Exclusive: The data leak affects potentially every Indian citizen subscribed to the database.
By Zack Whittaker for Zero Day | March 23, 2018 -- 20:00 GMT (01:30 IST) | Topic: Mobility
Another data leak hits India's national identity database, Aadhaar. (Image: file photo)
India's national ID database has been hit by yet another major security lapse.
Known as Aadhaar, the government ID database is packed with identity and biometric information -- like fingerprints and iris scans -- on more than 1.1 billion registered Indian citizens, official figures show. Anyone in the database can use their data -- or their thumbprint -- to open a bank account, buy a cellular SIM card, enroll in utilities, and even receive state aid or financial assistance. Even companies, like Amazon and Uber, can tap into the Aadhaar database to identify their customers.
Enrolling in the database isn't mandatory, but Indian citizens who aren't subscribed are unable to access even basic government services. Other countries are set to follow India's lead.
But the system has been dogged with security problems -- including, according to India's Tribune, a data breach. India's ruling Bharatiya Janata political party later called the report "fake news."
Now, the database is leaking information on every Aadhaar holder, a security researcher has told ZDNet.
A data leak on a system run by a state-owned utility company can allow anyone to download private information on all Aadhaar holders, exposing their names, their unique 12-digit identity numbers, and information about services they are connected to, such as their bank details and other private information.
Karan Saini, a New Delhi-based security researcher who found the vulnerable endpoint, said that anyone with an Aadhaar number is affected.
Yet the Indian authorities have done nothing to fix the flaw. ZDNet spent more than a month trying to contact the Indian authorities, but nobody responded to our repeated emails.
We later contacted the Indian Consulate in New York and alerted Devi Prasad Misra, consul for trade and customs. Over two weeks, this issue was explained in detail, and we responded to many follow-up questions. A week passed, and the vulnerability was still not fixed. At the start of this week, we told the consul that we would publish our story on Friday and requested comment from the Indian government.
The consul did not respond to that last email. At the time of publishing, the affected system is still online and vulnerable. For that reason, we're withholding specific details about the vulnerability until it's fixed. (Once it has been fixed, we will update the story with additional details.)
The utility provider, which we are not naming, has access to the Aadhaar database through an API, which the company relies on to check a customer's status and verify their identity.
But because the company hasn't secured the API, it's possible to retrieve private data on each Aadhaar holder, regardless of whether they're a customer of the utility provider or not.
The API's endpoint -- a URL that we are not publishing -- has no access controls in place, said Saini. The affected endpoint uses a hardcoded access token, which, when decoded, translates to "INDAADHAARSECURESTATUS," allowing anyone to query Aadhaar numbers against the database without any additional authentication.
Saini also found that the API doesn't have any rate limiting in place, allowing an attacker to cycle through every permutation -- potentially trillions -- of Aadhaar numbers and obtain information each time a successful result is hit.
He explained that it would be possible to enumerate Aadhaar numbers by cycling through combinations, such as 1234 5678 0000 to 1234 5678 9999.
"An attacker is bound to find some valid Aadhaar numbers there which could then be used to find their corresponding details," he said. And because there is no rate limiting, Saini said he could send thousands of requests each minute -- just from one computer.
When Saini ran a handful of Aadhaar numbers (from friends who gave him permission) through the endpoint, the server's response included the Aadhaar holder's full name and their consumer number -- a unique customer number used by that utility provider. The response also reveals information on connected bank accounts, said Saini. Screenshots seen by ZDNet reveal details about which bank that person uses -- though, no other banking information was returned.
That seems to contradict a tweet by India's Unique Identification Authority (UIDAI), the government department that administers the Aadhaar database, which said: "Aadhaar database does not keep any information about bank accounts."
Another tweet on the same day by Ravi Shankar Prasad, India's minister for electronics and information technology, also said: "Aadhaar does not save the details of your bank account."
The endpoint doesn't just pull data on the utility provider's customers; the API allows access to Aadhaar holders' information who have connections with other utility companies, as well.
"From the requests that were sent to check for a rate limiting issue and determine the possibility of stumbling across valid Aadhaar numbers, I have found that this information is not retrieved from a static database or a one-off data grab, but is clearly being updated -- from as early as 2014 to mid 2017," he told ZDNet. "I cannot speculate whether it is UIDAI that is providing this information to [the utility provider], or if the banks or gas companies are, but it seems that everyone's information is available, with no authentication -- no rate limit, nothing."
That data on the face of it may not be seen as sensitive as leaked or exposed biometric data, but it nevertheless contradicts the Indian government's claims that the database is secure.
India's former attorney general Mukul Rohtagi once said that a previous leak of Aadhaar numbers is "much ado about nothing."
But access to Aadhaar numbers and corresponding names increases the risk of identity theft, or could lead to impersonation.
It's long been believed that identity theft is one of the biggest issues faced by both UIDAI and Aadhaar number holders. It's been reported that linking Aadhaar numbers to SIM cards has led to stolen money and fraud.
The controversy surrounding the Aadhaar database has been ongoing. A month ahead of the Indian election in 2014, would-be prime minister Narendra Modi called the database's security into question.
"On Aadhaar, neither the team that I met nor PM could answer my [questions] on security threat it can pose. There is no vision, only political gimmick," said Modi in a tweet.
Now, his government is currently defending the identity scheme in front of the country's Supreme Court. Critics have called the database unconstitutional.
Until the court rules on the case, subscribing to the database won't be mandatory for Indian citizens. But that might not be much solace for those whose information has been already collected.
Zack Whittaker can be reached securely on Signal and WhatsApp at 646-755–8849, and his PGP fingerprint for email is: 4D0E 92F2 E36A EC51 DAAE 5D97 CB8C 15FA EB6C EEA5.
