Researcher Uncovers Another Aadhaar Security Gap

The integrity of India’s Aadhaar national identity program is once again being called into question. The latest concerns come courtesy of Atul Nair, a security researcher who uncovered a severe vulnerability in the Pradhan Mantri Kisan Samman Nidhi (PM-Kisan) website that is used to provide financial relief to small farmers in the country.

The problem, according to Nair, is that one part of the PM-Kisan website would reveal individual Aadhaar numbers to anyone who cared to ask. It’s unclear if any hackers managed to exploit the vulnerability, but it would have been relatively easy for a cybercriminal to collect a large amount of personal information with a simple script.

Nair first discovered the vulnerability and reported it to the Indian government’s cybersecurity team in January, though the agency did not manage to fix the problem until May (and Nair tactfully waited until after that before discussing the issue on his blog). Even though the gap has been closed, it offers yet more evidence that the Aadhaar system seems to riddled with holes that create opportunities for potential hackers. A 2018 report suggested that cybercriminals were selling access to the Aadhaar database on the black market, while UIDAI, the agency that manages the system, tried to downplay a separate breach in 2019.

In that regard, UIDAI has argued that criminals cannot carry out identity theft with an Aadhaar number alone, since the 12-digit numbers are tied to an individual’s iris and fingerprint biometrics. However, that has not quelled concerns about information security, which kicked up again after the government retracted an alert that advised citizens not to share photocopies of their Aadhaar cards with businesses like hotels. The government retracted the statement to dispel public panic, but it’s unclear if the government has actually addressed the issue that necessitated the warning in the first place.

The PM-Kisan program was established in 2019. More than 110 million farmers have already submitted their Aadhaar numbers and their iris biometrics to register in the program. 

Source: TechCrunch

–

June 15, 2022 – by Eric Weiss