Zomato hacked! Are Indian online startups taking security for granted?

After Gaana.com and Ola, it’s Zomato that has fallen prey to a hack attack. A hacker named Anand Prakash claims to have hacked Zomato recently. He reportedly hacked into Zomato and reported it to highlight the flaw in Zomato’s online security.

This is what the hacker stated in his blog:

“While creating an account, a user can store his phone number, addresses, date of birth, link Instagram account etc. In one of the API call, they were reflecting the user data based on the “browser_id” parameter in the API request. Interestingly, changing the “browser_id” sequentially resulted in data leakage of other Zomato users. The data leaked also had Instagram access token which could be used to see private photos on Instagram of respective Zomato users.”

The technical details of the vulnerability are mentioned in his blog.

Zomato’s engineering team was quick to respond and fixed the bug moments after it was reported. But with 62.5 million registered users, it’s still possible that this vulnerability could have been used to violate user privacy.

Disclosure Timeline:     

June 1, 2015; 09:29 PM: Report sent to Deepinder Goyal, CEO

June 2, 2015; 12:54 PM:  Added Gunjan Patidar, CTO and Shrey Sinha to the mail thread

June 2, 2015; 1:04 PM: Bug acknowledged by Gunjan Patidar

June 2, 2015; 2:01 PM: Confirmation of vulnerability fix from Gunjan Patidar

Earlier this week, cab hailing service Ola was hacked by a group of hackers called TeamUnknown, who posted the company’s database structure on Reddit. The group claims to have access to user details, credit card transaction details, and unused vouchers. Ola however denies these claims.

The group stated that the company’s application design is very poor and their development server is weakly configured. “The hack was a little tricky and involved many steps to get to the database.”