Instead Of Duping Air India & Other Airlines, This Ethical Indian Hacker Decided To Help Them

In the world of hacking, it's seldom that victims are offered help and notified about a technical glitch that could land them in a huge financial loss.

We've seen how hackers steal data and sell it for millions, misuse the system once they get access to credible information and what not. However, this kid, who could have easily travelled the world for free didn't do that.

20-something Kanishk Sajnani is not your everyday geek and you'd nod in affirmation after reading his mindblowing story.

With a passion for hunting gold and no intention to harm anyone, Kanishk hacked into a dozen of Indian websites, all within last month, and it then when he stumbled upon major technical glitches.

He then brought it to the attention of Air India via email.

He sent his first mail on 4th November 2015 and did not hear anything until 12th November, but then he received a phone call from them. On 12th, the finance manager of Air India called him and asked him to validate the trustworthiness of the vulnerability.

In order to prove his point and the vulnerability he stumbled upon, Kanishk booked himself a ticket to The United States Of America, only for re.1.

In a detailed mail, along with a video, he explained exactly how he did that. As he wished, Air India even offered him an internship, but he didn't take it.

In a similar vein, just a couple of days before this event, he booked a flight to Goa from Ahmedabad for rs.4, with was priced at ?4028. He took this as an opportunity to inform SpiceJet about this but was highly misunderstood.

Below is the reply he got from GM, Mr Pradeep Shah, who asked him to share the details of the vulnerability.

"They sent me our previous correspondence in a .eml type file attached *Double Facepalm * This time the mail was signed by their Nodal Officer. Either they didn¡¯t understand the point I made Or they didn¡¯t like to acknowledge the fact that their security was compromised. " he wrote.

After these two, he found another vulnerability in ClearTrip's payment system and decided to write to them, just like before.

He then began explaining it to Neeraj Nayan, the man in charge, and the company was also up for giving Kanishk a reward if his claims were proven.

He then wrote a mail, explaining everything, but things didn't turn out to be as expected. After this, Kanishk's mail went unnoticed and unaddressed. When he wrote to ClearTrip's founders about it, even they chose to stay mum on the situation.

However, he did order Biryani a couple of times, for just Re. 1 and somehow no one noticed.

He then informed the company about the issue and they hired a security firm.

"Air India, SpiceJet, Cleartrip, Mobikwik & Faasos were the only companies I ever corresponded with. Never informed the rest of them about any Loopholes. For the same reason, I never mentioned any technical details in this article. Compromised list may still include some E-commerce websites, Home services, Travel agencies, Educational Institutions, Government applications, etc"

You can read his entire blog here.