The move comes a month after, it was reported that Aadhar Data of a large number of farmers was leaked by the PM Kisan’s website.
New Delhi: The UIDAI (Unique Identification Authority of India) is said to have hired 20 ethical hackers to detect and fix vulnerabilities in the security system that guards the Aadhar data of the Indian Citizens as a part of the “bug bounty program”.
According to a news report by news 18, ethical hackers will be provided with UIDAI’s Identities Data Repository (CIDR) which stores the Aadhar data of 1.32 billion Indians. There have been instances in the past where Aadhaar details of people were leaked on the internet.
The move comes a month after it was reported that Aadhar Data of a large number of farmers was leaked by the PM Kisan’s website, which is designed for the welfare of the agriculture sector in India. “The website provides an endpoint, which returns information about the beneficiary. This endpoint was also sending Aadhaar numbers,” reported Gadgets 360.
The candidate should meet certain criteria to be selected among the 20 applicants, which are mentioned below:
In order to be selected by UIDAI, the applicants “should be listed in top 100 of the bug bounty leaders board such as HackerOne, Bugcrowd, or listed in the Bounty Programs conducted by reputable companies such as Microsoft, Google, Facebook, or Apple, etc.” As per the order, “…the candidate should be active in the bug bounty community or programs and should have submitted valid bugs or received bounty in the last one year”.
Moreover, the applicant is required to be an Indian resident and must have a valid Aadhaar number. The selected lot will also sign a non-disclosure agreement with UIDAI. If you are a current or former employee of UIDAI or one of its contracted technology support and audit organizations during the past seven years, you are not eligible for the work.
It further said, “In case more than 20 applications are received, then UIDAI reserves the right to evaluate and select top 20 suitable candidates…an independent committee shall be formulated to assess and verify the candidates’ credentials, past bug hunting records, or references and citations,” as per the order. There is no information available on whether or not these ethical hackers are paid remuneration for the exercise.
Lastly, the applicants “should be listed in top 100 of the bug bounty leaders board such as HackerOne, Bugcrowd, or listed in the Bounty Programs conducted by reputable companies such as Microsoft, Google, Facebook, or Apple, etc.” As per the order, “…the candidate should be active in the bug bounty community or programs and should have submitted valid bugs or received bounty in the last one year.”
As an independent media platform, we do not take advertisements from governments and corporate houses. It is you, our readers, who have supported us on our journey to do honest and unbiased journalism. Please contribute, so that we can continue to do the same in future.
