Published
Apr 1, 2018, 6:27 am IST
Updated
Apr 1, 2018, 6:27 am IST
Fingerprints should never be saved on local computers, says cyber expert.
Prasanna
Chennai :The state governments vested with the role of collecting personal details from public for Aadhaar purpose had failed to understand the seriousness of data leak and most of the outsourced portals and websites that deal with Aadhaar, lack adequate cyber security measures, making Aadhaar data vulnerable for the data breach, opines J. Prasanna, cyber security expert, cyber security and foundation Pte Ltd. In an interview with DC, Prasanna explains that the breach is not in the Unique Identification Authority of India (UIDAI), but the state governments, which execute the project had messed it up.
Elliot Alderson kicked up a storm across the country when he leaked details of close to 20,000 Aadhaar cards on the Internet and shared samples of fingerprint data on his handle. How can the state government be held responsible for this?
On an Aadhaar system where you can do fingerprint authentication, the print should not be saved on the local computer, but directly transmitted. Digital fingerprint would normally be 8 bit to 128 bit digital signature. So, when you put a fingerprint, it converts into a string (it will be 8 bit or 128 bit), which is transmitted at the backend and the hashes of the two strings are compared. The fingerprint is never sent to the back end system. That is the normal security process. What the guys collecting have been doing is that, they are actually storing the fingerprint themselves. In a credit card system, every payment gateway does not store credit card number. Same way they should not store fingerprint locally. They should directly transmit it and authenticate it with Aadhaar system.
Can you give an example about the involvement of third party websites of the state government, which is eventually messing up the system?
In every Aadhaar, there is be a string at the bottom saying "Mera Aadhar Mera Pehchaan". Do a google search for this string with the file type PDF. You will get hundreds of results in government sites and various forums. Some of them have been recently taken off after leaks from Elliot. Yet, few government sites still have this broken authentication, where they upload all these Aadhaar card insights without securing the directory. That means you go and visit the URL, download the files to get access to actual Aadhaar cards. Ofcourse, the biometric is not there. But, Aadhaar is enough to do crazy stuff. One can reprint another Aadhaar card, change the picture and appear anywhere.
In every Aadhaar, there is be a string at the bottom saying "Mera Aadhar Mera Pehchaan". Do a google search for this string with the file type PDF. You will get hundreds of results in government sites and various forums. Some of them have been recently taken off after leaks from Elliot. Yet, few government sites still have this broken authentication, where they upload all these Aadhaar card insights without securing the directory. That means you go and visit the URL, download the files to get access to actual Aadhaar cards. Ofcourse, the biometric is not there. But, Aadhaar is enough to do crazy stuff. One can reprint another Aadhaar card, change the picture and appear anywhere.
How is Tamil Nadu in terms of cyber security of Aadhar?
In Tamil Nadu, still there has not been much breach, which has been reported. It was reported mainly in Andhra and Maharashtra. But, the government must take precautionary measures. Currently they are only focusing on the benefits of Aadhaar and not cyber security where they are falling short.
In Tamil Nadu, still there has not been much breach, which has been reported. It was reported mainly in Andhra and Maharashtra. But, the government must take precautionary measures. Currently they are only focusing on the benefits of Aadhaar and not cyber security where they are falling short.
What needs to be done?
UIDAI should start with using the web to find data breaches on third party websites. Identify and go behind all the third party service providers and state governments to fix vulnerabilities on cyber security front. Also, any portal that works with UIDAI should be subjected to cyber security vulnerability assessment to find the vulnerability before they can actually allow them to connect to their system. Stringent laws should be applied even on governments, which are not taking personal ID or Aadhaar act more seriously.
UIDAI should start with using the web to find data breaches on third party websites. Identify and go behind all the third party service providers and state governments to fix vulnerabilities on cyber security front. Also, any portal that works with UIDAI should be subjected to cyber security vulnerability assessment to find the vulnerability before they can actually allow them to connect to their system. Stringent laws should be applied even on governments, which are not taking personal ID or Aadhaar act more seriously.
For this, do we have enough cyber security personnel?
No. Most of them claim to be cyber security personnel, but there is not enough skill for the job. The government must start recruiting white hat hackers who can actually work with security team or application development team to give them insights on how to build security.
No. Most of them claim to be cyber security personnel, but there is not enough skill for the job. The government must start recruiting white hat hackers who can actually work with security team or application development team to give them insights on how to build security.
