"index of: pan card": how a Google search exposes India's ID documents

My timeline today is busy being shocked about DotPe. If you missed it, Deedy posted that DotPe, an Indian startup that raised around $100M to build point-of-sale systems for restaurants, has left its entire API public with zero auth. Someone used it to see the most-ordered items at every Social outlet and to prank-order food for the next table.

People are surprised. I’m not, and I said so in a quote tweet:

Try a simple Google search for “index of: pan card” and you’ll be shocked to discover a trove of sensitive personal documents readily available on open FTP servers belonging to supposedly ‘secure’ websites of NBFCs, Universities and even Government offices.

That one kind of blew up!

Took me 10 seconds

To show I’m not exaggerating, I replied to myself with screenshots:

Took me 10 seconds. Just a google search, no hacking involved.

I’m not putting those screenshots on this blog, not even blurred. They are raw server listings. One had row after row of files named like Pancard-pancard_image... and aadhar-aadhaar_image..., uploaded through 2023 and 2024. The other has files with people’s names in them, next to things like voter.jpg and WhatsApp Image.... Most of those rows are real people’s ID documents.

I’m not naming any of the servers either. I didn’t have to try hard to find them, and nobody else will have to.

What is an “Index of” page, anyway?

You’ve probably opened a URL at some point and landed on a plain white page titled “Index of /something”, with a “Parent Directory” link at the top and a list of files with dates and sizes. That’s a directory listing. Web servers like Apache can generate one automatically when a folder has no index page.

Trouble starts when that folder is where your app dumps customer uploads, and it’s reachable from the public internet. Now anyone can browse it like a file explorer. Google’s crawler counts as anyone too. It follows the links, indexes the listing, and your customers’ PAN cards are one search away.

There’s a whole family of search tricks for this, usually called Google dorking: using search operators to filter results by page title, file type or a specific site. I’m not writing a how-to here. The search itself is legal in most places, but what you do with the results can stop being legal very quickly.

And none of this is hacking. Nobody broke anything! The servers just hand the files to whoever asks.

It’s a rabbit hole

In one of the sub-threads I put it plainly: “It’s a rabbit-hole. The deeper you go, the worse it gets.”

A few other things I’ve said in the thread, because it’s all the same disease:

• Wait till you learn how many routers are still running on out-of-the-box configurations in government offices.
• To someone who called it complex: it’s not. SFTP has existed since 1997.
• A lot of places skip input validation because, apparently, it’s too hard.
• This is a big reason people are getting scammed left and right in India right now.
• License Raj still exists. It’s just hidden behind a digital layer now.

On DotPe specifically, someone pointed out it was a BOLA (Broken Object Level Authorization) issue, which falls under IDOR. Correct! But what I’m championing is a proper SecOps function inside an organisation. From an end user’s point of view, API sanitation and server hardening aren’t much different.

Why I think this is a startup opportunity

Someone in the replies asked whether there’s room for a data protection and security startup in India. That needed a longer answer, so here are my 2 cents. TL;DR: if you’re thinking about building a security startup in India, the time is ripe.

With Digital India, UPI and Aadhaar are part of daily life now, and we’re generating an unprecedented amount of sensitive digital data. Phones are only part of it. Your bread toaster might be running Linux and sharing your Wi-Fi with your vacuum cleaner, smart bulbs and fridge. If you’ve never been on shodan.io, take a peek and you’ll know what I mean.

From where I sit as a software engineer, AI and ML are changing threat detection, and they’re also creating new problems. As Indian businesses move to the cloud and remote work spreads, the attack surface keeps growing. Regulation is evolving, but slowly. So there’s a real gap for tools that make good security usable by everyone, from the local kirana shop owner to large corporations, and that fit how India actually does digital. I really do think SecOps is becoming as basic as any other utility.

And yes, I ended that tweet with this: if this inspires your billion-dollar security startup, remember who nudged you. A sprinkle of equity or a lifetime supply of chai would be nice.

The culture problem

Someone else asked a good follow-up: why is it like this? My answer was that it comes down to the complicated attitude the Indian tech industry has towards security.

Historically, a lot of companies here have got defensive when someone reports a vulnerability. They threaten legal action instead of saying thank you. That scares off ethical hackers and security researchers, and the issues get swept under the rug.

It is slowly changing. X has made it much easier to report and discuss security issues in public, and a bit of name and shame can force a company to act. DotPe is a good example: researchers like @prstb disclosed it responsibly, it got attention, and it got fixed. But companies need to understand that not every hacker is a good samaritan. For every public disclosure, there could be several exploits happening silently.

What I want to see is Indian tech companies building an actual culture of security, with bug bounty programs and responsible disclosure policies. That protects user data and builds trust, and it saves you some bad PR along the way.

I’ve worked on GDPR efforts at Uber and on HIPAA and data residency compliance at Atlassian, where the whole point is protecting customers’ personal and health data. We’re moving in the right direction, but there’s still a long way to go, and both the industry and users need to keep pushing.

One book, if this stuff fascinates you

In the rabbit-hole sub-thread I also said nothing ever changes, and recommended one of my favourite books of all time: Ghost in the Wires by Kevin Mitnick. It will blow your mind how auth used to work back in the 90s and 00s.

(Affiliate link: I may earn a small commission if you buy through it.)

🚨 To those who are surprised by this incident, I'd like to offer a sobering reality check. Try a simple Google search for "index of: pan card" and you'll be shocked to discover a trove of sensitive personal documents readily available on open FTP servers belonging to supposedly…

@jatinkrmalik, 23 September 2024

Took me 10 seconds. Just a google search, no hacking involved.

@jatinkrmalik, 23 September 2024

@prdeator_ash It's a rabbit-hole. The deeper you go, the worse it gets.

@jatinkrmalik, 24 September 2024

@avshkx Yes! You are correct, this vuln here is under BOLA (Broken Object Level Authorization) and hence under IDOR. But, the idea I am championing here is to have a proper SecOps within an organisation. API sanitation or Server hardening aren't much different from an end user…

@jatinkrmalik, 24 September 2024

➡️ Here's my 2 cents! TL;DR: For those considering a security startup in India, the time is ripe to make a significant impact. The potential for data protection and security startups in India is undeniably significant. As we embrace the Digital India initiative, with UPI and…

@jatinkrmalik, 24 September 2024

@engineer_decent You raise an excellent question, and the answer lies in the complex attitude of the Indian tech industry towards security. Historically, many companies have reacted defensively when informed about vulnerabilities, often threatening legal action against those who report breaches…

@jatinkrmalik, 24 September 2024

‹ 1 / 6 ›