No data, security breach by Aarogya Setu, says team after hacker claims privacy issues

The Aarogya Setu team, on Tuesday, issued a statement asserting that "no data or security breach had been identified" in the app, after Elliot Alderson, a French security researcher, claimed that there were privacy issues with it.

The app has been developed by the National Informatics Centre (NIC) under the Ministry of Electronics and Information Technology to track possible COVID-19 cases.

“Hi @SetuAarogya, A security issue has been found in your app. The privacy of 90 million Indians is at stake. Can you contact me in private? Regards. PS: Rahul Gandhi was right," the ethical hacker had tweeted.

Hi @SetuAarogya,

A security issue has been found in your app. The privacy of 90 million Indians is at stake. Can you contact me in private?

Regards,

PS: @RahulGandhi was right

— Elliot Alderson (@fs0c131y) May 5, 2020

“49 minutes after this tweet, @IndianCERT and @NICMeity contacted me. Issue has been disclosed to them. To be super clear: I’m waiting a fix from their side before disclosing publicly the issue. Putting the medical data of 90 million Indians is not an option. I have a very limited patience, so after a reasonable deadline, I will disclose it, fixed or not," Alderson tweeted a while later.

In response, Aaroga Setu, late in the night, tweeted saying the team was alerted “by an ethical hacker of a potential security issue in the app” and even discussed the matter with him. Aaroga Setu further assured that “no personal information of any user has been proven to be at risk” by the hacker.

Statement from Team #AarogyaSetu on data security of the App. pic.twitter.com/JS9ow82Hom

— Aarogya Setu (@SetuAarogya) May 5, 2020

The team added that the hacker mentioned two issues – “the app fetches user location on a few occasions”, and a “user can get the Covid-19 stats displayed on home screen by changing the radius and latitude-longitude using a script.”

Clarifying on the two queries, the team said that the fetching of a user’s location was a part of the design and that it is “stored on the server in a secure, encrypted and anonymised manner.”

The radius parameters on the app “are fixed and can only take one of the five values: 500m, 1km, 2km, 5 km, and 10 km," the team clarified on the second query.

Responding to the clarifications, Anderson tweeted, “Basically, you said “nothing to see here” We will see. I will come back to you tomorrow.”

Source: https://www.cnbctv18.com/technology/no-data-security-breach-by-aarogya-setu-says-team-after-hacker-claims-privacy-issues-5853851.htm