Mirza Burhan Baig

Early life and background

Baig attended high school in Karachi. Someone hacked one of his personal accounts. [1]

Education

Baig completed FSC rather than A-levels. He graduated from a university with a bachelor's degree in computer science. He said he graduated in 2017, which he called a late graduation. He said he financed his own studies, and that he dropped several courses and took semester breaks because he was sent on a two-month assignment to Islamabad. [1]

He said he is pursuing a master's degree in Islamabad. He says no one at his university taught a certain course, and his teacher did not know much about it at the time. His final year project was a network scanner that he says exists only on a USB drive. [1]

Career

Baig started his journey as a web developer and a mobile application developer. He began bug bounty hunting in 2013. He worked for a company in Karachi for five years and was among the early staff of a company that grew from one room to about 30 people. Someone approached him for a security role because there were few people in the market for it. [1]

He was a resident engineer at a bank where a core banking solution was being developed. He was hired full time because few people in the market had security awareness. His office was across from his university in Karachi. He worked remotely for about a year. He says he has worked with many banks. [1]

He says he found hundreds of bugs in the past, but now has little time for it because dedicated time has to be set aside. He says he has five or seven listings for Facebook, Google and Microsoft. He taught young men at his home how hacking works. He said he started career counselling and awareness sessions. [1]

He suggested developing a system that manages internal audits by itself. He says he wants to build a product rather than only offer services. [1]

Views

Baig defines white hat hackers as people who use their skills for constructive purposes. He defines black hat hackers as people who use their skills for destructive purposes. He said HackerOne is the most famous bug bounty platform. [1]

He says the biggest problem in Pakistan is that people do not care enough about their own data. He says medical records are the best-selling item on the dark web. He says bank database staff usually cannot see customers' data. He says a VPN does not hide users, because the VPN company holds all of their data. [1]

He says Pakistan has no CERT, and people who want to build one are not allowed to. He says that in Pakistan, customers keep using an organisation even after it has been hacked. He says IT teams and security teams often block each other's work and create hurdles. He says that in the recent attacks in Pakistan, the common observation was many problems with system updates and patches. He says Pakistan will improve if its mindset changes, and otherwise stay the same or get worse. [1]

He said NADRA clarified that its biometric data did not leak from NADRA itself. He says biometric data can leak from endpoints such as SIM registration shops. [1]

He says he does not trust that end-to-end encryption exists in practice. He says companies that receive data on their servers can read it through some channel. He says Telegram and Signal were built so that users can stay anonymous. [1]

He says Pegasus used three exploits chained together. He says threat hunting is the hottest area in security today. He describes blockchain as a ledger system that can be used in the medical field, and says its future is very good and very secure. He says that if development is secure, nothing will be hacked. [1]

Personal life

Baig's family are accountants, and no one in the family knew what he was doing. He says he misses Karachi a lot. [1]

Timeline

2013

Began bug bounty hunting.[1]

2017

Graduated, which he called a late graduation.[1]

Appearances

Frequently asked questions

References

1. Pakistanis don't care about their own data . Thought Behind Things , 2021-12-15.