Aarogya Setu was alerted “by an ethical hacker of a potential security issue in the app” but no personal information of users is proved to be at risk.
New Delhi| The Aarogya Setu app is a contact-tracing app developed by the National Informatics Centre (NIC) under the Ministry of Electronics and Information Technology.
Late on Tuesday, the official handle of the app stated that “no data or security breach had been identified” in the app.
The reply apparently came in acknowledgement to a tweet by Elliot Alderson, a French security researcher, earlier in the day, who claimed that the privacy of 90 million Indians is at stake.
Hi @SetuAarogya,
A security issue has been found in your app. The privacy of 90 million Indians is at stake. Can you contact me in private?
Regards,
PS: @RahulGandhi was right
— Elliot Alderson (@fs0c131y) May 5, 2020
The Twitter handle of Aarogya Setu said they were alerted “by an ethical hacker of a potential security issue in the app”, which they discussed with him, but “no personal information of any user has been proven to be at risk” by the hacker.
The app team said the hacker had pointed out 2 issues – “the app fetches user location on a few occasions”, and a “user can get the COVID-19 stats displayed on the home screen by changing the radius and latitude-longitude using a script.”
The team, however, said the fetching of a user’s location is “by design”, and it is “stored on the server in a secure, encrypted and anonymised manner.”
About the second issue, they said the radius parameters on the app “are fixed and can only take one of the five values: 500m, 1km, 2km, 5 km, and 10 km.”
Also Read: Flaw in Airtel App: 300 Million Users’ Personal Data Compromised
The information does not “compromise on any personal or sensitive data,” they added.
Basically, you said "nothing to see here"
We will see.
I will come back to you tomorrow. https://t.co/QWm0XVgi3B
— Elliot Alderson (@fs0c131y) May 5, 2020
The contact tracing app, which uses GPS (global positioning system) to track and record user data, has been red-flagged by a New Delhi-based Software Freedom Law Centre and Internet Freedom Foundation (IFF).
People have also pointed to a lack of transparency, comparing it to exercises undertaken by the Singapore government.
The total cases in India surged to 49,391 including over 14,000 cured/discharged or migrated and 1,694 deaths amid lockdown to curb the spread of COVID-19.
As an independent media platform, we do not take advertisements from governments and corporate houses. It is you, our readers, who have supported us on our journey to do honest and unbiased journalism. Please contribute, so that we can continue to do the same in future.
