Bengaluru Man Reportedly 'Hacked' Government's Aarogya Setu App In Under Four Hours
The Bengaluru based engineer cracked the application and skipped all the process where he had to fill in the data. He managed to bypass a page that requested personal information like name, age, gender, travel history, and COVID-19 symptoms.
A Bangalore-based software engineer has hacked Aarogya Setu, which seems to be slowly becoming mandatory in India. The programmer, who goes by the name Jay, found the government¡¯s contact tracing app¡¯s mandatory nature a little too disconcerting, that¡¯s when he decided to rip it all up.
Image for Representation/Reuters
Just a few days ago, ethical Hacker Elliot Alderson, a Twitter alias on the American television series character 'Mr Robot' - on May 5 - tweeted that there were security issues with the Aarogya Setu app.
Hi @SetuAarogya,
¡ª Elliot Alderson (@fs0c131y) May 5, 2020
A security issue has been found in your app. The privacy of 90 million Indians is at stake. Can you contact me in private?
Regards,
PS: @RahulGandhi was right
He tagged the app¡¯s handle and said: "A security issue has been found in your (Aarogya Setu) app. The privacy of 90 million Indians is at stake. Can you contact me in private?" The government, in response, said there is no security or data breach in the Aarogya Setu mobile application.
On the heels of this privacy breach claim, Jay started his work on hacking into Aarogya Setu app.
According to a Buzzfeed news report, the engineer cracked the application and skipped all the process where he had to fill in the data.
He managed to bypass a page that requested personal information like name, age, gender, travel history, and COVID-19 symptoms.
"I didn¡¯t like the fact that installing this app is slowly becoming mandatory in India,¡± said Jay. As he started working on the app at 9:00 AM, he first managed to bypass the code for registration, thereby eliminating the need to enter his phone number.
Twitter/TOI
Moreover, requests to access Bluetooth and GPS of the phone were also shunned, two things without which the app can't function.
After which, Jay managed to install the app without giving away any of his details and he was marked "safe" even though he didn't give any permission for it to run on his phone. By 1:00 PM, he was done with it.
Image For Representation/PTI
"I don¡¯t want to share my location 24/7 with the government.¡± He said the Indian app fared poorly against what Google and Apple were helping to build - apps that do not store personal information on centralized servers. ¡°If I was coding this app, I would have chosen to keep data points to a minimum,¡± he told Buzzfeed News.
Jay¡¯s experiment shows just how easy it is to hack your way around the app and it¡¯s unsettling.
With the Bengaluru hacker getting through the app in just four hours, questions now arise about the reliability of this app. Many might just be showing a fake result on the contact tracing app and it completely beats the purpose of the ¡®safety¡¯ app.
Last month, the Centre had made the app mandatory for all public and private sector employees. It also directed local authorities to ensure that people in Covid-19 containment zones have signed up for the app.
Police in multiples places such as Noida have also said it is mandatory for residents to have the app on their phones.
