A confession exposes India’s hacking industry | Hacker News Reader

A confession exposes India’s hacking industry

newyorker.com

104 pointsfortran7768 comments

India has 1.4 billion people, of course some of them are black hats for hire. Perhaps India is a hotbed of cybercrime but this article is mostly anecdotes and nothing in it is evidence that the nation’s at all comparable to other hotspots of hirable hackers like Eastern Europe or Israel.

India already have the reputation for their "IT support departments" calling everyone in the world every few months to try to gain access to their computer, also known as social engineering, a form of hacking. Many of their operation centers have been exposed, yet the Indian government has not been able to stop it. China also has 1.4 billion people, and they indeed are more known than India for being a serious black hat threat. But if you ask the average person what kind of hacker they are more familiar with, they will probably recall the 10+ times they were personally called by a hacker with a strong Indian accent.

India has ~150 million English speakers, while China has ~10 million.

It’s worrisome that many companies out source their IT there …

That's slowing down; Mexico City and the Philippines are becoming more popular.

PI because of long standing ties to the US and Canada, and eligbility for things like TFW workers in Canada. Mexico City for timezones and NAFTA TN visas.

> That's slowing down;

That's not what the IT export numbers say.

I always thought they were scammers, never have I heard them to refer to as hackers except in this thread.

Social engineering counts as hacking, even if it doesn't require much specialized technical finesse.

You can be both

The reputation you describe is non existant in my (non-English-speaking) country. I guess US and UK are just the easiest and richest targets for Indian hackers. Why should we expect something else ?

It's the language barrier. Germany is targeted by Turks and Eastern Europeans in similar fashion.

I think you severely overestimate German speakership in Turkey.

I think the point was more that there are fewer German speakers in India than English speakers, by a large margin, so if you are going to scam in German you might be more likely to source your call-centre operatives from elsewhere, which is why Indian call centres don't have the reputation in that country which they do in the UK & US.

Some of them might be former residents of Germany. Most of my spam calls came from Tunisia, Morocco, Turkey or Bulgaria, most of the spoken German was pretty decent. Good old times when I had time for scambaiting.

Good thing that this only affects English speaking countries.

It made me really allergic for the word kindly combine with Sir

Sir , kindly xxxxxx = Indian scammer

The fact that general English language proficiency is far greater in India (where English is an official language) than China ... may have something to do with this.

Boiler-room telephony operations tend to follow linguistic capabilities. The Philippines is another locale with widespread English-language capabilities and a low prevailing wage rate, though it seems less associated with technical scams than India is.

This has been there for a long long time. I remember Edward Snowden went to India to learn hacking.

India also has an amazing open source culture. Was quite shocked to see how high quality they were, since the ones you hire from the large outsourcing companies like Infosys etc are so so bad.

The ones for hire at Infosys aren't necessarily untalented. They're very smart, but keeping your job often means fitting in, going with the flow, and doing what you're told.

Also the very technically adept ones at Infosys are skilled enough to land other jobs within 2-3 years of joining.

That said, Infosys and other WITCHes pay very low. My cousins who are farmers earn 2x what Infosys pays thanks to a mix of farm subsidies, government rural employment schemes (MGNREGA), and local government jobs. And this is a common story for a massive portion of India now.

It's gotten very difficult for WITCH to pay Tier 1 salaries so they've expanded IT offices in Tier 3 Metros like Indore, Lucknow, Bhopal, etc because $4-8,000/yr goes much farther in those cities.

In my college Infosys was always seen as the option only slightly better than unemployment. Actually this was not even the popular view by the time I left.

I will age myself and maybe out myself but while infosys may not have been a dream job during my college days (pre infosys IPO), it soon was. The company probably wasn't any different in skills but there weren't too many people in tech those days. Minuscule. And post IPO infosys laid the foundation well those days, sold the company well and was indeed a dream job at least for a little while. But that's ancient history now.

Indeed. Between roughly 1995-2000 it was the place to be. The hyper growth that followed post ~2002 brought in dilution in talent, benefits were cut (e.g. stock options were discontinued mid 2002) and the emergence of global companies opening India offices made it even less desirable.

There's a meme about Infosys' 3L/annum salary. Funnily that was exactly my starting salary there (post confirmation) in 2002.

Mine was 42K rupees :) annual. Since it is an old thread now hope no one is watching.

Some of the best actual hackers (not just pentesters and ctf winners) are in india.

About the infosys stuff, it's cultural, as in infosys' culuture or rather the culture that comes about when you have misaligned incentives between a 3rd party outsourcer and a cheapskate western company. They don't get paid for quality.

If you want to see talent there, look at the folks working for local companies, on their own or for multinationals.

But you know, even in US companies that don't outsource I have seen that "infosys" culture of doing things low and slow and with maximum complexity and LoC and support cost, box checking "requirements",etc... Hire accenture or whoevee in the US and your experience would be similar.

> Some of the best actual hackers (not just pentesters and ctf winners) are in india.

How do you know this?

> I remember Edward Snowden went to India to learn hacking.

Allegedly for 6 days and he also learned java programming apparently.

Can someone get Snowden to confirm? I think this is some rumour based ad for a coaching institute.

> he also learned java programming apparently

"Learn Java in Six Days". That sounds like "I lost 10Kg in two weeks".

Sure, you can learn the basics of Java in six days, I suppose; but you certainly never needed to go to India to do it. I was thrown in the deep end with Java; from a standing start, I had to create production software in two months. I delivered, but the code I wrote was shit.

And I had no training at all; there was no time. I learned using online resources.

[Edit] In the 90s most spam and hacking seemed to come from relatively poor countries, like USSR, India, Africa and China. I assumed it was because with a PC, a modem and a phone connection, you could make a lot more than the average salary. Then outsourcing came along, Indian developers started eating my breakfast, and pay for UK developers nosedived.

>Then outsourcing came along, Indian developers started eating my breakfast, and pay for UK developers nosedived.

I don't know many companies that fared well with this. Pay nosedived everywhere and a few years later when the companies realized it isn't working it went up again.

Why are they seemingly underrepresented on Github?

When I check out a library I often peek at who made it. My general demographic "feel" is

- 40% some European or American

- 40% some dude in Siberia,

- 10% Chinese hacker in Shenzhen

- 10% some cryptic Japanese hacker

I'm always a bit surprised there are very very few South East Asians, Latin Americans, Koreans, Indians

I don't know about the others, but there are indeed people like me in India developing and maintaining non-cool, not on Github, free software. If you're here on Hacker News, there's actually a pretty good chance you've run, directly or indirectly, code I've written without even registering it.

What's the popular forge platform in India?

I know in China they typically host on Gitee - but it's in part an artifact of the national firewall. Didn't know in India it's also silo'ed off

I wouldn't say its siloed off. Its often on popular forges like Github and Gitlab. But also on smaller ones like sourceforge, GNU Savannah, sourcehut, etc. My point being that a lot of the free software movement in India doesn't create the hot new Rust / Go app. Its more focused on smaller things or on using the existing tools

What are some examples of smaller things that are more relevant in India than in the US/Europe?

> - 40% some dude in Siberia,

Is this remotely true? There's just 33 million people in Siberia, it would be strange for them to dominate OS like that.

A good chunk of the more interesting code I've seen around is usually attributed to someone from Russia or the Eastern Bloc. Doesn't seem weird to me at all. It isn't Siberia in a literal sense but I think this was the point trying to be made.

"Siberia" in the "random dude in the middle of nowhere slamming out lines of code" sense.

Siberia itself is not crazy; Novosibirsk is the capital of Siberia and 3rd largest city in Russia, strong engineer culture cuz of all of the natural resources around.

I want to say thats a very general stereotype? Not sure if thats the correct term here.

Popular repos do not represent all of open source. People generally contribute to thing which they are interested in and/or actively using, most of the traditionally popular repos that most people come across are bleeding edge technology not being actively used by rest of the world but mostly by US/EU.

There are a lot of regional technical issues in SEA that devs need to solve, the ones that are not so valuable for rest of the world to look into.

What would these be in particular? only one I can think of is IPv6 being way more common

The same reason that only 10% are some 'Chinese hacker from Shenzhen'. Indians & Chinese are invested in their local ecosystem, so you are unlikely to see their efforts reflected in the type of western-repositories that we're looking at.

Secondly, India is still a poor country. So open source is produced as a by-product of the commercial work you do, but it does not have the maturity of a made-for-open-source product that ends up having dubious commercial viability.

The main point of open source in under-developed economies is to put out a positive signal for hiring. So the second you've done just enough, you are looking to escape the hell that is 'unpaid open source work' and move to corporate code that might also be open-sourced. Also, the best candidates (IITians, flagship university kids, Bangalore undergrads) are hired through on-campus hiring procedures. So efforts go into improving their signaling towards those avenues, rather than publicizing your work to the entire world.

For a project on Github I maintain, I've seen increased amount of low quality PRs in the recent months (changes where it was obvious that the submitter never ran the code or interacted with the project as a user) that seemed to be raised just for the purpose of getting some sort of cred. These create noise and extra work for the maintainers. Most of them originated from India, I believe. Had to remove those 'help-wanted' and 'good-first-issue' tags because of these void PRs.

I don't find these argument convincing

- hackers in Shenzhen are underrepresented b/c of the language barrier. There is actually a huge Chinese language ecosystem (a lot of it off Github on Gitee) that is sort of impenetrable but you come across it all the time. I said 10% just b/c typically I have no way to use their work b/c it's under-documented in English. If you zip around this map you will see lots of "Zh" islands: https://anvaka.github.io/map-of-github/

- Are Indian hackers working in Hindi and other regional languages?

- While I understand that it's not as financial comfortable for a programmer in Indian compared wtih the US or Europe, Chinese and Russian hackers aren't significantly better off. Your typical Chinese program is also of course worried about working for a big company and making money and all of that jazz

- "escape the hell that is 'unpaid open source work' " - I think maybe is the crux of it... Most people work on open source work b/c they enjoy it.. You're definitely not going to make a major github project used by other people just because you're looking to pad your resume.

Sidenote: I don't personally know anyone who got hired from a deliberate effort to build an open source portfolio. I wouldn't recommend it to anyone as a way to try to find a job

You are right. The more popular libraries seem that way but if you look at the linux and the python ecosystem, you will find a lot more.

> I remember Edward Snowden went to India to learn hacking.

According to the owner of a podunk computer training school in New Delhi. If you believe this, I have a bridge to sell you in Brooklyn. https://archive.is/Aq6bU

I was involved a bit on bug bounty platforms like hackerone before, a very large percentage of the security researchers are from India. What's more fascinating is if you look them up on infosec Twitter, you see a lot of them are from these remote villages, where the security bounties are probably decent money for them.

> "Everyone’s hackable"

Is that like when Wonder Woman tells the little girl in the foiled bomb plot she can do anything she wants? The little girl should have asked when she can deflect bullets with her arm bands.

https://archive.is/lTJOG

India has a hacking industry?

Seriously, I can understand scamming industry presence in India, but hacking industry, if at all present will be very nascent.

Edit: In the title it suggests "confession", but it most likely was bragging :)

If their hacking ability is anything like the engineering ability you can contract then I am not worried.

If you're unable to hire quality talent, that's either because you can't afford the market rate or because you are incompetent. I don't know why you would want to advertise this.

Pretty extreme hot cake, don't you think?

Reply on news.ycombinator.com