IndianMascot
Core Member
Another security lapse has exposed millions of Aadhaar numbers.
This time, India's state-owned gas company Indane left exposed a part of its website for dealers and distributors, even though it's only supposed to be accessible with a valid username and password. But the part of the site was indexed in Google, allowing anyone to bypass the login page altogether and gain unfettered access to the dealer database.
The data was found by a security researcher who asked to remain anonymous for fear of retribution from the Indian authorities. Aadhaar's regulator, the Unique Identification Authority of India (UIDAI), is known to quickly dismiss reports of data breaches or exposures, calling critical news articles "fake news," and threatening legal action and filing police complaints against journalists.
Baptiste Robert, a French security researcher who goes by the online handle Elliot Alderson and has prior experience investigating Aadhaar exposures, investigated the exposure and provided the results to TechCrunch. Using a custom-built script to scrape the database, he found customer data for 11,000 dealers, including names and addresses of customers, as well as the customers' confidential Aadhaar number hidden in the link of each record.
Robert, who explained more about his findings in a blog post, found 5.8 million Indane customer records before his script was blocked. In all, Robert estimated the total number affected could surpass 6.7 million customers.
We verified a sample of Aadhaar numbers from the site using UIDAI's own web-based verification tool. Each record came back as a positive match.
VIA: MSN Money
This time, India's state-owned gas company Indane left exposed a part of its website for dealers and distributors, even though it's only supposed to be accessible with a valid username and password. But the part of the site was indexed in Google, allowing anyone to bypass the login page altogether and gain unfettered access to the dealer database.
The data was found by a security researcher who asked to remain anonymous for fear of retribution from the Indian authorities. Aadhaar's regulator, the Unique Identification Authority of India (UIDAI), is known to quickly dismiss reports of data breaches or exposures, calling critical news articles "fake news," and threatening legal action and filing police complaints against journalists.
Baptiste Robert, a French security researcher who goes by the online handle Elliot Alderson and has prior experience investigating Aadhaar exposures, investigated the exposure and provided the results to TechCrunch. Using a custom-built script to scrape the database, he found customer data for 11,000 dealers, including names and addresses of customers, as well as the customers' confidential Aadhaar number hidden in the link of each record.
Robert, who explained more about his findings in a blog post, found 5.8 million Indane customer records before his script was blocked. In all, Robert estimated the total number affected could surpass 6.7 million customers.
We verified a sample of Aadhaar numbers from the site using UIDAI's own web-based verification tool. Each record came back as a positive match.
VIA: MSN Money