Hacking India's largest automaker: Tata Motors

> M&S chair, told MPs that hackers had used “sophisticated impersonation” to gain entry “involving a third party.”

20 bucks says this sophisticated impersonation was social engineering a $5/hour outsourced customer support employee

> The attack is expected to lower operating profits by up to £300mn this year.

that's not counting the reputation and brand damage. M&S is seen as a premium retailer and this whole hack made them seem utterly incompetent and unreliable

> had decided to opt for another service provider after the process had completed

i wonder where this other provider is based. i think i'm gonna place another 20 bucks on this.

> The retailer continues to use the Indian group for other services.

lol.

When you pay your support employees so little, it's not difficult for someone from a wealthier place to bribe them.

I have heard there is a growing trend of hackers paying kickbacks to insiders, certainly makes hacking easier.

It's perfectly believable. Whether it is more believable or not is a toss up. If you employ such a large number of people there are bound to be a couple of bad apples, and unless you have very good internal processes and monitoring it isn't all that hard to imagine someone doing something they shouldn't be doing. But absent hard evidence that it happened that way it interesting speculation but no more than that, besides, it can be impossible to distinguish between the two even if you have evidence of an inside job that looks like incompetence!

Based on my experience working alongside TCS, incompetence seems far more likely. If we'd asked for a back door, we'd have gotten a solid wall.

Then again, my experience may have left me a little jaded.

I dont think there's much culture when the population is just overloaded with work and traffic and stress

Pay should reward doing something well vs merely doing something. Of course, this would generally mean you need to pay more than the competitor which will happily pay for merely doing something. So yes it is about pay.

It is about pay. If you don’t have someone working on 5 different items continuously straining their bandwidth they tend to do better work.

Becuase it is about pay.

For example, most of the security portfolio that GCP provides is developed and product managed out of the Google Hyderabad office, as is a fairly major Israeli CNAPP product that starts with "A", a large CNAPP from a public Israeli-American security company that is directly positioned against Wiz, and a major security vuln mgmt and redteaming tool used by the DoD, GitHub, and Google. But all these employers pay $60k-130k TC for mid-career security professionals in India.

We scoop up anyone who is remotely competent at transnational firms or startups because we can afford to pay Western salaries, and traditional conglomerates in India largely do not care about web exploits unless they are a web platform first and foremost.

Tata Motors - being an automotive company - does not care about web development for the same reason GM doesn't as well: it isn't tangibly connected to revenue generation. As such, they will just contract it out to TCS (a Tata Group company, but both are independent of each other) at the lowest contract rate possible.

That culture at WITCH and WITCh adjacent companies is itself a result of the pay.

Doh! You are correct! Crossed wires during a meeting