The MobiKwik leak is real. Here is what the dump had for me. One of those credit cards was valid until a couple weeks ago, and I don't recall authorising MobiKwik to save it. Companies that lie like 👇 ought to be taken to the cleaners. 
https://twitter.com/MobiKwik/status/1367489330902675463
Check for yourself here (requires Tor). It's under heavy load and timing out, so you may need to come back later.
https://twitter.com/mammad_pixell/status/1376569350849658893
Twitter has flagged the .onion URL as malicious, so it can no longer be shared. Boo, Twitter!
How does one determine this data is from Mobikwik? There are three indicators to work with. 👇
How does one determine this data is from Mobikwik? There are three indicators to work with. 👇
1. The join date in the dump matches an email receipt.
2. Dump has my contacts but not my name, matching website records.
The dump has a bcrypt password hash. I have a saved password for the website. However, in this case the hash does NOT match, adding some uncertainty. It is possible they are hashing it differently from what I'm doing in this screenshot. There is no way to reverse the hash.
A password hash match would have made this irrefutable evidence as the password isn't reused. Sans that, at this point the evidence is merely compelling.
If you had the Mobikwik app installed, the dump has a bit more data: a list of all apps on your phone, and your GPS coordinates. This is from a friend's dump, shared with permission (location redacted).
Shameless company, bringing disrepute to the compliance standards they claim to adhere to. Who are you fooling? blog.mobikwik.com/message-from-t…
The claim of a functioning bug bounty program, contrasted with the experience of the researcher who reported this breach.
https://twitter.com/rajaharia/status/1376789345441443840
What is this, MobiKwik? One story to the world, another to your suppliers? techcrunch.com/2021/03/30/mob…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
