After an investigation by a leading English news daily in India discovered how Aadhaar details of the entire country were being sold at Rs 500, a French security researcher found yet another massive loophole that allows anyone with basic programming knowledge to break into the mAadhaar Android app and steal user data.
The French-researcher alias Eliot Alderson who goes by the handle @fs0c131y on Twitter revealed in a thread of Tweets how the password to the local database which the mAadhaar app uses to store sensitive information like your biometric preferences, KYC profile data, and user passwords, can be easily acquired. Essentially, if someone has access to your phone, your Mobile Aadhaar PIN can be compromised with ease.
Another day, another security breach
We reached out to the researcher who said that the mAadhaar app uses a local database on the phone to store information like your password, app preferences and the likes. It’s a common practice by developers to do so. That local database is protected by a password which is randomly generated. However, @fs0c131y found that the way to generate this password randomly is poorly written.
https://twitter.com/fs0c131y/status/951154910569140225?ref_src=twsrc%5Etfw
Essentially, the password is generated using a random number with the seed as “123456789” and a hardcoded string “db_password_123” which remains the same for every phone. Using this, anyone with access to your phone can break into the app and get your user password and basically, get access to all your demographic and biometric details.
https://twitter.com/fs0c131y/status/951384370346119168?ref_src=twsrc%5Etfw
The researcher even made a proof-of-concept on Github to demonstrate the flaw. He made an application with the same code so that if you run it multiple times, it will give you the same password over and over again instead of the randomised password the app is supposed to generate. You read more about it here.
https://twitter.com/fs0c131y/status/951396546557435904?ref_src=twsrc%5Etfw
The mAadhaar app, @fs0c131y found, stores your photograph on the local database, which is a biometric information by itself, apart from your eKYC profile data, and more. Furthermore, the eKYC profile data stores the user ID, the Aadhaar ID, your name, date of birth, gender, address and your photograph.
The researcher uses an alias Elias Alderson, which is the name of the protagonist of Mr. Robot, a popular TV series about cyber security and hacking. He had earlier found a backdoor on OnePlus devices which granted hackers with root access and other sensitive information with ease.
The researcher even shared the information with UIDAI that supervises the Aadhaar project in the country. However, the last time a reporter tried to inform the authority about a breach in the Aadhaar system, the regulatory body filed an FIR against her. It remains to be seen how UIDAI handles the new revelation and more importantly, what steps the authority takes to remedy the issue and make the app secure.