[Full-disclosure] Infosys TCS Wipro like companies don't know security basics?
Hi Security Experts, I have a question about the security track record of Indian IT vendors like Infosys, TCS, Wipro etc. An article about Indian IT vendors by an ex-employee of one of these companies is circulating in the different NITs (National Institute of Technology) of India today. My doubt is about this part of the article from http://susam.in/blog/re-infosys-tcs-or-wipro/#engineers : Many claimed that I am wrong about the poor standard of training in Infosys, TCS, or Wipro. I must tell them that I have attended some of these training programmes. Among the many horror stories pertaining to training in these companies, I'll share only one with you to make my point. In the training assessments, the instructors set question papers containing problems with code that invokes undefined behaviour and ask you to predict its output. 'It Invokes undefined behaviour' is not provided as an option you can select as the correct answer. Such training and knowledge is not only inaccurate but also very dangerous if you care about robustness and security of the software you create. I am trying to verify this by using Secunia. I can find plenty of Microsoft and Google security vulnerabilities [ http://secunia.com/advisories/search/?search=Microsoft+Google http://secunia.com/advisories/search/?search=Microsoft+Google%C2%A0] but none for Infosys TCS or Wipro [ http://secunia.com/advisories/search/?search=Infosys+TCS+Wipro http://secunia.com/advisories/search/?search=Infosys+TCS+Wipro%C2%A0]. What is the matter here? Indian software vendors are the best in the whole world in security matters or Secunia simply doesn't care about Indian software vendors? ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Infosys TCS Wipro like companies don't know security basics?
On Thu, 01 Dec 2011 07:24:14 +0530, Wonder Guy said: What is the matter here? Indian software vendors are the best in the whole world in security matters or Secunia simply doesn't care about Indian software vendors? Secunia doesn't care about little fish no matter which pond they're in. If an Indian software vendor created a browser and shipped as many copies as IE or Firefox has shipped, I'm sure Secunia would show some hits. Pick a few dozen Indian prodcuts that have shipped in fairly high volume. Then pick a similar sized sample of non-Indian products that shipped in similar volumes, and see what the expected number of Secunia entries would be for each sample. pgpNmRUrhTGyY.pgp Description: PGP signature ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Infosys TCS Wipro like companies don't know security basics?
Wonder guy, the basis of your conclusion are as ridiculous as your question. Microsoft and Google are products companies. Atleast TCS and Wipro are not. They are into offshore and managed business domains. Infosys is also into making custom solutions and they are all closed source. And none of the companies that you mentioned cater to the such a large audience as MS and Google do. Are you going to start looking for every single company in secunia and come up with such preposterous conclusions? - Wonderguy - TAS http://twitter.com/p0wnsauc3 -Original Message- From: Wonder Guy blrwonder...@gmail.com Sender: full-disclosure-boun...@lists.grok.org.uk Date: Thu, 1 Dec 2011 07:24:14 To: Full-Disclosure@lists.grok.org.uk Subject: [Full-disclosure] Infosys TCS Wipro like companies don't know security basics? ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Infosys TCS Wipro like companies don't know security basics?
Hi, No offence, I think you have a wrong perception with these companies, They are not into Zero day !!! They are just vendor specific support companies. you cannot expect an vendor specific support company to find Zero day and handle operations support both at same time. Sorry buddy that aint possible. I am working with the one you have mentioned what ever Vulnerability we identify are either for our vendors and we are not allowed by contractual agreement to published identified vulnerabilities to public domain. secondly If I am identifying some Zero day why would I share it on behalf of the company name . Hope this clears your doubt about security basics. thanks, On Thu, Dec 1, 2011 at 7:24 AM, Wonder Guy blrwonder...@gmail.com wrote: Hi Security Experts, I have a question about the security track record of Indian IT vendors like Infosys, TCS, Wipro etc. An article about Indian IT vendors by an ex-employee of one of these companies is circulating in the different NITs (National Institute of Technology) of India today. My doubt is about this part of the article from http://susam.in/blog/re-infosys-tcs-or-wipro/#engineers http://susam.in/blog/re-infosys-tcs-or-wipro/#engineers : Many claimed that I am wrong about the poor standard of training in Infosys, TCS, or Wipro. I must tell them that I have attended some of these training programmes. Among the many horror stories pertaining to training in these companies, I'll share only one with you to make my point. In the training assessments, the instructors set question papers containing problems with code that invokes undefined behaviour and ask you to predict its output. 'It Invokes undefined behaviour' is not provided as an option you can select as the correct answer. Such training and knowledge is not only inaccurate but also very dangerous if you care about robustness and security of the software you create. I am trying to verify this by using Secunia. I can find plenty of Microsoft and Google security vulnerabilities [ http://secunia.com/advisories/search/?search=Microsoft+Google http://secunia.com/advisories/search/?search=Microsoft+Google%C2%A0] but none for Infosys TCS or Wipro [ http://secunia.com/advisories/search/?search=Infosys+TCS+Wipro http://secunia.com/advisories/search/?search=Infosys+TCS+Wipro%C2%A0]. What is the matter here? Indian software vendors are the best in the whole world in security matters or Secunia simply doesn't care about Indian software vendors? ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Infosys TCS Wipro like companies don't know security basics?
On Thu, Dec 1, 2011 at 10:37 PM, TAS p0wnsa...@gmail.com wrote: Wonder guy, the basis of your conclusion are as ridiculous as your question. Microsoft and Google are products companies. Atleast TCS and Wipro are not. They are into offshore and managed business domains. Infosys is also into making custom solutions and they are all closed source. And none of the companies that you mentioned cater to the such a large audience as MS and Google do. Are you going to start looking for every single company in secunia and come up with such preposterous conclusions? Hi TAS, I never made any conclusions. I only asked a question and it was not a loaded question but a curious one. In case you missed it, here is the question once again: I am trying to verify this by using Secunia. I can find plenty of Microsoft and Google security vulnerabilities [ http://secunia.com/advisories/search/?search=Microsoft+Google ] but none for Infosys TCS or Wipro [ http://secunia.com/advisories/search/?search=Infosys+TCS+Wipro ]. What is the matter here? Indian software vendors are the best in the whole world in security matters or Secunia simply doesn't care about Indian software vendors? Thanks for the clarification that TCS and Wipro are not product companies. But I heard that Infosys makes banking products. But anyway, from all the replies to my email I am able to understand that Secunia is not listing vendors catering to small part of the software world. So that answers my question. Thanks TAS and everyone. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
