Elliot Alderson, a French security researcher claimed that the privacy of 90 million Indians is at stake & later released a detailed article about the issues.
New Delhi| Aarogya Setu, the app which is flagged for privacy issues, is a contact-tracing app developed by the National Informatics Centre (NIC) under the Ministry of Electronics and Information Technology.
Late on Tuesday, the official handle of the app stated that āno data or security breach had been identifiedā in the app.
The reply apparently came in acknowledgement to a tweet by Elliot Alderson, a French security researcher, earlier in the day, who claimed that the privacy of 90 million Indians is at stake.
Hi @SetuAarogya,
A security issue has been found in your app. The privacy of 90 million Indians is at stake. Can you contact me in private?
Regards,
PS: @RahulGandhi was right
— Elliot Alderson (@fs0c131y) May 5, 2020
The Aarogya Setu application is available on the PlayStore and 90 million Indians have already installed it.
Elliot says that with just 1-click an attacker can open any app internal file, including the local database used by the app called fight-covid-db.
This was on April 3, 2 days after the launch of the application.
On May 4, the ethical hacker says he noticed that the issue described previously had been fixed silently by the developers.
“In the app, you have the ability to know how many people did a self-assessment in your area. You can choose the radius of the area. It can be 500m, 1km, 2kms, 5kms or 10kms,” he writes.
“Thanks to this endpoint an attacker can know who is infected anywhere in India, in the area of his choice. I can know if my neighbour is sick for example. Sounds like a privacy issue for meā¦”
“So I decided to play with it a little bit and checked who was infected in some specific places with a radius of 500 meters”
And yes, yesterday:
– 5 people felt unwell at the PMO office
– 2 unwell at the Indian Army Headquarters
– 1 infected people at the Indian parliament
– 3 infected at the Home OfficeShould I continue?
— Elliot Alderson (@fs0c131y) May 6, 2020
Also Read: Phones Without Aarogya Setu App Will Draw Punishment in Noida
“The funny thing is they(Indian Government) also admit a user can get the data for multiple locations. Thanks to triangulation, an attacker can get with a meter precision the health status of someone.
Iām happy they quickly answered to my report and fixed some of the issues but seriously: stop lying, stop denying, the French security researcher concluded.
The contact tracing app, which uses GPS (global positioning system) to track and record user data, has been red-flagged by a New Delhi-based Software Freedom Law Centre and Internet Freedom Foundation (IFF).
People have also pointed to a lack of transparency, comparing it to exercises undertaken by the Singapore government.
As an independent media platform, we do not take advertisements from governments and corporate houses. It is you, our readers, who have supported us on our journey to do honest and unbiased journalism. Please contribute, so that we can continue to do the same in future.
