135 million Aadhaar numbers leaked through government portals, reveals report



Aadhaar sample

Centre for Internet & Society (CIS) has released a new report titled “Information Security Practices of Aadhaar (or lack thereof): A documentation of public availability of Aadhaar Numbers with sensitive personal financial information” that reveals that four government portals including National Social Assistance Programme (NSAP)’s dashboard and the National Rural Employment Guarantee Act (NREGA)’s portal have leaked around 130 to 135 million Aadhaar numbers publicly.


“While these numbers are only from two major government programmes
of pensions and rural employment schemes, other major schemes, who have also used Aadhaar for DBT could have leaked PII (personally identifiable information) similarly due to lack of information security practices,” says the report.

In the National Social Assistance Programme (NSAP) welfare programme, attributes listed in the databases of pensioners include Job card number, Bank Account Number, Name, Aadhaar Number, account frozen status. The report shows screenshots of sample pages to demonstrate it.

“While the details were masked for public view, someone with login access could get the details. When one of the url query parameters of website showing the masked personal details was modified from “nologin” to “login”, that is control access to login based pages

were allowed providing unmasked details without the need for a password,” adds the report.
Regarding the ill-conceived data driven policies and transparency measures without proper consideration to data security measures, the report said:
The lack of consistency of data masking and de-identification standard is an issue of great concern. As mentioned earlier, the masking of Aadhaar numbers does not follow a consistent pattern. In some instances, the first four digits were masked, while in others the middle digits were masked. Given the multitude of databases publicly available, someone with access to different databases could use tools for aggregation to reconstruct information hidden or masked in a particular database. Further, most of the databases we encountered were also available for download as spreadsheets. The availability of the information in datafied formats also facilitates the use of data analytics to aggregate information from various sources, thus, increasing the risk of data points from different sources coming together to enable reconstruction of masked or undisclosed information.
“It must be stated that since we began reviewing and documenting these portals, we have noticed that some of the pages with sensitive PII have now been masked, presumably in response to growing reports about Aadhaar Leaks,” says the report.

Even though over the last two months, some of information has been masked, it is not clear whether these government databases are still leaking data.

Source

Comments

Post a Comment

Popular posts from this blog

Samsung Galaxy S7 Press Image Surfaces

Image
Ladies and gentlemen, we now have what might be the very first renders that accurately present Samsung's Galaxy S7 and Galaxy S7 edge, both of which will likely be announced next month at MWC 2016 (on February 21, to be exact). Revealed by @evleaks , the renders seem to be press images that may have originated from Samsung (thus not being fan-made renders). In the past, @evleaks unveiled accurate images of many new smartphones ahead of their official announcements, so we're inclined to believe that the new renders are legit. As expected, the Galaxy S7 and S7 edge don't look too different from last year's Galaxy S6 and S6 edge. However, while the Galaxy S7 may keep the same 5.1-inch display of the S6, the Galaxy S7 edge could have a 5.5-inch screen, and its render seems to be supporting this idea. Minor design changes aside, the Galaxy S7 series should bring significant improvements over the S6 family, including water-resistance, microSD card support
Read more

Samsung Galaxy S6 Long Term Review

Image
First Of All I want to make it clear that this is review of Samsung Galaxy S6(32GB) indian version after the usage of 6 Months.So in This review I won't Be talking about the specifications But About Daily Life Usage Experience & Perfomance After Installing Many applications So Let's Move Forward BUILT As You People Might Be knowing That Samsung changed its design language with the s6 series as 6th Generation of S Series Is Made With The combination of Glass & Metal Infact Glass is used On both Sides Which Looks Gorgeous As it Refelects Different Colors In Different Lighting Conditions But At The same time makes it quite delicate & prone to Breakage of glass which cost quiet a lot to replace But Thankfully My Galxy S6 Is completely Fine Till Now as There Is No Breakage Of glass or any kind of sctraches although this is probably because i have used my s6 most of the time with the clear case on it. Once I aslo Accidentally Dropped It On the concrete Floor without
Read more

70,000 Le 1s smartphones sold out in 2 seconds in first flash sale on Flipkart

Image
LeEco (formerly known as Letv) today announced that it sold 70,000 Le 1s smartphones in just 2 seconds in the first flash sale at 12 noon on Flipkart. The company said that this is a new record in India. Yesterday Flipkart announced that it received over 5,30,000 lakh registrations for the smartphone within 10 days after registration opened. Today LeEco said that the registration number had reached a record high of 605,000 before the sale.   Incredible India! 70,000 Le 1s sold out in 2 secs today!! New industry record! #SuperPhoneLe1s 2nd sale: 9th of Feb. pic.twitter.com/2TpA0dBNml — LeEco India (@LeEcoIndia) February 2, 2016 “The history LeEco just created is about three incredible records. The largest number of phones sold out in a single flash sale, the shortest ever time for sale of such a large number of phones, and the highest pre-sale registration number,” said the company. LeEco launched the Le 1s smartphone in India last month at a price tag of Rs. 10
Read more