COVID-19 Platform Used by UP Government Exposed Data of Lakhs: Researchers


A COVID-19 surveillance software that was apparently constructed by the state authorities of Uttar Pradesh put the info of 80 lakh residents in danger, in line with a report. The software was discovered to have quite a few vulnerabilities that each one have been exposing personally identifiable data knowledge that included full names, ages, genders, resident addresses, and cellphone numbers of each particular person who was examined for COVID-19 within the nation’s greatest state and its different elements, in line with researchers. The info breach acquired secured on September 10 — over a month after it was first observed.

Researchers from digital non-public community (VPN) service supplier VPNMentor observed the info breach via the software known as “Surveillance Platform Uttar Pradesh COVID-19” on August 1. The surveillance platform was compromised via varied vulnerabilities and all of them have been pointing to a extreme lack of safety, the researchers noted in a weblog submit.

The primary vulnerability was present in an unsecured git repository that contained a “knowledge dump” of saved login credentials together with usernames and passwords for admin accounts on the platform. Based mostly on the preliminary discovery, VPNMentor analysts Noam Rotem and Ran Locar found an uncovered Net index that contained a listing itemizing of CSV recordsdata. These recordsdata listed all identified instances of COVID-19 testing in Uttar Pradesh and different elements of India, reaching the quantity of over 80 lakh folks. There have been knowledge resembling full names, addresses, and cellphone numbers together with check outcomes of people.

The Net index additionally included the info of non-Indian residents and overseas residents. Additional, there have been lists that had the details about many healthcare staff, in line with the invention.

Researchers talked about within the weblog submit that the Net index was accessible with none password and was utterly open to the general public.

“Whereas the listing itemizing did not immediately impression Uttar Pradesh’s surveillance platform, it severely compromised the protection of the hundreds of thousands of individuals listed within the CSV recordsdata, whose knowledge in all probability originated from the surveillance platform and different sources,” the researchers mentioned.

After amassing the main points from the invention, the researchers submitted the report back to share with the Indian authorities. The report was forwarded to the nation’s Laptop Emergency Response Group CERT-In on August 27. The crew of researchers additionally reached the UP cybercrime division, although it did not reply. On September 7, CERT-In was reached out once more by the researchers that finally helped repair the problems, as per the weblog submit.

“Such malicious actions would have many real-world penalties on the effectiveness of Uttar Pradesh’s response and motion towards coronavirus, probably inflicting excessive disruption and chaos,” the researchers famous.

There is no such thing as a data whether or not any of the uncovered knowledge was compromised by an attacker. Nevertheless, the researchers at VPNMentor consider that the impact of the vulnerabilities within the surveillance software may very well be felt far past the authorities engaged on COVID-19 reduction in Uttar Pradesh.


Ought to the federal government clarify why Chinese language apps have been banned? We mentioned this on Orbital, our weekly expertise podcast, which you’ll be able to subscribe to by way of Apple Podcasts, Google Podcasts, or RSS, download the episode, or simply hit the play button under.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top