A safety researcher says a bug on an Indian state authorities web site inadvertently revealed paperwork containing residents’ Aadhaar numbers, id playing cards, and copies of their fingerprints.
The bug was fastened final week after the safety researcher disclosed the bug to native authorities.
Sourajeet Majumder discovered the bug within the West Bengal authorities’s e-District net portal that enables state residents to entry authorities providers on-line, like acquiring beginning and dying certificates and constructing purposes. Majumder stated the web site bug meant it was attainable to acquire land deeds, which comprise information concerning the house owners of a bit of land, from the e-District web site by guessing sequential deed software numbers.
Software identification numbers are distinctive 16-digit numbers issued by the state authorities when a neighborhood resident applies for a digital copy of a deed.
{A partially} blurred copy of an uncovered West Bengal resident’s land deed.
Not each software identification quantity was legitimate. Utilizing publicly accessible instruments like Burp Suite to research the community site visitors out and in of the web site meant that Majumder might cycle via whole lists of sequential software numbers and use the responses from the server to find out if an software identification quantity was legitimate.
With entry to an software identification quantity, anybody with a login to the e-District system might entry a duplicate of a land deed. Two land deed information seen by TechCrunch comprise the names of the people concerned with the deed, their pictures, and their full set of fingerprints from each arms. It’s not unusual to see a number of people on a single deed.
The deeds additionally comprise the people’ government-issued id paperwork, together with their confidential Aadhaar numbers, which each and every citizen is assigned as a part of India’s nationwide id and biometric database. Aadhaar numbers are required for accessing banking, cellphone plans, and lots of authorities providers.
Majumder reported the web site vulnerability to India’s pc emergency response workforce, often called CERT-In, and the West Bengal authorities, fearing that the vulnerability might be misused for id fraud. The bug was fastened quickly after.
It’s not identified if anybody else aside from Majumder found the bug. Representatives for the West Bengal authorities and CERT-In didn’t return requests for remark. The West Bengal authorities’s e-District web site says it has processed greater than 17 million purposes so far, although it’s not identified what number of relate to land deeds.
Native media reviews a current rise in fraud linked to the alleged theft of biometric data, which criminals are stated to be utilizing to empty financial institution accounts.
