Ehraz Ahmed

Ehraz Ahmed
Born	(1996-07-26) July 26, 1996 Mysuru, Karnataka, India.
Education	P.E.S. College of Engineering
Occupation	Security Researcher fintech professional entrepreneur

Ehraz Ahmed (Hindi: एहराज़ अहमद, born July 26, 1996) is an Indian Entrepreneur, FinTech professional and Security Researcher. He is one of the most renowned ethical hackers in India. He is known for securing the userdata of over 1 billion users by detecting security flaws in companies like Facebook, Justdial, Airtel and Truecaller. He is the CEO and founder of Voxy Wealth Management and Aspirehive.

Personal life

Ahmed was born in Mysuru, Karnataka, India, on July 26, 1996. In 2016, He joined PES College of Engineering to pursue B.E. in Computer Science and dropped out in 2017 to launch his Web Security company. During his 10th grade, his father survived a heart attack, and later, in 2019, he underwent open-heart surgery.

Career

At the age of 14, Ahmed began his entrepreneurial career by selling Game hosting servers and started a company that later provided web hosting. At 16, Ahmed was listed to 50 Security Researcher's Hall of fame for detecting security flaws in companies like Facebook, Twitter, Apple, and Microsoft. In 2016, Ahmed started his FinTech company, Voxy Wealth Management. In 2017, he started Aspirehive, a web security company. In 2019, he safeguarded the sensitive user data of over one billion users by finding security flaws in companies like Airtel, Justdial, Truecaller & SonyLiv.

Truecaller controversy

On 21 August 2019, Ahmed found a security flaw in Truecaller's login process that could have allowed attackers to access virtually any Truecaller account. Ahmed demonstrated the flaw to Republic World by sending out a few messages on Truecaller Chat from an invalid phone number that used to be Airtel's official prepaid customer care number. Later, In an email statement to Republic World, Truecaller said it investigated the issue with the security researcher and the flaw was not reproducible.

Justdial security flaw

On 10 October 2019, Ahmed found a security flaw in Justdial's Register API that exposed over 156 million accounts. The flaw allowed hackers to log into any Justdial account by placing the phone number in the username parameter. By doing so, this granted the hacker access to any person's Justdial account. In a filing to the Bombay Stock Exchange, Justdial acknowledged the vulnerability and said it could potentially be accessed by an expert hacker to gather basic user information. The company said the flaw had been fixed and that there was no theft of data or financial loss to the company, its users or customers.

Airtel security flaw

On 7 December 2019, Ahmed detected a security flaw in Airtel's Mobile Application API that exposed personal details of more than 325 million Indian users. The vulnerability could have allowed hackers to access the personal data of users by just using their mobile number. The security flaw in the Airtel app could have provided access to information such as the name of users, emails, birthday, residential address, and the IMEI number of the device on which the app was installed.

Airtel acknowledged the issue and fixed the flaw after it was notified about it by BBC. "There was a technical issue in one of our testing APIs, which was addressed as soon as it was brought to our notice", an Airtel spokesperson was quoted as saying by BBC.

On 13 December 2019, Business Insider listed Airtel's Security Flaw as one of the Biggest Data Breaches Of 2019.

Web Application for Covid detection

On 19 October 2020, Ahmed developed a Web Application to determine Covid infection in chest radiographs. The machine learning model was trained on the data set of 7,084 chest X-ray images of patients infected with COVID-19 and pneumonia.

Recent researches

On 12 November 2019, Ahmed detected a digital flaw in the Bounceshare app. Exploiting one of its Internal Application Programming Interface (API) allowed hackers to log into any Bounceshare account, bypassing the users’ phone number into the request. In response, it returned with the Access Token and RiderId. This Access Token can then be used to access any Bounceshare account.

A few days later, On 18 November 2019, Ahmed detected an API flaw in Nykaa Fashion's internal systems that allowed a potential attacker to log in to any user account. And on 23 November 2019, Ahmed discovered a security flaw in Truecaller that exposed user data as well as system and location information. Truecaller confirmed this information in a statement to Gadgets360 and fixed the flaw. The security vulnerability allowed hackers to inject malicious links as URLs for the profile picture, exploiting anyone who would view the attacker's profile by search or through a pop-up. This API flaw would, in turn, allow the hackers to steal IP addresses along with other user data.

A few weeks later, On 20 December 2019, Ahmed found a security flaw in SonyLiv that allowed attackers to fetch sensitive user information such as profile picture, email address, date of birth, name, and phone number of its registered users.

On 23 October 2020, Ahmed found a security flaw in Thrillophilia's API exposing sensitive user data of 2 million registered users. The flaw allowed hackers to fetch sensitive user data of any registered user bypassing their email address in the cURL request.

On 16 June 2021, Ahmed found a security flaw in Lazypay that allowed hackers to obtain user data such as their full name, gender, date of birth, and phone number.