Indian financial news

Paul was arrested on July 4 for allegedly facilitating the scam in a police sub-inspectors (PSI) recruitment exam conducted in October 2021. The IPS officer was the head of the Karnataka Police Recruitment Cell between 2019 and 2021 when the alleged scam took place. The CID has alleged Paul was party to the recruitment scam.

The senior officer is alleged to have received Rs 1.36 crore that was collected by deputy superintendent of police Shanthakumar, working at the recruitment cell, as part of bribes to facilitate the selection of candidates following the recruitment exam.

Paul was arrested by the CID on the basis of statements provided by Shanthakumar, who has also been arrested, about the bribe to the Additional Director General of Police (ADGP).

The CID is also looking at investments in land made by the police officer in the region neighbouring Bengaluru in the names of family members—through his real estate and financial associates.

Sources in the CID said Paul’s associates were questioned in order to find the money trail from the recruitment scam and the payments allegedly made to the IPS officer.

As many as 40 candidates who wrote the police recruitment exam in Bengaluru last year have been accused of rigging their exam performances through bribes paid to officials at the recruitment cell.

The CID probe has found the staff at the recruitment cell accessed OMR answer scripts stored in a strong room in the cellar in the early hours of the day when no other staff was present in the cell or adjoining buildings.

They allegedly turned off the CCTV cameras and gained access to the strong room where they removed answer scripts of candidates who had paid a network of operators between Rs 30 lakh to Rs 85 lakh to score high marks.

The mostly blank OMR sheets of candidates who had paid bribes were filled up by the recruitment staff and their associates over several days early in the morning before other staff arrived for duty. The answer scripts were supposed to be under the custody of Paul.

The exam scam surfaced after it was found that one of the selected candidates, Veeresh H who obtained 121 marks in the exam, had only answered questions for 31.5 marks out of a total of 150 marks in the objective section.

The Karnataka government annulled the results of the exam on April 29 after the CID reported large-scale rigging of the results.

Jhunjhunwala was among the most influential market voices in Asia’s third-biggest economy, with an intense following among the nation’s growing horde of retail investors. The man also known as “Big Bull” was a fierce backer of the India growth story. His investing success earned him a cult-like following, with news of his trades occasionally sparking stocks to move by their daily limits.

On August 13, CloudSEK ’s threat intelligence arm, XVigil, found that BharatPay ’s backend database containing customers’ personal information, bank balance, and transaction data from Feb. 2018 to Aug. 2022 was leaked on a cybercrime forum.

BharatPay provides various digital financial services, including fund transfers and cash deposits, to customers as well as merchants by partnering with numerous distribution networks all across India.

According to the company website , BharatPay operates in 11 states with more than 50,000 retail outlets. The firm also offers prepaid cards which can be issued to a customer via its partner network.

Why is the data breach significant?

The compromised database includes user names, hashed passwords, mobile phone numbers, and in some cases, UPI IDs and email addresses as well. Official email IDs of several Indian insurance and banking firms were also recovered from the leaked database.

In addition to PII and sensitive financial data of users, researchers found that transaction data and API keys of online bill payment facilitators such as Patchway Recharge and Mr Robotics were also leaked. Furthermore, information pertaining to SMS vendors were also exposed in the data breach.

The leaked data includes callback response logs, which contains information about the transacting entity’s phone number, transaction ID, and the bank balance amount – all of which are very sensitive pieces of information. Transactions records, the researchers explain, are a vital piece of evidence for any financial dealings between two entities.

Leaked data containing PII and sensitive financial information puts users at the risk of being targeted by spear-phishing attacks, SMS phishing or smishing, and social engineering-driven exploits.

Furthermore, researchers tell us that the exposed could equip threat actors with information required to launch sophisticated ransomware attacks, data exfiltration, and maintaining persistence. “This information can be aggregated to further be sold as leads on cybercrime forums,” they add.

A CloudSEK researcher was able to procure the SQL dump from the threat actor via a source. A screenshot of the leaked database shared with ETCISO. A preliminary search on Truecaller with the leaked mobile numbers corresponds to the user names. Independent security researcher Sunny Nehra also confirms that the leaked data is legitimate.

The data dump included information of 32 partner banks and contact details of their employees as well. The listed partners include major banks such as Reserve Bank of India, State Bank of India, HDFC, Axis Bank, Syndicate Bank, Yes Bank, and Punjab National Bank, among others.

“The threat actor also had access to the API configurations database that allowed them to manipulate what is deduced to be discounts and commissions for finance plans from BharatPay,” researchers say.

Code shows BharatPay used outdated jQuery module & PHP version

The cause of the breach appears to be an outdated software version. According to CloudSEK’s researchers, the PHP version from the SQL dump was found to be Version 4.9.7, which was rolled out in October 2020.

Nehra tells ETCISO that the website used outdated jQuery modules. A sample he shared shows that the code uses a 2014 version. (see below)

/*! jQuery v2.1.1 | (c) 2005, 2014 jQuery Foundation, Inc. | jquery.org/license */

“The outdated jQuery has prototype pollution and other flaws as well,” Nehra says.

According to the NIST vulnerability database, prototype pollution ( CVE-2018-16487 ) enables hackers to inject properties into existing JavaScript language construct prototypes, thereby allowing object attributes to be altered.

The hacker can then propagate a Denial of Service (DoS) or remote code execution attack.

CloudSEK researchers recommend patching vulnerable and exploitable endpoints, not storing passwords in cleartext, and enabling multi-factor authentication.

Additionally, scanning for anomalies in user accounts could forewarn companies on possible account takeovers, they say.

BharatPay hacker had targeted Manappuram Finance, Airtel Payments Bank in the past

According to CloudSEK’s researchers, the threat actor (TA) has been active since March 2022 and has been observed targeting Indian financial institutions, such as Manappuram Finance and Airtel Payments Bank.

“The threat actor is believed to be a reliable source and has provided valid information in the past,” the researchers add.

The reputation of the threat actor on cybercrime forums and his meteoric rise is corroborated by researcher Sunny Nehra as well. The TA has a reputation score of 967 and has achieved ‘God status’ in a fairly short period of time.

Adding to the hacker’s popularity is also the fact that the leaked databases were sold at throwaway prices – just 8 credit point on the cybercrime forum.

Wankhede had come into limelight following the NCB’s high-profile raids in October 2021 on a Mumbai cruise after which the agency arrested actor Shah Rukh Khan’s son Aryan Khan and 19 others, and claimed to have seized some narcotics.