Government’s DigiLocker app was found to have a bug that put the information of over 38 million account holders at risk by enabling hackers to easily surpass the app’s authentication system.
The vulnerability was discovered by security researcher Ashish Gahlot, who detailed his findings in a post on Medium.
DigiLocker’s authentication mechanism involves using a combination of an OTP and a six-digit PIN to log into the cloud-based document storage. Gahlot noted that though the app requires a two-step authentication process for logging, the process can be bypassed simply by adding the Aadhaar number and changing a bunch of parameters in the app. On doing so, he landed on a page which asks for setting a new PIN instead of typing in the previously set PIN.
“This not only changes the previous PIN of the user but also gives complete access to the Locker,” he wrote in the post.
The authentication flaw not only allows hackers to gain access to profiles without requiring a password but it also gives hackers complete access to specific user profiles as well.
As per a report by Gadgets 360, Gahlot reached out to the DigiLocker team and the security vulnerability has now been patched.
Catch all the Latest Tech News, Mobile News, Laptop News, Gaming news, Wearables News , How To News, also keep up with us on Whatsapp channel,Twitter, Facebook, Google News, and Instagram. For our latest videos, subscribe to our YouTube channel.