<story><title>Indian Government Breached, Massive Amount of Critical Vulnerabilities</title><url>https://johnjhacking.com/blog/indian-government-breached-massive-amount-of-critical-vulnerabilities/</url></story><parent_chain><item><author>Clewza313</author><text>This smells a bit off: why is there no detail whatsoever on &lt;i&gt;what&lt;/i&gt; exactly they breached?  The &amp;quot;Indian Government&amp;quot; (central, state, other?) is a sprawling octopus that employs on the order of 50 million people, and there&amp;#x27;s a world of difference between breaching the public site of the Department of Fertilizers (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;fert.nic.in&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;fert.nic.in&amp;#x2F;&lt;/a&gt;) vs getting into the internal systems of the Ministry of External Affairs.  The only clue appears to be those 14,000 police records.&lt;p&gt;Update: the leader of the &amp;quot;Sakura Samurai&amp;quot; appears to be 15 years old, which explains a lot.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;mobile.twitter.com&amp;#x2F;jacksonhhax&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;mobile.twitter.com&amp;#x2F;jacksonhhax&lt;/a&gt;</text></item></parent_chain><comment><author>eganist</author><text>John Jackson (johnjhacking) is not jacksonhhax, though they&amp;#x27;re both part of the same group.&lt;p&gt;For context, John&amp;#x27;s a vet who&amp;#x27;s employed in the field. And beyond that, he&amp;#x27;s published other sound security research in the past, e.g. &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;johnjhacking.com&amp;#x2F;blog&amp;#x2F;cve-2020-28360&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;johnjhacking.com&amp;#x2F;blog&amp;#x2F;cve-2020-28360&amp;#x2F;&lt;/a&gt; (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;cve.mitre.org&amp;#x2F;cgi-bin&amp;#x2F;cvename.cgi?name=CVE-2020-28360&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;cve.mitre.org&amp;#x2F;cgi-bin&amp;#x2F;cvename.cgi?name=CVE-2020-2836...&lt;/a&gt;, which links &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;frenchbread&amp;#x2F;private-ip&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;frenchbread&amp;#x2F;private-ip&lt;/a&gt;)&lt;p&gt;As for the attribution chain to sakurasamurai.org, reference the following:&lt;p&gt;• twitter.com&amp;#x2F;johnjhacking refers users to&lt;p&gt;• twitter.com&amp;#x2F;sakurasamuraii, which links&lt;p&gt;• sakurasamurai.org in a pinned tweet.&lt;p&gt;Source: I know John personally.</text></comment>
<story><title>Indian Government Breached, Massive Amount of Critical Vulnerabilities</title><url>https://johnjhacking.com/blog/indian-government-breached-massive-amount-of-critical-vulnerabilities/</url></story><parent_chain><item><author>Clewza313</author><text>This smells a bit off: why is there no detail whatsoever on &lt;i&gt;what&lt;/i&gt; exactly they breached?  The &amp;quot;Indian Government&amp;quot; (central, state, other?) is a sprawling octopus that employs on the order of 50 million people, and there&amp;#x27;s a world of difference between breaching the public site of the Department of Fertilizers (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;fert.nic.in&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;fert.nic.in&amp;#x2F;&lt;/a&gt;) vs getting into the internal systems of the Ministry of External Affairs.  The only clue appears to be those 14,000 police records.&lt;p&gt;Update: the leader of the &amp;quot;Sakura Samurai&amp;quot; appears to be 15 years old, which explains a lot.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;mobile.twitter.com&amp;#x2F;jacksonhhax&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;mobile.twitter.com&amp;#x2F;jacksonhhax&lt;/a&gt;</text></item></parent_chain><comment><author>jcims</author><text>I think that Twitter user is just a member.  One of the founders is &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;johnjhacking&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;johnjhacking&lt;/a&gt; who proclaims to have a full time job and be a disabled vet.</text></comment>