Can your aadhaar card be hacked / misused?

Yes, Your aadhaar card can be hacked and it can result in data theft, monetary loss, identity theft / cybercrime. So, hold your breath and count to ten, no swearing / no bad words here... ;)

Aadhaar - One Nation, One Card :D
It is well known now that Aadhaar has become synonymous with a person's identity in India. Thank You, Narendra Modi (PMO). I liked him better when he opposed aadhaar as Gujarat's CM, when Congress Party was ruling the country.

Constitutional Validity of Aadhaar
The face of Narendra Modi, post-2015 where he openly defied Supreme Court verdict to link Aadhaar to more than 100 schemes, both public and private, while passing off the Aadhaar Act, 2016 as a money bill in Lok Sabha, where BJP had majority, I started disliking him further when his government and cabinet of ministers, made the Aadhaar card mandatory for both public and private services instead of its original purpose as envisioned. (viz a viz, DBT, govt subsidy and tracking leakages / tracking corruption)

Contempt of Court
When any act outlives its original purpose, becomes draconian and violates constitutional principles like fundamental rights and right to live a dignified life (Article 21, which also includes right to privacy as interpreted by Supreme Court of India) it must be scrapped or repealed as nobody is above the constitution. The Supreme Court is considered to be the apex court, in charge of interpretation of law and they (supreme court judges) are ALSO bound by the constitution.

Where's the Security?
The question is NOT something pertaining to an individual's opinion or my right to privacy, it concerns every *single* citizen of India. If they can't provide maximum security in terms of physical, electronic and digital security, they should at least have the decency to admit that their security is NOT up to the mark. Security won't "magically" happen, when UIDAI  / Modi govt says aadhaar database is secure. Something has to be shown like improvement to the aadhaar public database, aadhaar verification, e-hospital portal? (which was used to hack aadhaar once), recently disclosed details through verity infosol, hyderabad... What are these people doing to "really" improve security, by implementing safeguards / security standards??

Where's the transparency?
All too frequently, people lament about transparency and corruption (transparency in THIS product / THAT service); let me ask you, what is the level of security for UIDAI / aadhaar cards as a database?? Where's the transparency? You expect me to file a RTI?? 

Aadhaar Card - Not So Secure 
And all this ranting about Aadhaar card is for naught, if I can NOT make you understand the implication of losing your privacy, right? Here are the problems with Aadhaar Card,

1) I can NOT change my fingerprint, or iris (if it is lost)
- Like a credit card, debit card, sim card

2) Single point of failure
-Some judge and some panelist on some TV channel said, Government already has all of this information about you. Why are you uncomfortable sharing this data??
- Goes to show how uninformed the judge / panelist is about "disaster management / disaster recovery"
- aadhaar is a centralized database - which can lead to single point of failure

3) OTP is issued by Aadhaar's Website, hmmm, OK!
- So we are in 2018?? And you're telling me OTP is fool proof :P
- physical attacks / social engineering works

4) Aadhaar's android app called mAadhaar is an APK file
- There's a whole hours' worth of demonstration I can make on android security
- And conduct a full course on how to security test mobile devices / mobile OS
- Android OS, android API, apk and device permissions / settings / the works...

Disclaimer - I do NOT have to perform ANY of the above mentioned attacks...

A valid Aadhaar number is a key that opens multiple locks. Dialing *99*99# connects you to NPCI’s query service on Aadhaar mapper (QSAM), which cheerfully tells you which bank the Aadhaar holder is receiving subsidy deposits in. Indane’s website will tell you the name of the Aadhaar holder and their LPG connection ID, and the history of banks they have received subsidies in. Keep probing services like this, and soon enough one builds a comprehensive profile of an individual containing information that is most certainly not known to Google and Facebook, the Aadhaar ecosystem’s preferred bogeymen. Forget state-level actors, this is now available to common scamsters. Everyone from housemaids to members of Parliament have fallen prey to targeted phishing scams that use private information to convince the victim that they genuinely represent the service provider, only to find that money has been stolen from their bank accounts soon after.

Quoting from LiveMint's Article - http://www.livemint.com/Opinion/iUYT70CSTkEIuu2BDbCCsM/The-Aadhaar-ecosystem-leaks-too-much-data.html

Disclaimer - I do NOT have to perform ANY of the above mentioned attacks... It has all been done before, and it will be done again unless, UIDAI and the Govt of India take concrete steps to "regularly" and I emphasize, "regularly" audit the Aadhaar infrastructure, gain the public's trust and make aadhaar genuinely useful for the public.

(Despite having a bunch of "interesting" and "useful" individual identity cards, essential commodities act, motor vehicles act, passport act - separate means to identify and access govt schemes and services, people are coerced to enroll with UIDAI/Aadhaar, produce the same for public and private services in violation of Supreme Court's August 2017 - verdict. In legal jargon, it is called contempt of court...)

Hacking aadhaar is NOT new / newsworthy
It happens regularly... It is well known to people working in the security industry that Aadhaar database has been breached about half a dozen times, in the last 2 to 3 years, by various eminent individuals... ;))

https://www.thehindubusinessline.com/info-tech/uidai-suspends-airtel-airtel-payments-banks-ekyc-licence/article9995428.ece
https://www.thehindubusinessline.com/info-tech/uidai-suspends-airtel-airtel-payments-banks-ekyc-licence/article9995428.ece
http://www.tribuneindia.com/news/nation/rs-500-10-minutes-and-you-have-access-to-billion-aadhaar-details/523361.html
 https://www.thequint.com/news/india/exclusive-aadhaar-dirty-secret-out-add-anyone-as-data-admin
 https://thewire.in/210954/uidai-aadhaar-security-breach/

Bone of contention?
Unfortunately, Aadhaar card as of now,  serves no additional purpose, that your other identity cards, bank accounts and social welfare schemes fail to provide. Why do we need Aadhaar? For state surveillance on Citizens of India or, to catch a Nirav Modi, a Vijay Mallya (Kingfisher) and/or a Lalit Modi (IPL Scam)??

3 Point Conclusion
1) At present there is no data protection / privacy law in India, we need these laws... ( IT Act does NOT count as a full-fledged privacy law - read up on laws / legalese please!)

2) The Indian govt must have a framework for citizen's identity to be safely accessed via Aadhaar, limit the level of data available to third parties, conduct periodic security assessments / checks, comply with laws of the land, provide an opt-out clause, allow the citizens access to essential services such as direct benefit transfer, food subsidy, bank accounts and mobile phones without coercion to provide aadhaar card.

3) So when Aadhaar becomes congruent with its original vision of distributing benefits, subsidy and leakage / corruption tracking, I will be the first person and the best proponent of aadhar. I will encourage people to enroll and sensitize them about the benefits of aadhaar. Let's safely say, that's 5 to 10 years away... :D

Currently, Aadhaar's constitutional validity is being hotly debated in the Supreme Court of India...

I'll leave it at that... Peace Out!

- Kish

ZKSoftware ZEM500 Authentication Bypass - Update

A Brief Update To The Original Post on ZKSoftware ZEM500 Authentication Bypass

First things first, I am now on a sabbatical, pursuing alternate avenues for pleasure, not profit... I am semi-retired from security on my own terms... ;)

Username & Password for the device was "root:solokey" in 2013...

I believe that in addition to getting root, you could play with firmware, packets and the device's OS (busybox) if you are inclined to explore every filetype including elf, bat and sh files for getting a better understanding. You could ALSO use tftp / ftp, ssh or telnet to upload and download files (for reverse engineering the elf files). Firmware for the device comes in gzip or tgz (tarred-gzip) format.

I am NOT very sure or updated on the vulnerability as such. It may have been reported and fixed by now (I saw THIS in 2013) - I could be wrong, too... Since some vendors don't fix the vulnerabilities quickly.

Good luck playing with the device!

Cheers,
Kish

ICICI Bank - Authentication Bypass Vulnerability

Source: http://gadgets.ndtv.com/internet/news/your-icici-statement-can-be-accessed-online-by-anyone-510296

Consider this my opinion on the latest vulnerability discovered in ICICI's Internet Banking portal that allows anybody to read your bank statement without logging in to your account. Yeah, you read that right, "without" logging in...

OK, A friend of mine pointed out this vulnerability to me... Initially my impression was well it must be another SQL injection as I have always been skeptical about the level of security on the Internet provided by private & public banks.

Bug: Authentication Bypass + Direct Insecure Object Reference

Discovered by: Ayush Ghosh, BookMyShow

Disclosed by NDTV to ICICI Bank because the bank didn't bother checking that researcher's email as usual. So much for having those abuse / info e-mail addresses on their website. The banks must start to consider working on a middle-ground with security researchers.

Initially the vulnerability seems innocuous but, when you factor in that a vulnerability like this could lead to money being stolen or could lead to internet fraud. Imagine 20 lakhs get stolen from your bank account straight up by a guy who cons you with an internet scam. Then try to look at this vulnerability in this new light with your money on the table... Scary? Yeah I thought so! ;)

New Delhi-based cyber-security consultant Dominic K. spoke to NDTV Gadgets and discussed the multiple layers of security that banks have in place, which include multi-factor authentication, encryption, secure connectivity - SSL and HTTPS and identity management systems. He added, "We have not heard of any serious attacks that were successful. These are industry practices that meet global standards."

SSL - Broken many times
HTTPS - Broken - Can be stripped and/or hijacked
Certificates can be spoofed and/or stolen

How multi-factor authentication or secure connectivity will help when there's no user logged in? Authentication is the mechanism where a user logs-in to confirm the his / her identity on the bank's website. This is usually achieved with parameters such as Debit card no, Account no, Debit card PIN or Username / Password issued for Internet banking. The authentication mechanism is NOT part of this vulnerability so, all those global standards don't matter in this case.

Our high school teachers have spoiled us by with an example for every damn thing in the world.

Example: A Grifter with very little computer knowledge can write an e-mail with your name (first name, last name), bank account information, your bank balance and a 'mistake' he noticed (a reason to click). Since the dawn of graphical user computing we have always been clicking, you can't get anything done without clicking. You click more than you type and that is a fact, you clicked on this damn page... fact... :D

Mr.Grifter can then systematically make you execute javascript and steal your cookies, pun intended! Cookies here equate to money, but that's just for people who care. If that grifter is savvy and smart, he just might hack your browser and make your life hell. The people who want to sit at home feeling safe, well... good luck, security has always been an illusion.

The original article can be found here

Cheers!

OpenSSL Heartbleed Vulnerability

Myself and Digi from Crimemachine have whipped up a document to educate the public about this recent vulnerability. With all the information and buzz surrounding this vulnerability, comes a lot of confusion too... We provide this information with the standard disclaimer, this information is for educational purposes only.

Download the Heartbleed - Information Packet (Google Drive)

 You will be responsible for your own actions. Use the information sensibly.

Official Website: http://www.heartbleed.com 
OpenSSL Advisory: http://www.openssl.org/news/secadv_20140407.txt

Update: A simple shell script for those of you who are dabbling with the code,

root@crimemachine:~# while true;do ./heartbleed.py 192.168.220.133 -p 443;sleep2;done >> /tmp/heartbleed.log

You can iterate the loop and record login credentials when a user logs in to the site/server.

Cheers,
Kish

ZKSoftware ZEM500 Authentication Bypass

############################################
# ZKSoftware ZEM500 RFID Card Reader
# Date: 22.11.2013
# Vuln: Authentication bypass / Abuse of Access
###########################################

In a world which relies on technology heavily, the use of software and/or hardware to track people at office / work isn't new. It is actually quite old and a lot of systems are vulnerable. This is just my observation of ZEM500 hardware on a limited scope of attack.

Typical connectivity diagram from the ZEM500 Hardware to the network...

ZEM500 by ZKSoftware (Sold by ESSL India) is a biometric fingerprint cum smart card system to authenticate and maintain user attendance in corporate offices. The authentication (employee name, employee password) is encoded in a smart card like any other system. The ZEM500 runs a Linux kernel 2.4x. The device runs busybox linux and its based on fingerprinting.

Port Scan of the ZEM 500,

Telnet to ZEM 500,

Malformed packet for ZEM500 using Scapy,

Observing the traffic with Wireshark was not amusing and revealed employee login / log out details... For obvious reasons of confidentiality and safety, I won't post it online!

eSSL Time Track - Hardcoded Password,

Apart from the above mentioned authentication bypass, you can download a copy at www.esslindia.com/install/eTimeTrack.zip  to manage the software like a normal administrator would. eSSL resells the hardware in India. The management software has a hardcoded password for Windows and SQL Authentication. Weak Encryption, anyone?

Default install includes SQL Express for the management software. The software can be used to manage, maintain and fetch reports from the system.

The ZEM500 has WiFi capability and I never hooked my system to the firewire... Food for thought? ;))

Cheers,
Kish