Inspired by Mr. Robot’ Elliot Alderson, Robert Baptiste has been exposing security flaw in popular applications, smartphones and other online services
TECH Updated: Mar 20, 2018 13:28 Ist
|
|
Kul Bhushan
Hindustan Times
|
A sceengrab of Alderson’s Twitter profile picture.(Elliot Alderson)
Elliot Alderson, a Twitter alias inspired by a character in popular TV series Mr. Robot, has his own cult following on the social media platform. Just like Mr. Robot’s Alderson, he has taken upon himself to expose serious security flaws in several applications, smartphones and other internet services. But he’s primarily known for finding flaws in India’s massive biometric-based programme, Aadhaar.
Earlier this year, Alderson claimed to have found a massive loophole in the Aadhaar’s mobile application on Google that allowed anyone with basic coding knowledge to gain users’ data. The alleged flaw expose gained wide media attention as it came shortly after a Tribune report disclosed that full Aadhaar details was being sold for mere Rs 500 by anonymous sellers.
Knowing the man behind Elliot Alderson
Elliot Alderson’s real name is Robert Baptiste, or at least he tells us so. Robert describes himself as a French developer who develops applications for Android platform and customise AOSP (Android Open Source Project) for smartphone companies. By profession, he’s a network and telecommunications engineer.
When asked about whether he considers himself as a whistleblower, Robert said, “I consider myself as a random guy. I am not special or whatever. As I said multiple times, I encourage people to do the same thing.”
Robert says he follows a “standard process” to find vulnerabilities and doesn’t have a team. But he does get tip off from his followers.
“I have a standard process, nothing fancy. I am working alone. However, a lot of my followers shared what they find because nobody listen to them or they are afraid to be harassed,” he said.
Why Aadhaar?
When asked about why has he a special interest in the Aadhaar programme, he responded, “Aadhaar is interesting by his scale. This is a gigantic project with a lot of security implications.”
“I will not give an opinion on Aadhaar as I don’t think I’am legitimate. However, I think this project deserve the maximum [security],” he said.
Hi #Aadhaar ! Can we talk about the #BenefitsOfAadhaar for the #India population?
I quickly check your #android app on the #playstore and you have some security issues...It's super easy to get the password of the local database for example...
I quickly check your #android app on the #playstore and you have some security issues...It's super easy to get the password of the local database for example...
Is it possible to have 100% privacy in modern digital era? “This is complicated, very complicated but you can be close to 100%, yes,” he added.
Read more
|
|
|
|
|
|
|
|
|
|
Alderson’s other work
Apart from Aadhaar, Alderson has found some security flaws in OnePlus phones in the past. Earlier this year, he pointed out that OnePlus’ clipboard application came with a strange file called “badwords.txt” which was transmitting data to a company called TeddyMobile. The data was being shared without the knowledge. OnePlus later acknowledged the issue and said that the code was just meant for China and was inactive in other markets.
All these files are used in a obfuscated package which seems to be an #Android library from teddymobile
TeddyMobile is a Chinese company, they worked with a lot of manufacturers including @oppo.
Most recently, Alderson and a few other Twitter users pointed out that Paytm was seeking root access to users’ devices. Alderson also got into a brief Twitter tussle with Paytm’s Deepak Abott over the issue. Paytm later removed the root request.
After this tweet, @Paytm contact me in private. Today, according to them, they remove remotely this root rights request. Do you confirm it?
