Why Flipkart, Amazon, Snapdeal are Hiring Ethical Hackers

In January, one of India's major e-commerce firms discovered that someone has been buying goods on its platform for free for several months.

A hacker, operating from a small town in Uttar Pradesh, had exploited a loophole in its payment system to manipulate it and avail 100% discount on almost anything he purchased for about six months. It would have continued had it not been for another hacker - an ethical one - who spotted the loot and helped the e-commerce company save the day.

"We hacked in to the e-commerce platform from outside and were able to buy almost anything for free," said the 20-something ethical hacker who helped the company. "It may be little complicated for you to understand, but simply put, an algorithm was developed which manipulated the payment gateway in to reading duplicated discount codes," the youngster said.

E-commerce and mobile app-based service providers such as Amazon, Flipkart, Snapdeal, Paytm and Ola are increasingly roping in ethical hackers to look for loopholes in their system by continuously trying to hack into them from outside and report back to the company even as they grow their business in the country at an astronomical pace. In some cases these ethical hackers also help companies fix the glitch.

"We're in the job of finding flaws across people, process and technology of an organisation's digital set-up. We hack them with their permission and produce an overall maturity scorecard of the organisation providing the CEO/CFO the information about the overall cyber risk they are sitting on along with a roadmap to enhance the cyber security maturity of the organisation," said Saket Modi, CEO at Lucideus, an online cyber security firm.

And while the cyber security firms are working with marquee names, there is an air of confidentiality around these projects. Employees of Lucideus, for instance, are not even allowed to mention where they work anywhere on social networks.

Dishant Shah, co-founder of Spherical Defence Labs, another firm specialising in cyber-attacks, said many technology companies have woken up to the challenge of cyber threats as their business model is based around mobile applications and e-commerce. "Today hacks are highly targeted and lead to server crashes and corruption, implying massive losses for technology companies," he said.

Besides roping in hackers from outside to look for loopholes in their systems, these companies have also been hiring consultancies to create systems that can avert attacks. Paytm confirmed that the company ropes in external experts on a regular basis for compliance audit, vulnerability assessment and penetration testing of its infrastructure and applications. "We conduct internal as well as external penetration testing from third parties. Additionally, we've bug bounty program where people can report security vulnerabilities against us," said Nitin Misra, vice president at Paytm.

Snapdeal and Amazon did not respond to queries sent by ET as of press time Friday. "Many companies are deploying deception techniques called 'honeypots' in their systems so that whenever the hackers attack, they are routed to these fake servers," said Mukul Shrivastava, fraud investigation and disputes partner at Ernst & Young. "But there are many similar measures available, and companies, especially those whose business is dependent on technology, are deploying them to predict and defend cyber-attacks before it actually takes place," he said.

The risk from the hackers is on the rise. Last year, many Indian companies have been on the receiving end of cyberattacks. While the risk for all the companies remain the same, for technology startups it is a reputational risk that can kill the business model altogether.

Modi of Lucideus said, "Today the CEOs of most internet companies understand that their business relies on technology. So a loophole anywhere in their digital stack is no longer an IT problem but a top management problem, which sometimes even makes it to the agenda of board room meetings these days." He added that his company handhold its clients to implement a suggested plan.