In early May this year, reports surfaced that a tampered version of UIDAI’s Aadhaar enrollment software, which bypassed the original software’s security features and allowed any unauthorized person to create an Aadhaar number, was being sold online on WhatsApp. UIDAI swiftly denied the reports, but a recent in-depth investigation has revealed that UIDAI’s ‘super-secure’ Aadhaar enrollment software has been hacked and a patch allowing the hack is being sold for just Rs. 2,500.
A 3-month long investigation conducted by Huffington Post India has uncovered the existence of a patch which disables all the critical security features of UIDAI’s official Aadhaar enrollment system and allows any person to create an Aadhaar number, from anywhere in the world.
The patch has been assessed by 3 international and two Indian software security experts, who confirmed its working and the danger it poses. The patch overcomes the biometric authentication protocol of the Aadhaar enrollment software – called the Enrolment Client Multi-Platform – and also reduces the accuracy of the iris recognition system, making it easy to spoof the software with a print-out of an iris, instead of 3D verification, letting anyone other than a certified Aadhaar enrollment operator add new members.
As stated in the original report months ago, it also disables the software’s mandatory GPS feature for tracking the whereabouts of an Aadhaar enrolment center, making it possible to create an Aadhaar ID from any place across the globe. Interestingly, the patch was created using code from older builds of UIDAI’s enrollment software which had multiple security flaws and according to the latest report, it is being widely used across the nation.
Security experts who analyzed the patch revealed that using the patch is as simple as installing any software, and then copy-pasting folders to crack the Aadhaar enrollment system.
Gustaf Björksten, Chief Technologist at Access Now, a global technology policy and advocacy group, and one of the experts consulted by Huffington Post for the investigation said Aadhaar is a high-level target for criminals. “There are probably many individuals and entities, criminal, political, domestic and foreign, that would derive enough benefit from this compromise of Aadhaar to make the investment in creating the patch worthwhile.
“To have any hope of securing Aadhaar, the system design would have to be radically changed,” he added.
Huffington Post claims it provided access to the patch to the National Critical Information Infrastructure Protection Centre (NCIIPC), the government body responsible for overseeing Aadhaar security.
However, the agency is yet to disclose its findings.
UIDAI on the other hand on Tuesday dismissed the probe
and called the report “incorrect and irresponsible”. In a 24-tweet thread, it said, “No operator can make or update Aadhaar unless resident himself give his biometric (sic).”
It also said the operator’s biometrics had to be authenticated before enrolments or updates were processed.
UIDAI refuted the claims, saying, “It is not possible to introduce ghost entries into Aadhaar database.” If an operator’s or resident’s biometrics were not captured or were blurred and sent to the system, “the same is identified by the robust backend system of UIDAI, and all such enrolment packets get rejected and no Aadhaar is generated,” it said.
But who's lieing about this reports??
Uhmm, so am a fan of Arsenal FC and Wizkid, i love coding and most of all blogging, i play football for fun, beach bash is my something, music promo is my best. Am just a cool headed guy.
Shherma Bajarma Boom || Arjun Thakor New Song || Sharavan Thakor || Gabbar Thakor New Song 2018.
by Pachan Thakor GKTS Deesa
Monohybrids and the Punnett Square Guinea Pigs
by Amoeba Sisters
Top 40 Anime Endings Summer 2017
رأفت الهجان جـ2׃ الحلقة 06 من 27
by ماسبيرو دراما
Phim Hành Động Hay Nhất 2019 (Thuyết Minh)