Any Indian DigiLocker Account Could've Been Accessed Without Password

guest · Jun 8, 2020

Any Indian DigiLocker Account Could've Been Accessed Without Password
June 8, 2020
https://thehackernews.com/2020/06/aadhar-digilocker-hacked.html

The Indian Government said it has addressed a critical vulnerability in its secure document wallet service Digilocker that could have potentially allowed a remote attacker to bypass mobile one-time passwords (OTP) and sign in as other users to access their sensitive documents stored on the platform.

"The OTP function lacks authorization which makes it possible to perform OTP validation with submitting any valid users details and then manipulation flow to sign in as a totally different user," security researcher Mohesh Mohan said in a disclosure shared with The Hacker News.
According to Mohan, to unauthorizedly access a targeted Digilocker account, all an attacker needs to know is either victim's Aadhaar ID or linked mobile number or username, prompting the service to send an OTP and subsequently exploiting the flaw to bypass the sign-in process.
Click to expand...

"The nature of the vulnerability was such that an individual's DigiLocker account could potentially get compromised if the attacker knew the username for that particular account," Digilocker said in a tweet last week acknowledging the flaw. "It was not a vulnerability that could let anyone get access to [the] DigiLocker account of anyone whose username and other details were not known."
Click to expand...

Log in or Sign up

Any Indian DigiLocker Account Could've Been Accessed Without Password

guest Guest

Log in or Sign up

Any Indian DigiLocker Account Could've Been Accessed Without Password

guest Guest

Useful Searches