APK CONTAINS AndroidManifest.xml
An APK contains the application files, including AndroidManifest.xml.
Explicit Direction flagged Confidence 99% · Jack Rhysider EP 49 Details
“This showed him a file called [00:05:00] AndroidManifest.xml.”
Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
APK CONTAINS AndroidManifest.xml
An APK contains the application files, including AndroidManifest.xml.
Explicit Direction flagged Confidence 99% · Jack Rhysider EP 49 Details
“This showed him a file called [00:05:00] AndroidManifest.xml.”
Aadhaar web application weaknesses DISCOVERED_BY Elliot Alderson
Elliot says he found five or six issues in the Aadhaar web application after followers directed him to it.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“I found five or six different issue in their application”
Narendra Modi website upload vulnerability DISCOVERED_BY Elliot Alderson
Elliot discovered a vulnerability in Narendra Modi's website that allowed arbitrary file uploads.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“He discovered a vulnerability on it which allowed him to upload whatever file he wanted to their site.”
Firebase security rules misconfiguration DISCOVERED_BY Elliot Alderson
Elliot discovered the Firebase exposure while inspecting the Donald Daters application.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“Elliot took this Firebase URL that he found in the app and tried to see if he could see what’s in the Donald Dater’s database.”
63red API vulnerability DISCOVERED_BY Elliot Alderson
Elliot says he quickly found a major vulnerability in the 63red API.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“Very quickly I managed to find a big vulnerability in their API.”
Donald Daters database exposure INVOLVES Firebase security rules misconfiguration
The Donald Daters database exposure involved Firebase debug/security settings being left open.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“This is a scandal because they kept the debug sitting on Firebase.”
public Aadhaar-number exposure INVOLVES Aadhaar
The incident concerned Aadhaar numbers and cards exposed publicly online.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“Within three hours, Elliot found 20,000 Aadhaar numbers listed publically online”
Indane Aadhaar-number exposure INVOLVES web scraping
Elliot used an automatic scraper to enumerate the exposed Indane records and estimate the scale of the exposure.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“I wrote an automatic scraper in order to do my request automatically.”
“It was 6,700,000.”
Indane Aadhaar-number exposure INVOLVES Indane
The Indane exposure involved Aadhaar numbers of Indane users being accessible through modified URLs.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“The URL was a website called Indane. It’s a gas company in India”
“there was Aadhaar number of Indane users”
Mr. Robot MENTIONS Elliot Alderson
The show Mr. Robot has Elliot Alderson as its main hacker character.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“There’s a TV show called Mr. Robot. Elliot Alderson, he’s the main character. He’s a hacker.”
Robert Baptiste SAME_AS Elliot Alderson
Robert Baptiste uses Elliot Alderson as his Twitter identity and says he can be called Robert or Elliot.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“he said his name is Robert Baptiste”
“You can call me Baptiste, Robert, Elliot.”
Elliot Alderson USES Python
Elliot published the Python script used in his Aadhaar search challenge.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“he put his Google searches and Python script onto his GitHub account”
Elliot Alderson USES security research without authorization
Elliot performs vulnerability research on applications without explicit authorization, describing himself as between a white hat and a grey hat.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“I don’t have the authorization, the explicit authorization to find these kinds of vulnerabilities.”
“You can consider me between the white hat and the grey hat”
Donald Daters USES Firebase
The Donald Daters application uses Firebase as its online database.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“they used Firebase database, which is a service offered by Google”
63red USES JavaScript
The 63red application exposed JavaScript used to create its website-like interface.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“Elliot was able to see all the JavaScript used to create this website app”
Elliot Alderson USES Google search queries
Elliot used Google search queries to locate publicly exposed Aadhaar cards and numbers.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“with some pretty good search query, I found a lot of Aadhaar cards”
Elliot Alderson USES web scraping
Elliot created an automatic scraper to retrieve Aadhaar data from publicly accessible sources.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“I created an automatic scraper in order to retrieve all the data automatically.”
Elliot Alderson USES Reverse engineering
Elliot posts useful information about reverse-engineering and specializes in reverse-engineering applications.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“he’s posting real and useful information about reverse-engineering”
“he loves reverse-engineering them”
Elliot Alderson USES doxing
Elliot explicitly rejects characterizing his redacted publication about R S Sharma as doxing, while describing doxing as bad.
Uncertain Confidence 84% · Elliot Alderson EP 49 Details
“Doxing is very, very bad and people shouldn’t do it.”
“This is not doxing. The goal was not to dox him.”
Elliot Alderson USES Android
Elliot's expertise is in Android applications, and he began his career as an Android developer.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“Robert’s expertise is in Android applications”
“He started his career as an Android developer”
Elliot Alderson USES Have I Been Pwned?
Elliot checked R S Sharma's email address against Have I Been Pwned and found it in a breach.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“Elliot checked his e-mail in haveibeenpwned.com and yep, the e-mail was in a breach as well.”
Elliot Alderson USES APK
Elliot moved the Donald Daters APK to a computer, extracted its files, and decompiled the application.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“Elliot moved the APK from his phone to the computer, then he extracted the files from the APK and decompiled the app.”
63red is described as an app built using HTML5.
Explicit Confidence 95% · Jack Rhysider EP 49 Details
“you can just make the app in HTML 5 using JavaScript”
Donald Daters USES Android
Donald Daters is described as an Android application.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“a new Android application called Donald Daters”
Elliot Alderson USES GitHub
Elliot published his Aadhaar search queries and Python script on GitHub.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“onto his GitHub account and published it for everyone to see”