FB pixel

State government fixes bug exposing Aadhaar biometric records

Philippines responds to breach allegations
State government fixes bug exposing Aadhaar biometric records

Fingerprint biometrics submitted to India’s national ID system, Aadhaar, have been exposed by the West Bengal state government website, TechCrunch reports.

Security researcher Sourajeet Majumder found and reported a bug that exposed Aadhaar digital ID numbers, identity documents, photographs and images of fingerprints on the e-District web portal. Soon after he reported the bug to government cybersecurity body CERT-In and the West Bengal government, it was fixed, according to the report.

The bug allowed a prospective attacker to guess sequences of 16-digital deed application numbers, and publicly available tools enabled valid numbers to be identified based on responses from the server.

The fear is that a malicious attacker may have discovered the path to people’s biometrics before Majumder reported it and could use the data to mount spoof attacks. The Unique Identification Authority of India (UIDAI) recently implemented liveness detection for fingerprint biometrics to stem incidents of fraud carried out with presentation attacks against the Aadhaar-enabled Payment System.

The UIDAI has launched a bug bounty program to find and close security vulnerabilities in Aadhaar’s biometric database last year.

India has been plagued by data breaches from state government and private sector portals over the past decade, though the UIDAI has denied allegations that biometric data has been leaked from the centralized database.

Philippines denies details of data breach accusations

The Philippine Statistics Authority (PSA) has responded to allegations on social media of a data breach by assuring the public that biometric and digital ID data held by the Philippine Identification System (PhilSys) and the Civil Registration System (CRS) has not been stolen.

The allegations themselves are malware attempts, the agency says. However, an investigation by the PSA’s Data Breach Response Team found that personal data from the Community-Based Monitoring System, a local planning tool, may have been compromised.

Article Topics

 |   |   |   |   | 

Latest Biometrics News


Rumors of liveness detection’s defeat have been greatly exaggerated

Photo and video face filters are perhaps the most mainstream use case for augmented reality –  and an illustrative test…


Companies House takes new measures to fraud fight, but not biometric IDV

Companies House, the UK’s business registry, has begun rolling out new tools to fight fraud and help cleanse the register…


Mitek: quarterlies, annuals, SEC actions

April 4, 2024 – Mitek is getting back on track with its financial reporting, which may be more reflective of the…


Jamaica parliament soon to receive draft digital ID regulation for scrutiny

Plans are being finalized to send the draft regulation on Jamaica’s digital ID program to the country’s parliament for examination…


US launches PKI system to make mobile driver’s licenses interoperable, easy to use

The Digital Trust Service being set up by the American Association of Motor Vehicle Administrators (AAMVA) to ease the use…


Worldcoin reaches 10 million users, could face $1m fine in Argentina

It is the best of times and the worst of times for Worldcoin. The iris biometrics, digital ID and cryptocurrency…


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.


Featured Company