Government Sites Said to Have Critical Vulnerabilities; NCIIPC and CERT-in Step In: Reports

The vulnerabilities reportedly exposed sensitive files, credentials, and police FIRs.

Advertisement
By Shayak Majumder | Updated: 22 February 2021 19:36 IST
Highlights
  • Sakura Samurai researchers’ collective spotted the lapses
  • US DoD Vulnerability Disclosure Program was involved to raise concerns
  • NCSC says remedial actions have been taken
Government Sites Said to Have Critical Vulnerabilities; NCIIPC and CERT-in Step In: Reports

The critical issues included over 13,000 identifiable information instances

Photo Credit: Pexels/ Mati Mango

Security researchers said they found thousands of critical vulnerabilities in dozens of government-run Web services, more than half of which reportedly belonged to state governments. Most of the services had multiple issues that included exposed credentials, leaks of sensitive files, and existence of known bugs. If exploited, these lapses could reportedly lead to deeper access within the government network, as per the researchers. The issues had been brought under the notice of the National Critical Information Infrastructure Protection Centre (NCIIPC) earlier this month. Now, a top official from the National Cyber Security Coordinator (NCSC) said that “remedial actions” have been taken.

The details of the compromised services were not made public as a security measure. However, many government departments are still catching up on security measures, particularly at the state level. But obviously, different departments have different threat profiles.

The collective of researchers, who call themselves Sakura Samurai, reached out to the NCIIPC in early February. However, the flagged issues remained unresolved for over two weeks, as per a report by Hindustan Times.

On February 20, Sakura Samurai member John Jackson published a blog detailing the breach and how the US Department of Defense Vulnerability Disclosure Program (DC3 VDP) had to be involved to help the Indian cyber-security wing to take notice. The report suggests that the delay in action could have resulted in bad actors accessing sensitive information and conduct disruptive operations against government servers.

The critical issues found in the government Web services included exposed credentials that could allow unauthorised access for hackers. Apart from that, Jackson and his team wrote that they discovered 35 instances of credentials pairs (that can be used to authenticate to a target), three instances of sensitive files, dozens of police FIRs, and over 13,000 identifiable information instances. Potential lapses were also discovered that could compromise extremely sensitive government systems. Team Sakura Samurai tested gov.in systems as part of the Responsible Vulnerability Disclosure Program (RVDP) run by NCIIPC. RVDP allows developers, researchers, and security professionals to report issues of potential information security risk to companies and countries.

Jackson explained in the blog, “Even though the Indian Government has a RVDP in place, we didn't feel comfortable disclosing the vulnerabilities right away. The hacking process was far from the standard situation of business-as-usual security research. In total, our report compounded to a massive 34-page report worth of vulnerabilities. We knew that our intent was good, but we wanted to ensure that the US Government had eyes on the situation.”

Advertisement

Sakura Samurai then co-ordinated with the DC3 VDP to assist in facilitating the initial conversations. On February 4, the US body tagged NCIIPC in a tweet, saying, “Check your email and let's chat.”

The NCSC opened a communication channel with Jackson and his team on Sunday. National Cyber Security Coordinator (NCSC) Lt Gen Rajesh Pant told Hindustan Times that necessary actions were taken. “Remedial actions have been taken by NCIIPC (National Critical Information Infrastructure Protection Centre) and Cert-IN (Indian Computer Emergency Response Team)… NCIIPC handles only the Critical Information Infrastructure issues. In this case the balance pertained to other states and departments that were immediately informed by CERT-In. It is likely that some action may be pending by users at state levels which we are checking.”


Does WhatsApp's new privacy policy spell the end for your privacy? We discussed this on Orbital, our weekly technology podcast, which you can subscribe to via Apple Podcasts, Google Podcasts, or RSS, download the episode, or just hit the play button below.

Affiliate links may be automatically generated - see our ethics statement for details.
 

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.

Advertisement

Related Stories

Popular Mobile Brands
  1. Amazon Prime Day Sale 2025: Best Offers on Thin and Light Laptops
  2. Vivo X Fold 5 Launched in India With 8.03-Inch Foldable Display
  3. Vivo X200 FE Launched in India With 6,500mAh Battery, Compact Design
  4. iQOO Z10R India Launch Teased; May Get MediaTek Dimensity 7400 SoC
  5. Google Pixel 10 Series Leak Hints at Similar Pricing to Pixel 9 Lineup
  6. Qualcomm Announces Snapdragon XR Day in India for July 21
  7. Amazon Prime Day 2025 Sale Is Live: Best Tech Deals
  8. Vivo X200 FE First Impressions
  1. Vivo X200 FE Launched in India With MediaTek Dimensity 9300+ SoC, 6,500mAh Battery
  2. Vivo X Fold 5 Launched in India With 8.03-Inch Foldable Screen, 50-Megapixel Telephoto Camera
  3. Samsung Confirms Some Galaxy AI Features Will Remain Free After 2025: Report
  4. Amazon Prime Day Sale 2025: Check This Last Minute Deal on iPhone 16e
  5. Samsung Galaxy S25 FE Key Specifications Leaked; Could Feature Larger Battery, LTPO Display
  6. Google Pixel 10 Series, Pixel Buds 2a Pricing Leaked Online Ahead of Launch
  7. iQOO Z10R India Launch Teased; Listed on Geekbench With MediaTek Dimensity 7400 SoC
  8. Qualcomm Announces Snapdragon XR Day in India to Showcase Future of AR, VR Technologies on July 21
  9. Meteorite From Outer Solar System Challenges Planet Formation Timeline in Early Solar System
  10. NASA’s Hubble and Webb Discover Bursting Star Formation in Small Magellanic Cloud
Gadgets 360 is available in
Download Our Apps
Available in Hindi
© Copyright Red Pixels Ventures Limited 2025. All rights reserved.