National

“Aarogya Setu: The story of a failure” Hacker Describe The Privacy Issues

Elliot Alderson, a French security researcher claimed that the privacy of 90 million Indians is at stake & later released a detailed article about the issues.

New Delhi| Aarogya Setu, the app which is flagged for privacy issues, is a contact-tracing app developed by the National Informatics Centre (NIC) under the Ministry of Electronics and Information Technology.

Late on Tuesday, the official handle of the app stated that “no data or security breach had been identified” in the app.

The reply apparently came in acknowledgement to a tweet by Elliot Alderson, a French security researcher, earlier in the day, who claimed that the privacy of 90 million Indians is at stake.

The Aarogya Setu application is available on the PlayStore and 90 million Indians have already installed it.

Elliot says that with just 1-click an attacker can open any app internal file, including the local database used by the app called fight-covid-db.

This was on April 3, 2 days after the launch of the application.

On May 4, the ethical hacker says he noticed that the issue described previously had been fixed silently by the developers.

“In the app, you have the ability to know how many people did a self-assessment in your area. You can choose the radius of the area. It can be 500m, 1km, 2kms, 5kms or 10kms,” he writes.

“Thanks to this endpoint an attacker can know who is infected anywhere in India, in the area of his choice. I can know if my neighbour is sick for example. Sounds like a privacy issue for me…”

“So I decided to play with it a little bit and checked who was infected in some specific places with a radius of 500 meters”

Also Read: Phones Without Aarogya Setu App Will Draw Punishment in Noida

“The funny thing is they(Indian Government) also admit a user can get the data for multiple locations. Thanks to triangulation, an attacker can get with a meter precision the health status of someone.

I’m happy they quickly answered to my report and fixed some of the issues but seriously: stop lying, stop denying, the French security researcher concluded.

The contact tracing app, which uses GPS (global positioning system) to track and record user data, has been red-flagged by a New Delhi-based Software Freedom Law Centre and Internet Freedom Foundation (IFF).

People have also pointed to a lack of transparency, comparing it to exercises undertaken by the Singapore government.

Dear Readers,
As an independent media platform, we do not take advertisements from governments and corporate houses. It is you, our readers, who have supported us on our journey to do honest and unbiased journalism. Please contribute, so that we can continue to do the same in future.

Related posts