Aadhaar bio-metrics is completely broken now?

[Lord Nemesis]

https://www.ndtv.com/surat-news/2-h...-data-to-divert-subsidised-foodgrains-1808220

Is Aadhar completely broken now? Stored Bio-metric data is being used to complete finger print authentications steps?

The beneficiary had to provide his finger print, details of his ration card and UID (Aadhaar) numbers to match the data fed into the computer. This would generate a slip on the basis of which he was given subsidised ration every month," Inspector Dave said.

The arrested duo, he said, used a duplicate software and obtained a data bank of beneficiaries from an unknown source.

"They used this data bank to create an electronic record every month to show that beneficiaries had obtained subsidised foodgrain when in reality they had not," he said.

Inspector Dave said that investigations were underway to find out the source of the fake software as well as the biometric data.

If they are able to bypass the finger print authentication step in any manner from the client side, its an indication of a very fundamentally flawed system design.

 

[indy1811]

Was it Aadhar biometrics that were leaked? The article isn't very clear on that...just says that they obtained a data bank of beneficiaries from unknown sources.

 

[pratikb]

Its ndtv article. What else i except ?

 

[Lord Nemesis]

Was it Aadhar biometrics that were leaked? The article isn't very clear on that...just says that they obtained a data bank of beneficiaries from unknown sources.

The e-FPS process requires Aadhar based fingerprint verification to receive the goods and update the records. These people managed to obtain a data set of legitimate beneficiaries and along with a modified software from some as yet unknown source and were able to complete the authentication step and update the records stating issue of goods..

Whatever they did, the important point is that they managed to pass the bio-metric authentication step which means the system is flawed and broken.

Typically when bio-metrics are collected, it is translated to a feature set (non-reversible) which further transformed using non-reversible methods and then stored. This data should be only usable for matching. During the authentication process, the same metric (fingerprint for instance) is collected from the user and transformed again and matched. It should not be possible to use the existing data in the database to perform a match.

So one these things happened here.

1. The copies of raw fingerprints of the beneficiaries were obtained in some manner and used for the authentication process.
2. The finger print bio-metric data was stored in a format that it could be reused for a match and such data was obtained by these people in conjunction with modified client software was used to perform the authentication.
3. There was some even bigger flaw in the system that allowed them to completely bypass the bio-metric check on the server.

This is exactly why govt's should not be collecting bio-metrics. If a password gets hacked, you could get back access somehow and simply change the password. With bio-metrics, you are damaged goods forever if somebody else can replicate them.

 

[indy1811]

The e-FPS process requires Aadhar based fingerprint verification to receive the goods and update the records. These people managed to obtain a data set of legitimate beneficiaries and along with a modified software from some as yet unknown source and were able to complete the authentication step and update the records stating issue of goods..

Whatever they did, the important point is that they managed to pass the bio-metric authentication step which means the system is flawed and broken.

Typically when bio-metrics are collected, it is translated to a feature set (non-reversible) which further transformed using non-reversible methods and then stored. This data should be only usable for matching. During the authentication process, the same metric (fingerprint for instance) is collected from the user and transformed again and matched. It should not be possible to use the existing data in the database to perform a match.

So one these things happened here.

1. The copies of raw fingerprints of the beneficiaries were obtained in some manner and used for the authentication process.
2. The finger print bio-metric data was stored in a format that it could be reused for a match and such data was obtained by these people in conjunction with modified client software was used to perform the authentication.
3. There was some even bigger flaw in the system that allowed them to completely bypass the bio-metric check on the server.

This is exactly why govt's should not be collecting bio-metrics. If a password gets hacked, you could get back access somehow and simply change the password. With bio-metrics, you are damaged goods forever if somebody else can replicate them.

None of the 3 things you've mentioned suggest Aadhar biometrics of everyone have been leaked.

They've probably stored customers bio metrics locally (like some SIM card dealers were doing) and are using it to authenticate it against Aadhar.

 

[Lord Nemesis]

I said that the system is flawed and broken, not that the complete data is stolen. None of these things should be possible in a secure system.

 

[nimod]

I said that the system is flawed and broken, not that the complete data is stolen. None of these things should be possible in a secure system.

yes, data was not stolen/leaked.
it's still there on UIDAI servers. anyone can check (costs only 500).

and the best part is, only 'a few' are affected.
i know that i am not among those 'a few' and i will never be. (because my saviour is the ruler now)

stop 'fear mongering'!

 

[Sub]

Lol, that's not how data security works."Data theft" does not mean "physical theft of servers" or "deleted from servers". It means, no one can access, under any circumstances, even one bit of data. Anything else is completely unacceptable. Aadhaar is completely unacceptable from a data security perspective.

Please educate yourself, read up some academic investigations on the matter. This is a good one, and easy to read for starters, by the famed Troy Hunt - https://www.troyhunt.com/is-indias-...ssing-a-publicly-observable-security-posture/

 

[onlyravi]

and the best part is, only 'a few' are affected.

If 1.5cr records is 'few' then I agree.

This is only one exposed scam. Imagine how many such illegal data stores might be in existence. The worst part is once they get the biometric of an individual they store it in binary and can resend it on demand to the official UIDAI database and authenticate anything on that individuals name. So there is no way of telling if it was really a physically present individual who requested that service or it was a malicious software that was using illegally scrapped data to do that transaction.
Ofcourse they can couple it with OTP or other nonsense but the fact remains that the whole sham of UIDAI has fallen apart and they have FAILED.

 

[6pack]

What is worse is it was a paid software. So somewhere the aadhaar api is opening up all info to anyone who connects to it with a fingerprint scan. So saying that only a few are affected is not true. Possibly everyone who made their aadhaar card is affected if a lot more such software licenses are being used. Only one ration card shop keeper was arrested. The others who bought the software are still using it. Just remember, a software is not made for one shopkeeper. It wouldn't have been made if it didn't have a huge demand.


Edit: As per the UIDAI website for developers,

https://authportal.uidai.gov.in/web/uidai/home-articles?urlTitle=operation-model&pageType=authentication

Process of sending authentication requests

1) After collecting the Aadhaar number or any other identifier provided by the requesting entity which is mapped to Aadhaar number and necessary demographic and / or biometric information and/ or OTP from the Aadhaar number holder, the client application shall immediately package and encrypt these input parameters into PID block before any transmission, as per the specifications laid down by the Authority, and shall send it to server of the requesting entity using secure protocols as may be laid down by the Authority for this purpose

2) After validation, the server of a requesting entity shall pass the authentication request to the CIDR, through the server of the Authentication Service Agency as per the specifications laid down by the Authority. The authentication request shall be digitally signed by the requesting entity and/or by the Authentication Service Agency, as per the mutual agreement between them.

3) Based on the mode of authentication request, the CIDR shall validate the input parameters against the data stored therein and return a digitally signed Yes or No authentication response, or a digitally signed e-KYC authentication response with encrypted e-KYC data, as the case may be, along with other technical details related to the authentication transaction.

4) In all modes of authentication, the Aadhaar number is mandatory and is submitted along with the input parameters specified in sub-regulation (1) above such that authentication is always reduced to a 1:1 match.

5) A requesting entity shall ensure that encryption of PID Block takes place at the time of capture on the authentication device as per the processes and specifications laid down by the Authority.

So chink in the armour is at the agencies taking the aadhaar number and info. The process of encrypting and storing the data is left to the field agency. The encrypted contents are then sent over TLS. Where they made a mistake is they shouldn't have allowed any information to be stored at all on the machine. But then that would be a deterrent in areas where there is no internet connectivity at all.

 

[Sub]

Wanna get Aadhaar database for 500 bucks to find my ex gf trololololol

You're joking, but in case of a breach, there are millions of stalkers who would have access to their address, phone number, bank account, biometrics and who knows what else. Not to mention, the underworld and criminals. It's basically an Orwellian nightmare, even if the data was secure. The fact that it isn't makes it an existential hazard.

 

[onlyravi]

What is worse is it was a paid software. So somewhere the aadhaar api is opening up all info to anyone who connects to it with a fingerprint scan. So saying that only a few are affected is not true. Possibly everyone who made their aadhaar card is affected if a lot more such software licenses are being used. Only one ration card shop keeper was arrested. The others who bought the software are still using it. Just remember, a software is not made for one shopkeeper. It wouldn't have been made if it didn't have a huge demand.
Edit: As per the UIDAI website for developers,

https://authportal.uidai.gov.in/web/uidai/home-articles?urlTitle=operation-model&pageType=authentication

So chink in the armour is at the agencies taking the aadhaar number and info. The process of encrypting and storing the data is left to the field agency. The encrypted contents are then sent over TLS. Where they made a mistake is they shouldn't have allowed any information to be stored at all on the machine. But then that would be a deterrent in areas where there is no internet connectivity at all.

The system anyways does not work without an internet connection.

Instead of allowing clients to collect the data and then encrypt and send it to the API what they should have done is exposed an applet or a block of web form and make it mandatory for everyone to use only that block. Something payment gateways use. whereas the site can use css to alter the look and feel of the block they cannot store any information from that block and its directly sent to the API.

I am pretty sure that not only some hackers but even some foreign govt have already seeded the entire (or atleast most of the) Aadhaar db. this thing is in existence for almost 9 years now.

 

[blr_p]

So one these things happened here.

1. The copies of raw fingerprints of the beneficiaries were obtained in some manner and used for the authentication process.
2. The finger print bio-metric data was stored in a format that it could be reused for a match and such data was obtained by these people in conjunction with modified client software was used to perform the authentication.
3. There was some even bigger flaw in the system that allowed them to completely bypass the bio-metric check on the server.

This is exactly why govt's should not be collecting bio-metrics. If a password gets hacked, you could get back access somehow and simply change the password. With bio-metrics, you are damaged goods forever if somebody else can replicate them.

My guess is option 1 via social engineering

The important part is the two got caught. So it should become clear in the coming days what happened.

That is if its ever revealed and people here track the story

 

[RakaKaKaka]

Is there a way to find aadhar address of some1 with his mobile number. Willing to pay upto 1000 fr it

 

[Chaos]

Is there a way to find aadhar address of some1 with his mobile number. Willing to pay upto 1000 fr it

You realize you can go to jail for that right?

 

[Zaibatsu]

You realize you can go to jail for that right?

Not really. Aadhaar data has already been leaked. Anyone can get access to anyone's address by simply sending 500 Rs through PayTM. This is official & old news

https://www.ndtv.com/india-news/uid...500-report-says-it-s-secure-10-points-1795915

NEW DELHI: UIDAI, the authority that issues Aadhaar numbers, has filed a police case after a newspaper appeared to have bought login details to get access to its database for Rs. 500, but insisted that there had been no breach. "The Aadhaar data including biometric information is fully safe and secure," a statement by the Unique Identification Authority of India, or UIDAI, said. Aadhaar already faces a legal challenge in the Supreme Court filed by activists who believe that the rule to force people to submit their Aadhaar numbers was a violation of their privacy.
Here are the 10 points on this story:

1. The newspaper, The Tribune, has reported that it received an offer to buy access into the Aadhaar database for Rs. 500, and that it's journalist was given login details to access the data. The journalist tried to key in an individual's Aadhaar number and was able to see the demographic details of the person concerned, the newspaper has claimed.
2. The story was seen as a vindication of concerns expressed by think-tanks such as the Centre for Internet and Society that the centralized data retention model for 12-digit biometric identity to all Indian residents was flawed.
3. But the UIDAI has indicated that the login details provided to the newspaper "appears to be instance of misuse of the grievance redressal search facility", given to designated personnel and state government officials. They could access details about an individual by entering their Aadhaar or enrolment number.
4. A UIDAI official said this system only provided limited access about the basic details of an individual and does not include access to biometric details. Also, there were enough checks and balances built into the system to trace every piece of data that has been accessed to ensure that every deviation will be punished.
5. "The legal action including lodging of FIR against the persons involved in the instant case is being done," the UIDAI statement said.
6. There has not been any data breach of biometric database which remains fully safe and secure with highest encryption, the UIDAI said, underlining that mere display of demographic information cannot be misused without biometrics. It also stressed that Aadhaar number is not a secret number and had to be cited by residents to avail various services.
7. Aadhaar was set up to be a form of digital identification for all residents, originally pitched for targeted delivery of benefits to the poor.
8. UIDAI says it has a well-designed, multi-layer approach, robust security system in place and the same is being constantly upgraded to maintain the highest level of data security and integrity.
9. In the past, the UIDAI has, however, taken a dim view of government websites publicly displaying details such as names and addresses of Aadhaar beneficiaries.
10. Last month, the UIDAI told parliament that about 210 government departments and organisations had been ordered to remove the Aadhaar and other personal data from their websites.

 

[Lord Nemesis]

^^ That doesn't mean you won't go to jail for it when caught.

 

[blr_p]

Not really. Aadhaar data has already been leaked. Anyone can get access to anyone's address by simply sending 500 Rs through PayTM. This is official & old news

https://www.ndtv.com/india-news/uid...500-report-says-it-s-secure-10-points-1795915

Also read point 4

The word leak is ambigious it can be mean parts of or everything. When you say 'aadhar data' what amount of it or all of it. Biometrics clearly haven't been compromised which without nothing interesting can be had. How long for remains to be seen

See Q2 of the think tanks clarification statement

 

[Lord Nemesis]

Any data-set that ties your name to any other single piece of data about yourself is information that has value. In fact, some times, mere mention of your name under a list is information of value. For instance, in this very case, the culprits were interested in the list of legitimate beneficiaries for the rations.The mere presence of a name under this list was of value to them. If they had got only the list of names, they could then obtain more information about the targets from other sources. Any information about you made accessible openly without your consent is a leak of information. It could be as simple as a list containing just names. This is why a govt should not be in a position to dictate which information is safe to share without your consent or which information leaking can be ignored.

 

[blr_p]

Yes but what happened is more public disclosure than leak or hack, they got the info through the grievance addressal mechanism or it was inadvertantly put on govt websites. Out of ignorance more than anything.

Only way to get the govt to become more vigilant is to expose it. THat think tank informed the depts concerned before going public