- Saurabh Singh
- New Delhi
- March 24, 2018
- Follow @singh_saurabh10
A data leak on a system run by a state-owned utility company can potentially allow hackers to access private information of every Aadhaar holder in India, if a new ZDNet report is to be gone by. The data leak affects potentially every Indian citizen subscribed to the Aadhaar program, according to the report, exposing names, their unique 12-digit identity numbers, and also information about services they are connected to, such as their bank details. The government of India, the report adds, knows about the data leak but is yet to take any concrete steps to fix the loophole.
First spotted by Karan Saini, a New Delhi-based security researcher, the leak has apparently stemmed from a non-secure API that the unnamed utility provider relies on to access the Aadhaar database in order to verify a customer's identity.
Specific details about the utility provider, as well as the vulnerability have been withheld from the public at this point of time, in the report, citing security concerns. What's being shared, however, is that the vulnerable API's endpoint -- which is an unspecified URL -- uses a hardcoded access token that can allow anyone with a little technical know-how to query Aadhaar numbers against the database without requiring any additional piece of authentication.
The reported vulnerability can be exploited to access private data of any Aadhaar holder, regardless of whether he/she is a customer of the utility provider or not. What makes matters worse is that the non-secure API doesn't have any rate limiting in place which means hackers can sift through every permutation of Aadhaar numbers and retrieve private information each and every time they stumble upon a successful result.
Running a few Aadhaar numbers from friends who gave him permission, through the endpoint, saw Saini successfully getting a hold of an Aadhaar holder's full name and their consumer number, as also their connected bank details, more specifically the name of the bank the person used. Although the report mentions no further bank details were churned out, the fact that bank details, at all made the cut is in sharp contradiction to the Unique Identification Authority's (UIDAI) claims that the Aadhaar database does not keep any information about bank accounts. A similar stance was also recently conveyed by Union IT Minister, Ravi Shankar Prasad.
"From the requests that were sent to check for a rate limiting issue and determine the possibility of stumbling across valid Aadhaar numbers, I have found that this information is not retrieved from a static database or a one-off data grab, but is clearly being updated -- from as early as 2014 to mid 2017. I cannot speculate whether it is UIDAI that is providing this information to [the utility provider], or if the banks or gas companies are, but it seems that everyone's information is available, with no authentication -- no rate limit, nothing," Saini was quoted by ZDNet as saying.
The revelations, in the report, come at a time when the government of India is arguing in front of the Supreme Court, how safe and secure its unique ID system was. The government of India has, in fact, told the Supreme Court that Aadhaar data taken from millions of Indians was safe behind 5-feet thick walls, reiterating it can't be breached. The report, however, makes stark claims that the government of India is aware of the purported flaw in the system, and yet it has done nothing to fix the flaw. The report, further adds, that it would publish further specifics once the flaw has been fixed.
