Hardcoded credentials and other issues in Tata Motors App
qtqtqt
84 points
17 comments
November 06, 2026
Related Discussions
Found 5 related stories in 131.2ms across 11,878 title embeddings via pgvector HNSW
- Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles EatonZ · 145 pts · July 27, 2026 · 47% similar
- About the compromised eMudhra intermediate CAs birdculture · 160 pts · October 28, 2026 · 47% similar
- A complete bypass of eMudhra’s 1FA OTP login system tensegrist · 170 pts · October 22, 2026 · 47% similar
- Oracle Security Alert Advisory – CVE-2026-91403 (eMudhra cert revocation) rayhaanj · 24 pts · October 21, 2026 · 46% similar
- 4 Real? Tracking exploitation and patching of eMudhra's weak keys pure-orange · 11 pts · October 30, 2026 · 45% similar
Discussion Highlights (7 comments)
Titan2189
Page doesn't load for me
qtqtqt
Tata says the issue has been fixed and there were no leaks: https://auto.timesofindia.com/news/cars/tata-motors-says-ira...
richbell
Par for the course. https://eaton-works.com/2025/10/28/tata-motors-hack/
tpowell
I feel like I just got a telegram... love the website.
monster_truck
As the person who had to rush out an update to MyFordMobile because some enterprising windows phone nerd ganked the hardcoded creds out of their Android app to build a winphone app that allowed you to authenticate against their backend and remotely start/unlock your car, which they _really_ did not like... Many such cases. And no, I was not the one who did that in the first place
axegon_
Though I have been critical of LLMs in general, I have to give them credit for being really good digging out stuff that me as a human would find tedious. As such, I have my own LOCAL clanker that I use for two things: as a rubber duck and dump an apk with apktool inside a locked up container and let it go nuts. I've done it on numerous popular apps and it has found countless hardcoded credentials and keys in them. Just about all apps really, so far I think there's only been one that hasn't had THIS particular problem(it did have countless others though).
hecturchi
The developers have probably surrendered their identities and the apps got reviewed, verified, and can be distributed to end users via official stores, so it can't be so bad because they keep users safe. Funny that the verification step doesn't include scanning for hard coded credentials though. How do they detect malware if they don't decompile?