3 ms·
As a security researcher in india, Aadhaar is riddled with Security holes that are glaring. There is clear way to report these issues and nothing gets fixed. I
by captn3m0 9y ago
As a security researcher in india, Aadhaar is riddled with Security holes that are glaring. There is clear way to report these issues and nothing gets fixed.
I've had a possible-RCE vulnerability reported to UIDAI since February-2017 and there has been no action. The CERT-IN (Indian equivalent of CERT-US) has been aware of the issue, but there is no fix in sight.
The easiest to do exploits (fingerprint cloning) are already happening: https://www.medianama.com/2018/03/223-cloned-thumb-prints-used-to-spoof-biometrics-and-allow-proxies-to-answer-online-rajasthan-police-exam/ https://www.medianama.com/2018/03/223-cloned-thumb-prints-us...
- shripadk 9y agoNow that is news to me. I know UIDAI has handled the recent data leak from one of its partners horribly (even lodging an FIR against a news reporter). However, does the vulnerability you mention provide access to biometric data? For me personally, that is more of a concern than the metadata (name, address etc).
- captn3m0 9y agoIt is on a UIDAI-hosted system that has access to the CIDR, so it is possible.