1. Security through obscurity and fear
Abhinav Srivastava

2. Who am I ?
IIT Kharagpur graduate 2009, started career as Security researcher at iViZ Security
Founded Qarth Technologies with Govt funding and incubation support at IIT Madras 2011
Developed first version of secure UPI architecture in 2012
Startup acquired by Ola Now works at Ola Innovation labs on connected cars platform
Unified payment interface : Infrastructure of BHIM app/wahts app app

3. Why I am here?
Victim of media hype

4. What exactly happened ?
An android app was discovered on play store providing aadhaar data via an OTP
The publisher of the app (my personal ) was not an authorised Aadhaar eKYC agency
FUD !!!

5. How was the app working ?
App was using a publicly available API developed by NIC which was used in one of their app named eHospital

6. What was the Security Vulnerability ?
No HTTPS, No SSL Pinning in eHospital App
No request and response payload encryption
Password stored in android app
No demographic validation and rate limiting on server
Basically an insecure public API over the globe for providing aadhaar details through OTP

7. Why developed such an app?

8. Why developed such an app?
Fake Aadhar is a serious problem
Need an easy way to validate the Aadhar number
A simple android app can empower the citizens to verify an Aadhaar Card in seconds
Never save user’s aadhaar data in any form in the process.
Help people to validate their own Aadhar data

9. Why was the hype? Case tagged as a network security issue
Hyped up by media as national security breach
Nobody - media/police understood the technology behind the app
Overaggressive approach by police and judiciary - State vs Abhinav Srivastava

10. Key Questions? Does Aadhaar database got hacked ? - NO
Was it a National Security Issue ? - NO
Is Aadhar ecosystem secure? NO
Is there any other security loophole ? MAYBE
Govt has created fear in the mind of security researchers, even if they find something they won’t report. Like Google and facebook encourage vulnerability and reward them, our Govt is taking a strikingly opposite position for such a important national issue.

11. Q & A ?