Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
A confession exposes India’s hacking industry (newyorker.com)
104 points by fortran77 on June 6, 2023 | hide | past | favorite | 68 comments


India has 1.4 billion people, of course some of them are black hats for hire. Perhaps India is a hotbed of cybercrime but this article is mostly anecdotes and nothing in it is evidence that the nation’s at all comparable to other hotspots of hirable hackers like Eastern Europe or Israel.


India already have the reputation for their "IT support departments" calling everyone in the world every few months to try to gain access to their computer, also known as social engineering, a form of hacking. Many of their operation centers have been exposed, yet the Indian government has not been able to stop it. China also has 1.4 billion people, and they indeed are more known than India for being a serious black hat threat. But if you ask the average person what kind of hacker they are more familiar with, they will probably recall the 10+ times they were personally called by a hacker with a strong Indian accent.


I always thought they were scammers, never have I heard them to refer to as hackers except in this thread.


Social engineering counts as hacking, even if it doesn't require much specialized technical finesse.


You can be both


India has ~150 million English speakers, while China has ~10 million.


[flagged]


What is your claim based on?


It was a joke.


It’s worrisome that many companies out source their IT there …


That's slowing down; Mexico City and the Philippines are becoming more popular.

PI because of long standing ties to the US and Canada, and eligbility for things like TFW workers in Canada. Mexico City for timezones and NAFTA TN visas.


> That's slowing down;

That's not what the IT export numbers say.


The reputation you describe is non existant in my (non-English-speaking) country. I guess US and UK are just the easiest and richest targets for Indian hackers. Why should we expect something else ?


It's the language barrier. Germany is targeted by Turks and Eastern Europeans in similar fashion.


I think you severely overestimate German speakership in Turkey.


I think the point was more that there are fewer German speakers in India than English speakers, by a large margin, so if you are going to scam in German you might be more likely to source your call-centre operatives from elsewhere, which is why Indian call centres don't have the reputation in that country which they do in the UK & US.


Some of them might be former residents of Germany. Most of my spam calls came from Tunisia, Morocco, Turkey or Bulgaria, most of the spoken German was pretty decent. Good old times when I had time for scambaiting.


The fact that general English language proficiency is far greater in India (where English is an official language) than China ... may have something to do with this.

Boiler-room telephony operations tend to follow linguistic capabilities. The Philippines is another locale with widespread English-language capabilities and a low prevailing wage rate, though it seems less associated with technical scams than India is.


It made me really allergic for the word kindly combine with Sir

Sir , kindly xxxxxx = Indian scammer


Good thing that this only affects English speaking countries.


[dead]


> idol-worshiping pagans

That came out.. wrong?


I think the parent commenter was trying to portray Indians from a Western perspective, to highlight the disdain that the West has supposedly held for India.

They're not wrong, by the way; Nixon was reportedly vitriolic in his racism against Indians[1].

[1]: https://www.nytimes.com/2020/09/03/opinion/nixon-racism-indi...


Why? In the view of the descendants of Mediterranean civilisations — "the West" (Christendom) and West Asia/North Africa (Ummah), Hindus are the last remaining large group of pagans, and idol-worshippers to boot. Everyone else like them has been "saved" by hook or crook, stick or carrot.

Am I wrong?


The term "pagan" historically referred to individuals who practiced polytheistic religions outside of the major world religions and Hindus worship Brahman ultimately. Also the "idols" are not seen as the deity but a physical representation that helps worshiping the deity.

But I'd love to be corrected as my knowledge is very superficial.


> The term "pagan" historically referred to individuals who practiced polytheistic religions outside of the major world religions

Not really, all nature worshippers have been called pagans by followers of Abrahamic religions. "Major/minor" is a modern concept, the original idea was of true believer and heathen – Religion was never a democracy

> Hindus worship Brahman ultimately. Also the "idols" are not seen as the deity but a physical representation that helps worshiping the deity.

Talk to 10 Hindus and you will get 20 definitions of Hinduism. Not surprising, when considering its 4000 year old roots and its practice in an ultra-diverse society.


> Hindus worship Brahman ultimately.

This is not entirely true. Hinduism is a religion spanning almost 5000 years of continuous belief, and is the last direct descendant of the Proto-Indo-European mythos and beliefs system. As such, it is extremely complex, and it escapes attempts (especially by Western, Christocentric authors) to easily classify it.

Vaiṣṇavas believe Viṣṇu is the ultimate being; Śaivas replace him with Śiva. The Brahman-is-everything belief is closer to the Advaita and Smarta traditions, developed by Ādi Śaṅkara in the 8th century CE. There are the Aghoris, who believe extreme ascetism will lead them closer to Śiva; there exist Hindus who are also Jains, an arguably nāstika ('heterodox') tradition.

Furthermore, it is equally fair to argue that many Hindus do worship the idols (or mūrtis) themselves, which are generally considered extremely holy anyway. Although it has descended from PIE religion, Hinduism has undergone much syncretism after its arrival in the Indian subcontinent, perhaps first with the Indus Valley religion, and then with the myriad animist and fetishist beliefs of the various Indian tribes throughout the subcontinent, and therefore the lingering idolatry.

Every village has a kuladevatā, a 'clan god'. These have been syncretised with popular worship of the more major Hindu deities. 4000 years ago, Vedic nature deities closer to the Greco-Roman-Norse-Anglo-Saxon-Slavic equivalents were more popular. These include Indra, Váruṇa, Vāyu, Savitṛ, Agni, Sóma etc.

After approximately 500 BCE, they were generally replaced by the Trimūrti, their consorts, and their issue, including Gaṇeśa, Pārvatī, Sarasvatī, Lakṣmī, etc. These gods don't really have equivalents in pre-Christian European religions, as they developed through the synthesis of the various scriptures.

Hinduism doesn't even have a single prophet, or religious figure; it has not one but at least seven ṛṣis. It has four Vedas, dozens of Purāṇas, two epics that are individually orders of magnitude longer than any Homerian tragedy.

Dravidian Hinduism, being almost equally as old, has developed almost independently of the rest of the subcontinent, with its own set of beliefs, cultures, and even architecture.

Ergo, Hinduism does not fit into neat categories developed with a Judeo-Christian perspective. Heck, Christians have made it easy for themselves; even their own religion developed out of a polytheistic nature-god religion. The Judeo-Christian god Yahweh is just one deity out of an entire pantheon that more or less went out of fashion after Judaism, including Astarte, Ishtar, Asherah, Baal, El, etc.


I knew that I didn't know too much, now thanks to your comment, I'm searching for books about Hinduism and its history. Very interesting!

Thank you very much for the detailed answer!!


>Hindus worship Brahman As a Hindu, some people see this as the ultimate truth, while quite a lot of others don't. There are a lot of paths to salvation, depends on whom you ask.


Not disagreeing per se, but I find it interesting to regard Hinduism as anything other than a major world religion.


Nativity scenes, as well as the countless number of icons and statues seen in Catholicism and Orthodoxy, would count as a form of idol worship under strict interpretation of Abrahamic religious texts too. So yes, you are wrong.


I don't know about the rest, but you're wrong in the assumption that religion today has any relevance in how someone is perceived in the west.

Well, except for islam.


It does for evangelical christians, who form a large voter base and wield lots of political power.


Evangelical Christians dislike anyone who are unlike them in any way. This isn't some sort of special targeting against Indians.


I don't think even to them this stands out more than India having an order of magnitude lower GDP per capita than western countries.


[flagged]


We've banned this account for using HN for ideological and nationalistic flamewar. That's not allowed here, regardless of which party or ideology or nation you're battling for or against. Please don't create accounts to break HN's rules with.

https://news.ycombinator.com/newsguidelines.html


This has been there for a long long time. I remember Edward Snowden went to India to learn hacking.

India also has an amazing open source culture. Was quite shocked to see how high quality they were, since the ones you hire from the large outsourcing companies like Infosys etc are so so bad.


> I remember Edward Snowden went to India to learn hacking.

According to the owner of a podunk computer training school in New Delhi. If you believe this, I have a bridge to sell you in Brooklyn. https://archive.is/Aq6bU


Why are they seemingly underrepresented on Github?

When I check out a library I often peek at who made it. My general demographic "feel" is

- 40% some European or American

- 40% some dude in Siberia,

- 10% Chinese hacker in Shenzhen

- 10% some cryptic Japanese hacker

I'm always a bit surprised there are very very few South East Asians, Latin Americans, Koreans, Indians


The same reason that only 10% are some 'Chinese hacker from Shenzhen'. Indians & Chinese are invested in their local ecosystem, so you are unlikely to see their efforts reflected in the type of western-repositories that we're looking at.

Secondly, India is still a poor country. So open source is produced as a by-product of the commercial work you do, but it does not have the maturity of a made-for-open-source product that ends up having dubious commercial viability.

The main point of open source in under-developed economies is to put out a positive signal for hiring. So the second you've done just enough, you are looking to escape the hell that is 'unpaid open source work' and move to corporate code that might also be open-sourced. Also, the best candidates (IITians, flagship university kids, Bangalore undergrads) are hired through on-campus hiring procedures. So efforts go into improving their signaling towards those avenues, rather than publicizing your work to the entire world.


I don't find these argument convincing

- hackers in Shenzhen are underrepresented b/c of the language barrier. There is actually a huge Chinese language ecosystem (a lot of it off Github on Gitee) that is sort of impenetrable but you come across it all the time. I said 10% just b/c typically I have no way to use their work b/c it's under-documented in English. If you zip around this map you will see lots of "Zh" islands: https://anvaka.github.io/map-of-github/

- Are Indian hackers working in Hindi and other regional languages?

- While I understand that it's not as financial comfortable for a programmer in Indian compared wtih the US or Europe, Chinese and Russian hackers aren't significantly better off. Your typical Chinese program is also of course worried about working for a big company and making money and all of that jazz

- "escape the hell that is 'unpaid open source work' " - I think maybe is the crux of it... Most people work on open source work b/c they enjoy it.. You're definitely not going to make a major github project used by other people just because you're looking to pad your resume.

Sidenote: I don't personally know anyone who got hired from a deliberate effort to build an open source portfolio. I wouldn't recommend it to anyone as a way to try to find a job


For a project on Github I maintain, I've seen increased amount of low quality PRs in the recent months (changes where it was obvious that the submitter never ran the code or interacted with the project as a user) that seemed to be raised just for the purpose of getting some sort of cred. These create noise and extra work for the maintainers. Most of them originated from India, I believe. Had to remove those 'help-wanted' and 'good-first-issue' tags because of these void PRs.


I don't know about the others, but there are indeed people like me in India developing and maintaining non-cool, not on Github, free software. If you're here on Hacker News, there's actually a pretty good chance you've run, directly or indirectly, code I've written without even registering it.


What's the popular forge platform in India?

I know in China they typically host on Gitee - but it's in part an artifact of the national firewall. Didn't know in India it's also silo'ed off


I wouldn't say its siloed off. Its often on popular forges like Github and Gitlab. But also on smaller ones like sourceforge, GNU Savannah, sourcehut, etc. My point being that a lot of the free software movement in India doesn't create the hot new Rust / Go app. Its more focused on smaller things or on using the existing tools


What are some examples of smaller things that are more relevant in India than in the US/Europe?


I want to say thats a very general stereotype? Not sure if thats the correct term here.

Popular repos do not represent all of open source. People generally contribute to thing which they are interested in and/or actively using, most of the traditionally popular repos that most people come across are bleeding edge technology not being actively used by rest of the world but mostly by US/EU.

There are a lot of regional technical issues in SEA that devs need to solve, the ones that are not so valuable for rest of the world to look into.


What would these be in particular? only one I can think of is IPv6 being way more common


> - 40% some dude in Siberia,

Is this remotely true? There's just 33 million people in Siberia, it would be strange for them to dominate OS like that.


A good chunk of the more interesting code I've seen around is usually attributed to someone from Russia or the Eastern Bloc. Doesn't seem weird to me at all. It isn't Siberia in a literal sense but I think this was the point trying to be made.


"Siberia" in the "random dude in the middle of nowhere slamming out lines of code" sense.

Siberia itself is not crazy; Novosibirsk is the capital of Siberia and 3rd largest city in Russia, strong engineer culture cuz of all of the natural resources around.


You are right. The more popular libraries seem that way but if you look at the linux and the python ecosystem, you will find a lot more.


> I remember Edward Snowden went to India to learn hacking.

Allegedly for 6 days and he also learned java programming apparently.

Can someone get Snowden to confirm? I think this is some rumour based ad for a coaching institute.


> he also learned java programming apparently

"Learn Java in Six Days". That sounds like "I lost 10Kg in two weeks".

Sure, you can learn the basics of Java in six days, I suppose; but you certainly never needed to go to India to do it. I was thrown in the deep end with Java; from a standing start, I had to create production software in two months. I delivered, but the code I wrote was shit.

And I had no training at all; there was no time. I learned using online resources.

[Edit] In the 90s most spam and hacking seemed to come from relatively poor countries, like USSR, India, Africa and China. I assumed it was because with a PC, a modem and a phone connection, you could make a lot more than the average salary. Then outsourcing came along, Indian developers started eating my breakfast, and pay for UK developers nosedived.


>Then outsourcing came along, Indian developers started eating my breakfast, and pay for UK developers nosedived.

I don't know many companies that fared well with this. Pay nosedived everywhere and a few years later when the companies realized it isn't working it went up again.


The ones for hire at Infosys aren't necessarily untalented. They're very smart, but keeping your job often means fitting in, going with the flow, and doing what you're told.


Also the very technically adept ones at Infosys are skilled enough to land other jobs within 2-3 years of joining.

That said, Infosys and other WITCHes pay very low. My cousins who are farmers earn 2x what Infosys pays thanks to a mix of farm subsidies, government rural employment schemes (MGNREGA), and local government jobs. And this is a common story for a massive portion of India now.

It's gotten very difficult for WITCH to pay Tier 1 salaries so they've expanded IT offices in Tier 3 Metros like Indore, Lucknow, Bhopal, etc because $4-8,000/yr goes much farther in those cities.


In my college Infosys was always seen as the option only slightly better than unemployment. Actually this was not even the popular view by the time I left.


I will age myself and maybe out myself but while infosys may not have been a dream job during my college days (pre infosys IPO), it soon was. The company probably wasn't any different in skills but there weren't too many people in tech those days. Minuscule. And post IPO infosys laid the foundation well those days, sold the company well and was indeed a dream job at least for a little while. But that's ancient history now.


Indeed. Between roughly 1995-2000 it was the place to be. The hyper growth that followed post ~2002 brought in dilution in talent, benefits were cut (e.g. stock options were discontinued mid 2002) and the emergence of global companies opening India offices made it even less desirable.

There's a meme about Infosys' 3L/annum salary. Funnily that was exactly my starting salary there (post confirmation) in 2002.


Mine was 42K rupees :) annual. Since it is an old thread now hope no one is watching.


Some of the best actual hackers (not just pentesters and ctf winners) are in india.

About the infosys stuff, it's cultural, as in infosys' culuture or rather the culture that comes about when you have misaligned incentives between a 3rd party outsourcer and a cheapskate western company. They don't get paid for quality.

If you want to see talent there, look at the folks working for local companies, on their own or for multinationals.

But you know, even in US companies that don't outsource I have seen that "infosys" culture of doing things low and slow and with maximum complexity and LoC and support cost, box checking "requirements",etc... Hire accenture or whoevee in the US and your experience would be similar.


> Some of the best actual hackers (not just pentesters and ctf winners) are in india.

How do you know this?


I was involved a bit on bug bounty platforms like hackerone before, a very large percentage of the security researchers are from India. What's more fascinating is if you look them up on infosec Twitter, you see a lot of them are from these remote villages, where the security bounties are probably decent money for them.


> "Everyone’s hackable"

Is that like when Wonder Woman tells the little girl in the foiled bomb plot she can do anything she wants? The little girl should have asked when she can deflect bullets with her arm bands.



India has a hacking industry?

Seriously, I can understand scamming industry presence in India, but hacking industry, if at all present will be very nascent.

Edit: In the title it suggests "confession", but it most likely was bragging :)


If their hacking ability is anything like the engineering ability you can contract then I am not worried.


If you're unable to hire quality talent, that's either because you can't afford the market rate or because you are incompetent. I don't know why you would want to advertise this.


Pretty extreme hot cake, don't you think?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: