Aadhaar security lapse could allow major chunk of information to be stolen, says data security expert

By Alison Saldanah

For the second time in the first three months of 2018, the vulnerabilities of the Aadhaar programme €" the world's largest biometric database €" were exposed when American business technology website ZDNet >reported on 23 March 23, 2018, that the personal data of millions of enrolled Indians could be accessed through unsecure websites and mobile apps of third-party agencies that use the identification system for authenticating transactions.

Aadhaar comprises a unique 12-digit number assigned to Indian residents. As of 29 March, 2018, more than 1.2 billion Indians €" or 99.7 percent of the population €" have enrolled in the programme. The database, which is fast becoming an integral part of Indian policy, includes fingerprints, iris scans and demographic details of every enrolled individual. From 1 July, 2018, the system will also include facial recognition for identity authentication purposes.

One night in mid-February 2018, in 30 minutes, data security expert Karan Saini, who identifies as a "white-hat" hacker (one who improves security by exposing vulnerabilities before malicious hackers or "black-hat" hackers can detect and exploit these), found the vulnerable point in the Aadhaar database through Indane, a commercial distributor of liquefied petroleum gas (LPG), owned by Indian Oil, a public-sector company. Indane, the second-largest marketer of LPG globally, caters to 110 million households across the country.

Fearing prosecution from the government, Saini reached out to a reporter at ZDnet to notify the Unique Identity Authority of India (UIDAI), in-charge of programme, of the security lapse.

Through Indane, not only could Saini gain access to the Aadhaar numbers, demographic and biometric data of several Indian residents, but also view details of where these individuals hold bank accounts, and what other services their Aadhaar numbers are linked to.

Prior to this, on 3 January, 2018, The Tribune, a Chandigarh newspaper, >alleged in an investigation that unrestricted access to details of over one billion Aadhaar numbers could be purchased for as little as Rs 500.

Since its inception in 2011, Aadhaar has been caught in several debates, especially over privacy issues and information leaks. In the absence of a privacy law, lawyers and activists, who have challenged the Aadhaar Act, which essentially now mandates the enrollment of all citizens, as IndiaSpend reported in March 2017, argue that once the programme is linked to various services it will offer the government too much information too easily about individuals.

The UIDAI has dismissed these fears, maintaining that the central database, guarded by a 13-feet-high and five-feet-thick wall, is safe and insists the programme is a "serious effort to end corruption". Arguing for the constitutional validity of Aadhaar, the UIDAI has denied Saini's finding and The Tribune report of security lapses in the system during a Supreme Court (SC) hearing on Tuesday, 27 March, 2018.

"There has not been one data leak till date," Ajay Bhushan Pandey, chief executive officer of UIDAI, told the SC.

In an interview with IndiaSpend, Saini, a freelance information-security professional based in New Delhi, discusses data security and privacy concerns in Aadhaar. Saini, occasionally also participates in "bug bounty programs" that involve identifying and reporting security vulnerabilities to companies. He has worked with Twitter, Uber and the US Department of Defence.

What prompted you to check the third-party security of Aadhaar data and what exactly did you find?

I started looking into the vulnerabilities of Aadhaar on a whim. On the Apple App Store, I found this mobile application 'Aadhaar Status' offered by Indian Oil, which claimed to allow you to check your Aadhaar seeding status with Indane. I started to dig into the app and the API [Application Program Interface] it used to access and retrieve Aadhaar data. I wanted to see if it had any security measures in place, and if so, whether and how they could potentially be bypassed. In a few minutes, I was able to determine that a few key countermeasures could be put in place to access the data for an endpoint as sensitive as this.

Sources by:YAHOO!NEWS