were used in application/lambda processor/whatever there is. Not at all saying you shouldn't have done it though!
  - 0xbadcafebee 4y ago
    Even worse: PHI.
  - lmm 4y ago
    Sadly, if you measure "worse" in selfish financial terms, the site being down is probably worse for you.
- 4y ago
deleted 4y ago
[deleted]
lzooz 4y ago
- skullone 4y ago
  About as useful and informative as the output from any Infosys contractor. Did you do that on purpose?
- COMMENT___ 4y ago
  Yeah, that's an excerpt from Wikipedia. But when I see these lines I actually read "money laundering" and "scam".
  - COMMENT___ 4y ago
    Answer by GPT-3: > How is information security in Infosys? Information security at Infosys is implemented through a combination of technological and organizational measures. The company has a dedicated information security team that works to identify and mitigate risks. Technologies used to protect data include encryption, firewalls, and intrusion detection systems. Organizational measures include employee training on security policies and procedures.
    - another_devy 4y ago
      > teams that works to identify and mitigate risks Complete failure by team to not see super user permission as risks > intrusion detection… Clearly the did not implement AWS CloudTrail threat detection otherwise when op accessed the account it should have raised alarms, so its just plain lie > …training on security policy So the GitHub user probably skipped those considering them boring. And instead of reporting their own failure chose sneaky way to make it go away hoping no one will notice
      - COMMENT___ 4y ago
        I believe that the OP of this comment thread has been unfairly downvoted. It was irony, right? Sigh.
precompute 4y ago
> To put it bluntly, I’m not sure I trusted Infosys to revoke this key in a timely manner. So I did it for them with aws iam delete-access-key --access-key-id=$AWS_ACCESS_KEY_ID, and now the key is useless: Hilarious. Infosys is a known "mass recruiter" in indian colleges. WITCH (Wipro, Infosys, TCS, Cognizant, HCL) companies is where talent goes to die. No competent employee stays in those companies (from what I've witnessed). Wouldn't be surprised if this turns out to be just the tip of the iceberg, because putting people with 6-12 months of programming / computer "experience" (that they only signed up for because of the money) in charge of major production systems is a recipe for disaster.
- smcl 4y ago
  > Cognizant Someone hired those clowns as contractors as extra in a previous job, to loud protests from our development team. They produced what was quite possibly the most chaotic, copy-paste, typo-laden code I have ever seen in my life.
  - 0xmohit 4y ago
    This is hardly surprising. Most of them would be completely clueless about the code they've "written".
- foreggs5 4y ago
- drcross 4y ago
  >No competent employee stays in those companies Absolutely true from first hand experience. Imagine being a top performer doing great work for a company whose managers insist on wasting your time putting you into needless meetings getting you to explain how you're doing everything all through badly communicated text with typos and misspellings.
  - rodgerd 4y ago
loophr 4y ago
[dead]
- 988747 4y ago
  Well, if they choose Infosys as a company to implement CBDC then at least we are safe for the next 20+ years, because there's no way they complete the project before that time :)
- astrange 4y ago
  Governments already observe most every financial transaction, either because they run the money transmission system (ACH/FedWire/etc), or because countries with VAT send every invoice to the tax office. It's not clear how a CBDC is actually different from the current system, but insofar as it isn't different, it's not less private.
- cuteboy19 4y ago
  The Indian cdbc is being developed in-house by the RBI afiak
1024core 4y ago
Is it possible to do a full sweep across all tokens in all Python files (for instance) in Github and find such keys? Can you tell from the contents if it's a key or some such "important" string?
- vimda 4y ago
  GitHub already offers this - they scan all the code that gets uploaded to look for keys. I think the issue here is that the code wasn't on public GitHub, but the artifacts were uploaded to PyPi
- MarkMarine 4y ago
  Yep, and if you don't look for them, you can be darn sure someone else is looking for them. I heard about an incident from a friend where a GitHub repo was created accidentally public (ran out of private repos and I guess the failure mode back in the day was just make it public) and that repo had developer level access keys in it. Some enterprising fellow was scanning public repos for this, grabbed the keys, opened thousands and thousands of the biggest GPU machines they could get on AWS and started mining bitcoins. They were nice enough not to delete production to make room for more bitcoin miners.
  - TheFlyingFish 4y ago
    That's not nice, that's just smart. Delete production, and someone will notice right away. Leave production as it is, and they might not notice until the bill comes due.
  - PubliusMI 4y ago
- 0xbadcafebee 4y ago
  The keys here were actually in the published package, not in GitHub, as it seems it was published by accident. Here[1] are the prefixes used for all AWS IAM access keys. Here[2] is the API definition for an access key. If you're going to search all of PyPy for keys, here's some more keys you can look for: [3] [4] [1] https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-prefixes https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_i... [2] https://docs.aws.amazon.com/IAM/latest/APIReference/API_AccessKey.html https://docs.aws.amazon.com/IAM/latest/APIReference/API_Acce... [3] https://github.com/Josue87/GiveMeSecrets/blob/master/rules.py#L6-L25 https://github.com/Josue87/GiveMeSecrets/blob/master/rules.p... [4] https://github.com/BitTheByte/Eagle/blob/master/plugins/spider.py#L23-L49 https://github.com/BitTheByte/Eagle/blob/master/plugins/spid...
jaywalk 4y ago
Many years ago, I did some consulting work on a project that had been "delivered" by Infosys. It was, to put it lightly, a complete and utter mess in every way. Just from a security vulnerability standpoint, it had: SQL injection, plaintext passwords for user accounts, zero protection against URL manipulation, etc. And those are just the ones that come to mind immediately. Glad to see nothing has changed.
volleygman180 4y ago
Beautiful disaster
stuaxo 4y ago
Infosys, the UK prime ministers wife's families company.
COMMENT___ 4y ago
This kind of stories is one of the reason I visit Hacker News. Thank you! It's funny and annoying to read every week or so about another epic fail of a multi-billion "multinational information technology company". Good luck with outsourcing your critical services and medical data to neurodivergents. Thanks again for making my day.
- dekhn 4y ago
  I recommend the RISKS mailing list. https://seclists.org/risks/ https://seclists.org/risks/ But note that they sometimes take reliability too far.
  - COMMENT___ 4y ago
    Oh, this is great! Thank you. PS Good old usenet. :)
- throwaway5874 4y ago
  Not outsourcing, its incompetent engineers. Do you know how many american companies got hacked because of 200k enginners istakes? Still some american banks store user passwords in plain text, Allow sim awapping without a proper check and so
  - COMMENT___ 4y ago
    Yep, I guess you are right. But I think that some of those engineers come from Infosys-like companies, so they do exactly what they’ve been taught and what they are accustomed with. IDK, maybe it’s a cultural problem? Or is it a problem of following best security practices? I understand that it’s useless to seek answers to such questions. Let’s leave it to philosophers. :)
- notRobot 4y ago
  > neurodivergents Can you please explain this?
  - 4y ago
honestduane 4y ago
Infosys is long known to be incompetent as an organization among people who have experienced their brand of greed and labor fraud; I highly recommend you avoid them as much as possible.
zaptheimpaler 4y ago
In a world filled with more competence and less corruption, Infosys would have gone bankrupt 20 years ago. But here we are with Wipro, Infosys, TCS etc. all chugging along.
- belter 4y ago
  TCS -> US$25 billion Revenue in 2022 InfoSys-> US$16 billion Revenue in 2022 Wipro -> US$10 billion Revenue in 2022 I want to get out of this Universe and get into one that makes sense...
  - ramraj07 4y ago
    This universe makes perfect sense, you just don’t want to accept underlying equations is all.
  - zaptheimpaler 4y ago
    I think the coming recession will help that along ;) There's going to be less fraud and we'll find out who's been "swimming naked" when the tide goes out as Mr. Buffett likes to say. Like FTX..
- roncesvalles 4y ago
  I don't believe software development is their bread and butter. Traditionally these companies are known as "systems integrators" which basically means they have armies of people who have RTFM for popular enterprise software products and will provide you with bodies who sit in your office and install or provide support for the product.
another_devy 4y ago
The GitHub user instead of reporting incident to their security team chose to take sneaky approach to remove the keys fearing the actions from company. They will be fired and instead of retrospectively improving the security Infosys will ban all OSS contributions from their developers.
- deleted 4y ago
  [deleted]
- p0rkbelly 4y ago
  You assume they have a security team :)
  - ramraj07 4y ago
    They will have ten security teams at the minimum. You assume that their teams know what security means though :)
    - jp0d 4y ago
      This is an accurate assessment. Having worked for companies similar to Infosys, I can confirm this.
- ev1 4y ago
  > Infosys will ban all OSS contributions from their developers. Sounds... good to me?
axpy906 4y ago
Wow. Just wow. Not going to even unpack the levels of ineptitude this went down.
kryptozinc 4y ago
- dang 4y ago
  Can you please stop posting unsubstantive and flamebait comments and otherwise breaking the HN guidelines? You've been doing it repeatedly, unfortunately, and we have to ban such accounts. If other people are wrong or you feel they are, you're of course you're welcome to post substantive comments explaining why. Other users in this thread have modeled that quite nicely: e.g. https://news.ycombinator.com/item?id=33635659 https://news.ycombinator.com/item?id=33635659. But snark, name-calling, and swipes are not ok—they're not what this site is for, and destroy what it is for. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
29athrowaway 4y ago
Infosys = if "I have a friend that does it cheaper" was a company
deleted 4y ago
[deleted]
oregano 4y ago
I applaud any bad press on InfoSys. I picked up contract gig through them a few years ago. Here are some of the takeaways from my short lived experience: - It took them over two weeks to send me a computer. - They cancelled PTO for everyone. (this was the most egregious single thing they did) - They had absolute worst internal site for accessing HR documents and accessing personal resources. Just a maze of links. You could only access it via Internet Explorer (I swear I'm not joking). Everything took forever to load. It was like stepping back into 1997. - When I gave my 2 week notice, they refused and said I 'owed' them at least a month. LOL not sure how they think they can control people like that. I gleefully told them to 'deal with it'. This happened about 45 days after I started as it became obvious very quickly how bad this company treats people.
- chsreekar 4y ago
  was in a client position (Infosys was contracting for the companied I worked for). Absolute worst processes in the world. At one point they blocked legit dev domains in their firewall and took 3 weeks to unblock a mongo db after vehement protests. DON'T touch Infosys with a 100ft pole
- curiousgal 4y ago
  > You could only access it via Internet Explorer (I swear I'm not joking). That has been in the case in most investment banks as well.
- sofixa 4y ago
  > When I gave my 2 week notice, they refused and said I 'owed' them at least a month. LOL not sure how they think they can control people like that To be fair, in many countries (probably most developed ones) there are regulated mandatory min and max notice periods. E.g. in France the standard is 1 to 3 months, negotiable of course.
sasas 4y ago
When attempting to look at the git pull request files changed details [1], Github returns a server error. Any ideas why? [1] https://github.com/orf/pypi-data/pull/2/files https://github.com/orf/pypi-data/pull/2/files
- benburwell 4y ago
  The article mentions a takedown notice they received from GitHub instructing them on how to remove certain content from their repo. I'm guessing maybe this PR contains some of that content they were asked to remove, and there's a bug in GitHub when rendering a pull request page that references deleted content?
- mdaniel 4y ago
  Unknown, but all(?) GH PRs respond to ".patch" on the end of the PR: https://github.com/orf/pypi-data/pull/2.patch https://github.com/orf/pypi-data/pull/2.patch which redirects to https://patch-diff.githubusercontent.com/raw/orf/pypi-data/pull/2.patch https://patch-diff.githubusercontent.com/raw/orf/pypi-data/p...
heleninboodler 4y ago
Interesting that pull requests 1 and 2 on that repo cause a 500 error when I try to view their diffs. Is this due to action on github's part to try to suppress displaying of the keys?
0xbadcafebee 4y ago
> Johns_Hopkins_Hospital/Input/Excel/Covid_patientdetails/covid_patient_details.xlsx Should I file the HIPAA complaint, or has someone else already done that? (the stupid government website for filing complaints is, of course, not loading for me now)
- livinginfear 4y ago
  I feel a very satisfactory kind of schadenfreude at the idea of you filing this HIPAA complaint.
- bad416f1f5a2 4y ago
  Pro tip: https://www.hopkinsmedicine.org/institutional_review_board/hipaa_research/contact.html https://www.hopkinsmedicine.org/institutional_review_board/h... The breach notification to HHS typically comes from the covered entity. They often have the information on exactly what PHI was out there, how many individuals were impacted, and can provide the right info to HHS. And with my experience in healthcare IT, I can say privacy and compliance officers take reports like this incredibly seriously. Those might not be the right people but getting an email to compliance folks inside the covered entity and saying “here’s a likely breach” will absolutely get the ball rolling.
livinginfear 4y ago
I've worked extensively with employees from these Indian labor companies throughout my career as a software-engineer. Many of my positions have implicitly been just to ensure that these developers can't do too much damage. For a long time I despaired about the poor quality of software these contractors would create, and wished there was some kind of justice for the companies that employ these bodyshops. Then I realised, this is how that justice happens. There's been a string of these high profile security incidents over the last few years caused by contractors from these labor companies.
buildbot 4y ago
Why does Infosys get access to HIPAA data (including copying it to their own storage!) to train AI models? That seems like another large story.
- p0rkbelly 4y ago
  They could have been doing this on behalf of a paying customer. They will sell anything with our without having any expertise. "Pay us, bring your data, and we will do the AI for you and help you". They have case studies on it I suppose: https://www.infosys.com/industries/financial-services/case-studies/leveraging-actionable-insights.html https://www.infosys.com/industries/financial-services/case-s...
iamgopal 4y ago
One of my friend worked on WITCH’s treasury software used internally by government, from which millions of USD transactions happen on daily basis. Since remote access to server was not allowed, he used to use his personal USB drive to copy code from his personal laptop to the mainframe server on daily basis. With both being full of viruses.
p0rkbelly 4y ago
PSA: In exposures like this, Contact the cloud provider too. They tend to have the right contacts for customers. And I'm guessing there are actions they can take as well.
- throwawaaarrgh 4y ago
  Yeah, you have to digitally sign a Business Associate Addemdum in your AWS account to handle HIPAA data in it. If they didnt, they're double screwed
CaliforniaKarl 4y ago
I notice the author is in London. For people in the US, my suggestion is to go instead to https://www.cisa.gov/report https://www.cisa.gov/report to report things like this. Especially when you're dealing with a company that doesn't have a clear vulnerability-disclosure process, or if you have _any_ concern about your own safety (physical, legal, etc.) when making a report. Personally, I would have stopped right before "The Cleanup", and made a report. Which option would I choose from https://www.cisa.gov/report https://www.cisa.gov/report? None of them stand out, so I would have chosen the last option, to send an email.
0xmohit 4y ago
The Indian government has, over the years, awarded contracts worth billions of dollars to Infosys for projects like the Goods and Service Tax portal, Income Tax portal. In all these cases, the implementations are slow and super buggy. Deadlines to deliver are routinely missed. In an ideal world, these companies should not be allowed to exist.
- cuteboy19 4y ago
  It is much better than before now. And it's also better than most govt websites.
- ramraj07 4y ago
  Now, the interesting this is the recent complete refactor of the country’s income tax portal. It was messy, but I feel it was heavenly compared to the clusterF that was healthcare.gov. So what are your thoughts on this being a WITCH specific problem?
  - throwawayxx123 4y ago
    It was fixed because a govt minister threatened them with jail time in the end. That set them straight and they fixed the monstrosity to save their ass. Can't reveal more details.
    - ramraj07 4y ago
      That’s interesting to know, thanks lol. That’s the interesting part about corruption in india, in some screwed up way, it’s more “fair” than corruption in the US I think?
- morbidious 4y ago
  You seem to be suffering from inferiority complex issues. Please fix your own thinking's buggy implementation before commenting about others.
commanderjroc 4y ago
I am so glad I did not pursue a job with them out of college, infosys that is. I told them I was no longer interested and they kept calling my parent's house and even tried recruiting my sister who was in HS. How they go about stuff with that felt so weird, cause I would never get the same recruiter, makes sense they would do something like this.
diogenescynic 4y ago
If you've ever used a third-party outsourcing company like Infosys, Tata, Cognizant, or whoever you know you get literally nothing of value back for what you pay. Unfortunately, it's usually a cost-cutting movie that executives love and defers the pain to another day and creates another mess for someone else to deal with.
arvindamirtaa 4y ago
And to think they manage so many critical infrastructure projects (tax, passports, etc) in India and abroad.
basha94 4y ago
Can't help but be annoyed by the flock of pretentious hackers painting every Infosys/TCS employee with a broad brush. One might say this particular leak is bad on part of Infosys and they must be held accountable for this. But calling the entire company incompetent is just lazy and stupid. They make more than $3B in free cash flow, they are worth more than $80B in market-cap and they gainfully employ more than 100k people. Folks commenting here about the "competency" of a company should realize this. Most of their clients are based in US and UK. These companies have been using Infosys' services for decades and also have locked in deals for the coming decade. If a company was really that incompetent, it really wouldn't be on the scale they are today. You might call them a "boring services company" but they matter a great deal to a lot of people. Less pretension, more focus on "value", please? :)
- basha94 4y ago
  For those who are downvoting me, would love to hear your take instead of a salty downvote. All numbers in my post are factually correct.
  - mindentropy 4y ago
    I don't understand why you are being down voted. I disagree with you that they provide quality though. They don't. It is also the case that the company that hires them provide any quality. All are in it for making money with lowest spend and quality that they can get by. Very few obsess over quality and ones that do are vertically integrated to control quality in each step of the process. Very few American companies are like this. The engineers who complain here don't have any influence in the decision making or otherwise they wouldn't be crying and complaining here.
    - basha94 4y ago
      The engineers here need to understand the world doesn't function well if everyone waited for 100% quality before shipping something. Business trumps Engineering always. And I say this as an engineer myself.
  - 4y ago
bluesmoon 4y ago
In 1999, I was an intern at a company in India. We wanted to put a machine in a datacenter, and the datacenter admin asked us to set the Administrator password to "password". Turns out that all the other companies that put their boxes in that datacenter did the same. Infosys was one of those companies. I wrote more about it here: https://tech.bluesmoon.info/2017/04/a-tale-of-datacenter-security.html https://tech.bluesmoon.info/2017/04/a-tale-of-datacenter-sec...
- belter 4y ago
  Epic! Hope you don't mind my quote here. I enjoyed it :-) "...I glanced over at the other boxes, and they all had stickers on them saying "Administrator/password"...The three of us from TSPL looked at each other, and our president told me to decide. I asked the datacenter guy why he needed that. He said that sometimes they need to shutdown the boxes so they can move them to a different power strip. I asked him if it would be sufficient to give him an account that only had local access and could only reboot the box. He thought about it for a bit and said yes... So I created a new account that required a physically attached keyboard for login, and all it had was the ability to reboot the box. Our app was set up to start up automatically on boot, so we weren't worried about someone having to start it. DC guy physically locked the box to a rack, showed us that he was keeping they key, and we headed back to the office... ...We now needed to test our setup, so we asked everyone in the office to let us use the internet connection. We tried accessing our app, and it worked!... ...Since I had Admin access to our box, I was also able to open the "Network Neighbourhood" of our box in the datacenter. On that network, I saw all the other hosts that were in the datacenter. They had names identifying them from India's largest IT companies. These were companies I'd initially though of interning at...I looked at our president and grinned, and he looked back and said, "Send me a safe summary report when you're done" and walked off to his office. I double clicked on one of the other big boxes and was prompted for a username and password to connect to it... You can probably guess what happened next ;)..."
6Az4Mj4D 4y ago
Passing from college, I joined WITCH company and worked there for 2 years. A lot depends on seniors and guidance that team members provided and off course personal zeal to learn and learn every day.
nell 4y ago
This thread is full of generalized insults at a million people based on where they work. If someone did the same based on a different attribute of a population, they'd be banned. I've worked at one of these companies but left over a decade ago. I know how we're looked at when we do client work (part of why I left). Some of my colleagues were less competent, true. But, some will wipe the floor with the client employees we did the work for. To WITCH employees: If you are an employee at one of these companies, remember you are not the worst. Many of you come from humble backgrounds and are just learning the ropes. The world is cruel. It is a tough place, and you will be discriminated against. This is your fuel. You've already made great strides; keep going. You have to.
- mindentropy 4y ago
  The funny part is WITCH is propped up by these very companies complaining because they themselves are least bothered about quality. I have seen many executives in suit and tie visit them, get treated like royalty and shake their heads and talk bullshit. I always used to wonder how can someone be so stupid repeatedly but then I learnt along the way that engineer's opinions hold very little value in the way of making money at the lowest cost and quality possible that they can get by.
- willcipriano 4y ago
  I don't see this as a India problem, it's really an incentive problem. In my experience the further you get from the money, the less of a shit people give. At a 5 person start up the result of any effort you put in is considerably more noticable, you don't have to share the credit of a innovation with a thicket of business analysts, scrum masters, executive vice presidents, etc. In that type of environment people tend to put more effort in as generally a sizeable portion of the rewards for that effort will find it's way to them. (Side note: this has changed with the innovation of Hollywood accounting[0] for start ups, and the number of truly innovative start ups has also seemingly declined) Now think of a large company. The rewards tend to be nearly entirely rank based. You are a Software Engineer III, that pays between $x and $y, if you want a promotion you'll need to change fields into management. Perhaps a really bright idea or large effort will result in a small bonus, so you still have some reason to put effort in but probably won't go crazy. Now go one step further, you are a employee of a 3rd party firm working for a large corporation. A big part of the firm's value prop is that they are cheap, as in they demand less of the reward for effort, they share a small portion of that with you but also have their own thicket of business analysts, scrum masters... you get the point. At that point honestly why bother? You have so many middle men between you and the results of your efforts that it's very unlikely that you'll ever see any meaningful reward. Just do what it takes to not get fired. [0]https://en.m.wikipedia.org/wiki/Hollywood_accounting https://en.m.wikipedia.org/wiki/Hollywood_accounting
yrgulation 4y ago
And to think Infosys is slowly creeping into the uk contract market. You cant make this up.
ilrwbwrkhv 4y ago
Anyone who has Infosys (or the other witchy companies) on their resume is an instant no-hire on my books.
- duckydude20 4y ago
rxyz 4y ago
I know a person that works as a "Cybersecurity consultant" at Infosys. Mind you, not in India. She got hired as an intern with no degree, after a few months of game testing experience and some Udemy courses. Then, got promoted after less than a year and her salary doubled. Good for her, but she openly admitted to me her best skill is Powerpoint presentations

502 points by orf 4y ago

Lol, I love how he just opted to delete it. Great on ya for having some balls instead of walking on eggshells like most of these security back and forth dialogues.

SV_BubbleTime 4y ago
Reading the recent posts about an Android bug and how difficult it was for the researcher to get them to fix and how he was reluctant to disclose or even threaten to disclose reminds me of a time gone past of… harder… type of hackers. It’s like the completely backwards on the wrong foot.
- viraptor 4y ago
  In good old days you could do a lot without some massive Corp dragging you to court. Are you willing to risk years of self-funded courtroom process which may not turn out well for you, just to show how hard you are as a hacker? I don't think so. We know of cases where even reporting an issue caused lawyers to threaten you without any upside otherwise.
  - SV_BubbleTime 4y ago
    Yea… but I guess I’m from a time that you wouldn’t do any of this under your real name.

crossroadsguy 4y ago

Every taxpayer in India is dealing with Infosys as of today. After years of delays and fucks up you still see texts like “xyzObj.ststus.label” right in the tax portal when you’ve logged in to check your tax return status.

Ava4312 4y ago

dcdc123 4y ago

Their entire cybersecurity page is just a bunch of gibberish. It's like someone slapped together buzzwords and phrases until they filled a word count.

ununoctium87 4y ago
Probably GPT-3 generated...
zikduruqe 4y ago
Corporate Ipsum. https://cipsum.com https://cipsum.com
lob_it 4y ago
- lob_it 4y ago
  Oh gosh... TCP/IP is a resilient protocol and would route around any countr(y/ies) opting for modern standards. The world would continue to spin. I didn't say "puppy mill" regarding infosys... So.... Its just another puppy mill :) https://en.m.wikipedia.org/wiki/Puppy_mill https://en.m.wikipedia.org/wiki/Puppy_mill As you were :p
lob_it 4y ago
They could always segment networks to satisfy modern goals :) And puppy mills explain the aptitude with some company cultures :p https://en.m.wikipedia.org/wiki/Puppy_mill https://en.m.wikipedia.org/wiki/Puppy_mill

ticviking 4y ago

I really wish this surprised me. The number of people who completely understand the stack they are working on is shrinking, even as the size of the stack grows. The power of computing is such that every organization on the planet is forced to lower the bar to get people who are marginally competent, even if they lack attention detail and cannot be relied on to solve problems of this sort. This kind of leak is the result.

pipeline_peak 4y ago
In a world where all the problems are wrapped in containers and ever increasing bloat, it takes a lot of discipline to understand the stack, if that’s even the proper term anymore.
- ticviking 4y ago
  Even just understanding "the stack" if you're using a cheap Linux VM and admining it directly is a heavy lift for most devs.
andrewxdiamond 4y ago
I don’t think there are any people who understand the full stack. I don’t think anyone like that has existed in computing in a very long time. It’s truly impossible for a single human to actually understand the physics of electronics, the world of CPU micro-architecture, packet shuffling network equipment, the nuance of CSS, and the never ending complexity of UI/UX design. The only way this statement could be accurate is if you arbitrarily start cutting parts of the “stack” out.
- userbinator 4y ago
  If "full stack" means electronics up to JS, then there are probably quite a few people who can work at all those levels. Although a minority, at least they can understand a "fuller" stack than most, unfortunately.
- dwheeler 4y ago
  I disagree, it takes lots of time but it is possible. Personal example: I have an electronics engineering degree that was 1 semester short of a physics degree, so I learned quantum mechanics, electromagnetic field theory, transistors, and how to create a CPU (I even created a CPU out of simple gates and way too much wire wrapping). I love computer software, so I learned assembly, how to write compilers and operating systems, and libraries. I have configured network hardware and written network software at various levels. I've also used CSS and implemented UI/UX. I've written code in many programming languages, including JavaScript, Python, C, C++, Java, Ruby, Rust, Common Lisp, and Scheme. I eventually got a Computer Science degree as well. None of these things are magic, and the info is relatively easy to get. You simply have to keep learning and be willing to try new things. It can be fun, too. Yes, today it can be helpful to specialize at any particular time in your life. But I think it's best to use that as a launching pad to branch out.

neathack 4y ago

When do companies finally start adopting the `security.txt` proposal (see https://securitytxt.org https://securitytxt.org). Would have made a big difference! EDIT: That GitHub user is gone for good.

Akronymus 4y ago
That site is quite ironic. https://securitytxt.org/security.txt https://securitytxt.org/security.txt 404's As does https://securitytxt.org/well-known/security.txt https://securitytxt.org/well-known/security.txt nvm, I missed a '.' https://securitytxt.org/.well-known/security.txt https://securitytxt.org/.well-known/security.txt
deadbunny 4y ago
I'd really like to see a bugs.txt as well. The amount of large sites I have repeatable bugs on with no way to report the is frustrating.

avg_dev 4y ago

Wow. Really crazy. I know it was not right to revoke the key, he touched into their system. He probably broke someone’s production. But it was also absolutely the right thing to do. A god mode key floating around for over a year unrevoked, with real human beings’s medical data on the other side… I am glad the post author revoked the key. It is probably too little too late but they did close that door and maybe saved someone some pain: not the negligent development team, but a real patient and human being, perhaps many of them.

fragmede 4y ago
The lesson here is that there are things worse than downtime. Yeah the site being down is bad but hey, what's worse? Leaking PII all over the place.
- orf 4y ago
  I tried to highlight this in the post, but the key is a personal user one tied to an email, and the worst that I expect would happen would be that some training scripts break. If this was a production key or something that seemed like it would cause financial harm/downtime, I would have never deleted it.
  - OJFord 4y ago
    Honestly, with this level of competence I wouldn't be surprised if the same admin user credentials were used in application/lambda processor/whatever there is. Not at all saying you shouldn't have done it though!
- 0xbadcafebee 4y ago
  Even worse: PHI.
- lmm 4y ago
  Sadly, if you measure "worse" in selfish financial terms, the site being down is probably worse for you.
4y ago

deleted 4y ago

[deleted]

lzooz 4y ago

skullone 4y ago
About as useful and informative as the output from any Infosys contractor. Did you do that on purpose?
COMMENT___ 4y ago
Yeah, that's an excerpt from Wikipedia. But when I see these lines I actually read "money laundering" and "scam".
- COMMENT___ 4y ago
  Answer by GPT-3: > How is information security in Infosys? Information security at Infosys is implemented through a combination of technological and organizational measures. The company has a dedicated information security team that works to identify and mitigate risks. Technologies used to protect data include encryption, firewalls, and intrusion detection systems. Organizational measures include employee training on security policies and procedures.
  - another_devy 4y ago
    > teams that works to identify and mitigate risks Complete failure by team to not see super user permission as risks > intrusion detection… Clearly the did not implement AWS CloudTrail threat detection otherwise when op accessed the account it should have raised alarms, so its just plain lie > …training on security policy So the GitHub user probably skipped those considering them boring. And instead of reporting their own failure chose sneaky way to make it go away hoping no one will notice
    - COMMENT___ 4y ago
      I believe that the OP of this comment thread has been unfairly downvoted. It was irony, right? Sigh.

precompute 4y ago

> To put it bluntly, I’m not sure I trusted Infosys to revoke this key in a timely manner. So I did it for them with aws iam delete-access-key --access-key-id=$AWS_ACCESS_KEY_ID, and now the key is useless: Hilarious. Infosys is a known "mass recruiter" in indian colleges. WITCH (Wipro, Infosys, TCS, Cognizant, HCL) companies is where talent goes to die. No competent employee stays in those companies (from what I've witnessed). Wouldn't be surprised if this turns out to be just the tip of the iceberg, because putting people with 6-12 months of programming / computer "experience" (that they only signed up for because of the money) in charge of major production systems is a recipe for disaster.

smcl 4y ago
> Cognizant Someone hired those clowns as contractors as extra in a previous job, to loud protests from our development team. They produced what was quite possibly the most chaotic, copy-paste, typo-laden code I have ever seen in my life.
- 0xmohit 4y ago
  This is hardly surprising. Most of them would be completely clueless about the code they've "written".
foreggs5 4y ago
drcross 4y ago
>No competent employee stays in those companies Absolutely true from first hand experience. Imagine being a top performer doing great work for a company whose managers insist on wasting your time putting you into needless meetings getting you to explain how you're doing everything all through badly communicated text with typos and misspellings.
- rodgerd 4y ago

loophr 4y ago

[dead]

988747 4y ago
Well, if they choose Infosys as a company to implement CBDC then at least we are safe for the next 20+ years, because there's no way they complete the project before that time :)
astrange 4y ago
Governments already observe most every financial transaction, either because they run the money transmission system (ACH/FedWire/etc), or because countries with VAT send every invoice to the tax office. It's not clear how a CBDC is actually different from the current system, but insofar as it isn't different, it's not less private.
cuteboy19 4y ago
The Indian cdbc is being developed in-house by the RBI afiak

1024core 4y ago

Is it possible to do a full sweep across all tokens in all Python files (for instance) in Github and find such keys? Can you tell from the contents if it's a key or some such "important" string?

vimda 4y ago
GitHub already offers this - they scan all the code that gets uploaded to look for keys. I think the issue here is that the code wasn't on public GitHub, but the artifacts were uploaded to PyPi
MarkMarine 4y ago
Yep, and if you don't look for them, you can be darn sure someone else is looking for them. I heard about an incident from a friend where a GitHub repo was created accidentally public (ran out of private repos and I guess the failure mode back in the day was just make it public) and that repo had developer level access keys in it. Some enterprising fellow was scanning public repos for this, grabbed the keys, opened thousands and thousands of the biggest GPU machines they could get on AWS and started mining bitcoins. They were nice enough not to delete production to make room for more bitcoin miners.
- TheFlyingFish 4y ago
  That's not nice, that's just smart. Delete production, and someone will notice right away. Leave production as it is, and they might not notice until the bill comes due.
- PubliusMI 4y ago
0xbadcafebee 4y ago
The keys here were actually in the published package, not in GitHub, as it seems it was published by accident. Here[1] are the prefixes used for all AWS IAM access keys. Here[2] is the API definition for an access key. If you're going to search all of PyPy for keys, here's some more keys you can look for: [3] [4] [1] https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-prefixes https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_i... [2] https://docs.aws.amazon.com/IAM/latest/APIReference/API_AccessKey.html https://docs.aws.amazon.com/IAM/latest/APIReference/API_Acce... [3] https://github.com/Josue87/GiveMeSecrets/blob/master/rules.py#L6-L25 https://github.com/Josue87/GiveMeSecrets/blob/master/rules.p... [4] https://github.com/BitTheByte/Eagle/blob/master/plugins/spider.py#L23-L49 https://github.com/BitTheByte/Eagle/blob/master/plugins/spid...

jaywalk 4y ago

Many years ago, I did some consulting work on a project that had been "delivered" by Infosys. It was, to put it lightly, a complete and utter mess in every way. Just from a security vulnerability standpoint, it had: SQL injection, plaintext passwords for user accounts, zero protection against URL manipulation, etc. And those are just the ones that come to mind immediately. Glad to see nothing has changed.

volleygman180 4y ago

Beautiful disaster

stuaxo 4y ago

Infosys, the UK prime ministers wife's families company.

COMMENT___ 4y ago

This kind of stories is one of the reason I visit Hacker News. Thank you! It's funny and annoying to read every week or so about another epic fail of a multi-billion "multinational information technology company". Good luck with outsourcing your critical services and medical data to neurodivergents. Thanks again for making my day.

dekhn 4y ago
I recommend the RISKS mailing list. https://seclists.org/risks/ https://seclists.org/risks/ But note that they sometimes take reliability too far.
- COMMENT___ 4y ago
  Oh, this is great! Thank you. PS Good old usenet. :)
throwaway5874 4y ago
Not outsourcing, its incompetent engineers. Do you know how many american companies got hacked because of 200k enginners istakes? Still some american banks store user passwords in plain text, Allow sim awapping without a proper check and so
- COMMENT___ 4y ago
  Yep, I guess you are right. But I think that some of those engineers come from Infosys-like companies, so they do exactly what they’ve been taught and what they are accustomed with. IDK, maybe it’s a cultural problem? Or is it a problem of following best security practices? I understand that it’s useless to seek answers to such questions. Let’s leave it to philosophers. :)
notRobot 4y ago
> neurodivergents Can you please explain this?
- 4y ago

honestduane 4y ago

Infosys is long known to be incompetent as an organization among people who have experienced their brand of greed and labor fraud; I highly recommend you avoid them as much as possible.

zaptheimpaler 4y ago

In a world filled with more competence and less corruption, Infosys would have gone bankrupt 20 years ago. But here we are with Wipro, Infosys, TCS etc. all chugging along.

belter 4y ago
TCS -> US$25 billion Revenue in 2022 InfoSys-> US$16 billion Revenue in 2022 Wipro -> US$10 billion Revenue in 2022 I want to get out of this Universe and get into one that makes sense...
- ramraj07 4y ago
  This universe makes perfect sense, you just don’t want to accept underlying equations is all.
- zaptheimpaler 4y ago
  I think the coming recession will help that along ;) There's going to be less fraud and we'll find out who's been "swimming naked" when the tide goes out as Mr. Buffett likes to say. Like FTX..
roncesvalles 4y ago
I don't believe software development is their bread and butter. Traditionally these companies are known as "systems integrators" which basically means they have armies of people who have RTFM for popular enterprise software products and will provide you with bodies who sit in your office and install or provide support for the product.

another_devy 4y ago

The GitHub user instead of reporting incident to their security team chose to take sneaky approach to remove the keys fearing the actions from company. They will be fired and instead of retrospectively improving the security Infosys will ban all OSS contributions from their developers.

deleted 4y ago
[deleted]
p0rkbelly 4y ago
You assume they have a security team :)
- ramraj07 4y ago
  They will have ten security teams at the minimum. You assume that their teams know what security means though :)
  - jp0d 4y ago
    This is an accurate assessment. Having worked for companies similar to Infosys, I can confirm this.
ev1 4y ago
> Infosys will ban all OSS contributions from their developers. Sounds... good to me?

axpy906 4y ago

Wow. Just wow. Not going to even unpack the levels of ineptitude this went down.

kryptozinc 4y ago

dang 4y ago
Can you please stop posting unsubstantive and flamebait comments and otherwise breaking the HN guidelines? You've been doing it repeatedly, unfortunately, and we have to ban such accounts. If other people are wrong or you feel they are, you're of course you're welcome to post substantive comments explaining why. Other users in this thread have modeled that quite nicely: e.g. https://news.ycombinator.com/item?id=33635659 https://news.ycombinator.com/item?id=33635659. But snark, name-calling, and swipes are not ok—they're not what this site is for, and destroy what it is for. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.

29athrowaway 4y ago

Infosys = if "I have a friend that does it cheaper" was a company

deleted 4y ago

[deleted]

oregano 4y ago

I applaud any bad press on InfoSys. I picked up contract gig through them a few years ago. Here are some of the takeaways from my short lived experience: - It took them over two weeks to send me a computer. - They cancelled PTO for everyone. (this was the most egregious single thing they did) - They had absolute worst internal site for accessing HR documents and accessing personal resources. Just a maze of links. You could only access it via Internet Explorer (I swear I'm not joking). Everything took forever to load. It was like stepping back into 1997. - When I gave my 2 week notice, they refused and said I 'owed' them at least a month. LOL not sure how they think they can control people like that. I gleefully told them to 'deal with it'. This happened about 45 days after I started as it became obvious very quickly how bad this company treats people.

chsreekar 4y ago
was in a client position (Infosys was contracting for the companied I worked for). Absolute worst processes in the world. At one point they blocked legit dev domains in their firewall and took 3 weeks to unblock a mongo db after vehement protests. DON'T touch Infosys with a 100ft pole
curiousgal 4y ago
> You could only access it via Internet Explorer (I swear I'm not joking). That has been in the case in most investment banks as well.
sofixa 4y ago
> When I gave my 2 week notice, they refused and said I 'owed' them at least a month. LOL not sure how they think they can control people like that To be fair, in many countries (probably most developed ones) there are regulated mandatory min and max notice periods. E.g. in France the standard is 1 to 3 months, negotiable of course.

sasas 4y ago

When attempting to look at the git pull request files changed details [1], Github returns a server error. Any ideas why? [1] https://github.com/orf/pypi-data/pull/2/files https://github.com/orf/pypi-data/pull/2/files

benburwell 4y ago
The article mentions a takedown notice they received from GitHub instructing them on how to remove certain content from their repo. I'm guessing maybe this PR contains some of that content they were asked to remove, and there's a bug in GitHub when rendering a pull request page that references deleted content?
mdaniel 4y ago
Unknown, but all(?) GH PRs respond to ".patch" on the end of the PR: https://github.com/orf/pypi-data/pull/2.patch https://github.com/orf/pypi-data/pull/2.patch which redirects to https://patch-diff.githubusercontent.com/raw/orf/pypi-data/pull/2.patch https://patch-diff.githubusercontent.com/raw/orf/pypi-data/p...

heleninboodler 4y ago

Interesting that pull requests 1 and 2 on that repo cause a 500 error when I try to view their diffs. Is this due to action on github's part to try to suppress displaying of the keys?

0xbadcafebee 4y ago

> Johns_Hopkins_Hospital/Input/Excel/Covid_patientdetails/covid_patient_details.xlsx Should I file the HIPAA complaint, or has someone else already done that? (the stupid government website for filing complaints is, of course, not loading for me now)

livinginfear 4y ago
I feel a very satisfactory kind of schadenfreude at the idea of you filing this HIPAA complaint.
bad416f1f5a2 4y ago
Pro tip: https://www.hopkinsmedicine.org/institutional_review_board/hipaa_research/contact.html https://www.hopkinsmedicine.org/institutional_review_board/h... The breach notification to HHS typically comes from the covered entity. They often have the information on exactly what PHI was out there, how many individuals were impacted, and can provide the right info to HHS. And with my experience in healthcare IT, I can say privacy and compliance officers take reports like this incredibly seriously. Those might not be the right people but getting an email to compliance folks inside the covered entity and saying “here’s a likely breach” will absolutely get the ball rolling.

livinginfear 4y ago

I've worked extensively with employees from these Indian labor companies throughout my career as a software-engineer. Many of my positions have implicitly been just to ensure that these developers can't do too much damage. For a long time I despaired about the poor quality of software these contractors would create, and wished there was some kind of justice for the companies that employ these bodyshops. Then I realised, this is how that justice happens. There's been a string of these high profile security incidents over the last few years caused by contractors from these labor companies.

buildbot 4y ago

Why does Infosys get access to HIPAA data (including copying it to their own storage!) to train AI models? That seems like another large story.

p0rkbelly 4y ago
They could have been doing this on behalf of a paying customer. They will sell anything with our without having any expertise. "Pay us, bring your data, and we will do the AI for you and help you". They have case studies on it I suppose: https://www.infosys.com/industries/financial-services/case-studies/leveraging-actionable-insights.html https://www.infosys.com/industries/financial-services/case-s...

iamgopal 4y ago

One of my friend worked on WITCH’s treasury software used internally by government, from which millions of USD transactions happen on daily basis. Since remote access to server was not allowed, he used to use his personal USB drive to copy code from his personal laptop to the mainframe server on daily basis. With both being full of viruses.

p0rkbelly 4y ago

PSA: In exposures like this, Contact the cloud provider too. They tend to have the right contacts for customers. And I'm guessing there are actions they can take as well.

throwawaaarrgh 4y ago
Yeah, you have to digitally sign a Business Associate Addemdum in your AWS account to handle HIPAA data in it. If they didnt, they're double screwed

CaliforniaKarl 4y ago

I notice the author is in London. For people in the US, my suggestion is to go instead to https://www.cisa.gov/report https://www.cisa.gov/report to report things like this. Especially when you're dealing with a company that doesn't have a clear vulnerability-disclosure process, or if you have _any_ concern about your own safety (physical, legal, etc.) when making a report. Personally, I would have stopped right before "The Cleanup", and made a report. Which option would I choose from https://www.cisa.gov/report https://www.cisa.gov/report? None of them stand out, so I would have chosen the last option, to send an email.

0xmohit 4y ago

The Indian government has, over the years, awarded contracts worth billions of dollars to Infosys for projects like the Goods and Service Tax portal, Income Tax portal. In all these cases, the implementations are slow and super buggy. Deadlines to deliver are routinely missed. In an ideal world, these companies should not be allowed to exist.

cuteboy19 4y ago
It is much better than before now. And it's also better than most govt websites.
ramraj07 4y ago
Now, the interesting this is the recent complete refactor of the country’s income tax portal. It was messy, but I feel it was heavenly compared to the clusterF that was healthcare.gov. So what are your thoughts on this being a WITCH specific problem?
- throwawayxx123 4y ago
  It was fixed because a govt minister threatened them with jail time in the end. That set them straight and they fixed the monstrosity to save their ass. Can't reveal more details.
  - ramraj07 4y ago
    That’s interesting to know, thanks lol. That’s the interesting part about corruption in india, in some screwed up way, it’s more “fair” than corruption in the US I think?
morbidious 4y ago
You seem to be suffering from inferiority complex issues. Please fix your own thinking's buggy implementation before commenting about others.

commanderjroc 4y ago

I am so glad I did not pursue a job with them out of college, infosys that is. I told them I was no longer interested and they kept calling my parent's house and even tried recruiting my sister who was in HS. How they go about stuff with that felt so weird, cause I would never get the same recruiter, makes sense they would do something like this.

diogenescynic 4y ago

If you've ever used a third-party outsourcing company like Infosys, Tata, Cognizant, or whoever you know you get literally nothing of value back for what you pay. Unfortunately, it's usually a cost-cutting movie that executives love and defers the pain to another day and creates another mess for someone else to deal with.

arvindamirtaa 4y ago

And to think they manage so many critical infrastructure projects (tax, passports, etc) in India and abroad.

basha94 4y ago

Can't help but be annoyed by the flock of pretentious hackers painting every Infosys/TCS employee with a broad brush. One might say this particular leak is bad on part of Infosys and they must be held accountable for this. But calling the entire company incompetent is just lazy and stupid. They make more than $3B in free cash flow, they are worth more than $80B in market-cap and they gainfully employ more than 100k people. Folks commenting here about the "competency" of a company should realize this. Most of their clients are based in US and UK. These companies have been using Infosys' services for decades and also have locked in deals for the coming decade. If a company was really that incompetent, it really wouldn't be on the scale they are today. You might call them a "boring services company" but they matter a great deal to a lot of people. Less pretension, more focus on "value", please? :)

basha94 4y ago
For those who are downvoting me, would love to hear your take instead of a salty downvote. All numbers in my post are factually correct.
- mindentropy 4y ago
  I don't understand why you are being down voted. I disagree with you that they provide quality though. They don't. It is also the case that the company that hires them provide any quality. All are in it for making money with lowest spend and quality that they can get by. Very few obsess over quality and ones that do are vertically integrated to control quality in each step of the process. Very few American companies are like this. The engineers who complain here don't have any influence in the decision making or otherwise they wouldn't be crying and complaining here.
  - basha94 4y ago
    The engineers here need to understand the world doesn't function well if everyone waited for 100% quality before shipping something. Business trumps Engineering always. And I say this as an engineer myself.
- 4y ago

bluesmoon 4y ago

In 1999, I was an intern at a company in India. We wanted to put a machine in a datacenter, and the datacenter admin asked us to set the Administrator password to "password". Turns out that all the other companies that put their boxes in that datacenter did the same. Infosys was one of those companies. I wrote more about it here: https://tech.bluesmoon.info/2017/04/a-tale-of-datacenter-security.html https://tech.bluesmoon.info/2017/04/a-tale-of-datacenter-sec...

belter 4y ago
Epic! Hope you don't mind my quote here. I enjoyed it :-) "...I glanced over at the other boxes, and they all had stickers on them saying "Administrator/password"...The three of us from TSPL looked at each other, and our president told me to decide. I asked the datacenter guy why he needed that. He said that sometimes they need to shutdown the boxes so they can move them to a different power strip. I asked him if it would be sufficient to give him an account that only had local access and could only reboot the box. He thought about it for a bit and said yes... So I created a new account that required a physically attached keyboard for login, and all it had was the ability to reboot the box. Our app was set up to start up automatically on boot, so we weren't worried about someone having to start it. DC guy physically locked the box to a rack, showed us that he was keeping they key, and we headed back to the office... ...We now needed to test our setup, so we asked everyone in the office to let us use the internet connection. We tried accessing our app, and it worked!... ...Since I had Admin access to our box, I was also able to open the "Network Neighbourhood" of our box in the datacenter. On that network, I saw all the other hosts that were in the datacenter. They had names identifying them from India's largest IT companies. These were companies I'd initially though of interning at...I looked at our president and grinned, and he looked back and said, "Send me a safe summary report when you're done" and walked off to his office. I double clicked on one of the other big boxes and was prompted for a username and password to connect to it... You can probably guess what happened next ;)..."

6Az4Mj4D 4y ago

Passing from college, I joined WITCH company and worked there for 2 years. A lot depends on seniors and guidance that team members provided and off course personal zeal to learn and learn every day.

nell 4y ago

This thread is full of generalized insults at a million people based on where they work. If someone did the same based on a different attribute of a population, they'd be banned. I've worked at one of these companies but left over a decade ago. I know how we're looked at when we do client work (part of why I left). Some of my colleagues were less competent, true. But, some will wipe the floor with the client employees we did the work for. To WITCH employees: If you are an employee at one of these companies, remember you are not the worst. Many of you come from humble backgrounds and are just learning the ropes. The world is cruel. It is a tough place, and you will be discriminated against. This is your fuel. You've already made great strides; keep going. You have to.

mindentropy 4y ago
The funny part is WITCH is propped up by these very companies complaining because they themselves are least bothered about quality. I have seen many executives in suit and tie visit them, get treated like royalty and shake their heads and talk bullshit. I always used to wonder how can someone be so stupid repeatedly but then I learnt along the way that engineer's opinions hold very little value in the way of making money at the lowest cost and quality possible that they can get by.
willcipriano 4y ago
I don't see this as a India problem, it's really an incentive problem. In my experience the further you get from the money, the less of a shit people give. At a 5 person start up the result of any effort you put in is considerably more noticable, you don't have to share the credit of a innovation with a thicket of business analysts, scrum masters, executive vice presidents, etc. In that type of environment people tend to put more effort in as generally a sizeable portion of the rewards for that effort will find it's way to them. (Side note: this has changed with the innovation of Hollywood accounting[0] for start ups, and the number of truly innovative start ups has also seemingly declined) Now think of a large company. The rewards tend to be nearly entirely rank based. You are a Software Engineer III, that pays between $x and $y, if you want a promotion you'll need to change fields into management. Perhaps a really bright idea or large effort will result in a small bonus, so you still have some reason to put effort in but probably won't go crazy. Now go one step further, you are a employee of a 3rd party firm working for a large corporation. A big part of the firm's value prop is that they are cheap, as in they demand less of the reward for effort, they share a small portion of that with you but also have their own thicket of business analysts, scrum masters... you get the point. At that point honestly why bother? You have so many middle men between you and the results of your efforts that it's very unlikely that you'll ever see any meaningful reward. Just do what it takes to not get fired. [0]https://en.m.wikipedia.org/wiki/Hollywood_accounting https://en.m.wikipedia.org/wiki/Hollywood_accounting

yrgulation 4y ago

And to think Infosys is slowly creeping into the uk contract market. You cant make this up.

ilrwbwrkhv 4y ago

Anyone who has Infosys (or the other witchy companies) on their resume is an instant no-hire on my books.

duckydude20 4y ago

rxyz 4y ago

I know a person that works as a "Cybersecurity consultant" at Infosys. Mind you, not in India. She got hired as an intern with no degree, after a few months of game testing experience and some Udemy courses. Then, got promoted after less than a year and her salary doubled. Good for her, but she openly admitted to me her best skill is Powerpoint presentations