Government Sites Said to Have Critical Vulnerabilities; NCIIPC and CERT-in Step In: Reports

The vulnerabilities reportedly exposed sensitive files, credentials, and police FIRs.

Advertisement
By Shayak Majumder | Updated: 22 February 2021 19:36 IST
Highlights
  • Sakura Samurai researchers’ collective spotted the lapses
  • US DoD Vulnerability Disclosure Program was involved to raise concerns
  • NCSC says remedial actions have been taken
Government Sites Said to Have Critical Vulnerabilities; NCIIPC and CERT-in Step In: Reports

The critical issues included over 13,000 identifiable information instances

Photo Credit: Pexels/ Mati Mango

Security researchers said they found thousands of critical vulnerabilities in dozens of government-run Web services, more than half of which reportedly belonged to state governments. Most of the services had multiple issues that included exposed credentials, leaks of sensitive files, and existence of known bugs. If exploited, these lapses could reportedly lead to deeper access within the government network, as per the researchers. The issues had been brought under the notice of the National Critical Information Infrastructure Protection Centre (NCIIPC) earlier this month. Now, a top official from the National Cyber Security Coordinator (NCSC) said that “remedial actions” have been taken.

The details of the compromised services were not made public as a security measure. However, many government departments are still catching up on security measures, particularly at the state level. But obviously, different departments have different threat profiles.

The collective of researchers, who call themselves Sakura Samurai, reached out to the NCIIPC in early February. However, the flagged issues remained unresolved for over two weeks, as per a report by Hindustan Times.

On February 20, Sakura Samurai member John Jackson published a blog detailing the breach and how the US Department of Defense Vulnerability Disclosure Program (DC3 VDP) had to be involved to help the Indian cyber-security wing to take notice. The report suggests that the delay in action could have resulted in bad actors accessing sensitive information and conduct disruptive operations against government servers.

Advertisement

The critical issues found in the government Web services included exposed credentials that could allow unauthorised access for hackers. Apart from that, Jackson and his team wrote that they discovered 35 instances of credentials pairs (that can be used to authenticate to a target), three instances of sensitive files, dozens of police FIRs, and over 13,000 identifiable information instances. Potential lapses were also discovered that could compromise extremely sensitive government systems. Team Sakura Samurai tested gov.in systems as part of the Responsible Vulnerability Disclosure Program (RVDP) run by NCIIPC. RVDP allows developers, researchers, and security professionals to report issues of potential information security risk to companies and countries.

Jackson explained in the blog, “Even though the Indian Government has a RVDP in place, we didn't feel comfortable disclosing the vulnerabilities right away. The hacking process was far from the standard situation of business-as-usual security research. In total, our report compounded to a massive 34-page report worth of vulnerabilities. We knew that our intent was good, but we wanted to ensure that the US Government had eyes on the situation.”

Advertisement

Sakura Samurai then co-ordinated with the DC3 VDP to assist in facilitating the initial conversations. On February 4, the US body tagged NCIIPC in a tweet, saying, “Check your email and let's chat.”

The NCSC opened a communication channel with Jackson and his team on Sunday. National Cyber Security Coordinator (NCSC) Lt Gen Rajesh Pant told Hindustan Times that necessary actions were taken. “Remedial actions have been taken by NCIIPC (National Critical Information Infrastructure Protection Centre) and Cert-IN (Indian Computer Emergency Response Team)… NCIIPC handles only the Critical Information Infrastructure issues. In this case the balance pertained to other states and departments that were immediately informed by CERT-In. It is likely that some action may be pending by users at state levels which we are checking.”


Does WhatsApp's new privacy policy spell the end for your privacy? We discussed this on Orbital, our weekly technology podcast, which you can subscribe to via Apple Podcasts, Google Podcasts, or RSS, download the episode, or just hit the play button below.

Affiliate links may be automatically generated - see our ethics statement for details.
 

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.

Advertisement

Related Stories

Popular Mobile Brands
  1. Oppo Reno 14 5G Series Launching Today: All You Need to Know
  2. Oppo Reno 14 Pro 5G Launched in India Alongside Reno 14 5G: See Price
  3. Maa OTT Release Date Reportedly Revealed: When and Where to Watch it Online?
  4. Nothing Teases Release of Android 16-Based Nothing OS 4.0 Update
  5. Vivo X Fold 5, Vivo X200 FE to Launch in India On This Date
  6. Honor Watch 5 Ultra With eSIM Support, ECG Tracking Launched
  7. Oppo Reno 14 Pro First Impressions
  8. Tecno Spark 40 Pro+, Spark 40 Pro and Spark 40 Launched: All Details
  1. Google Pixel 6a to Get Mandatory Android 16 Update to Fix Battery Overheating Issues
  2. Tecno Spark 40 Pro+ With MediaTek Helio G200 SoC Launched Alongside Spark 40 Pro and Spark 40
  3. Oppo Pad SE Launched in India With MediaTek Helio G100 SoC, 9,340mAh Battery: Price, Specifications
  4. Naughty Dog Head Neil Druckmann to Step Away From HBO's The Last of Us TV Show to Focus on Games
  5. Google Chrome Update Patches Security Flaw That Granted Attackers Access When Users Visited Malicious Websites
  6. Google Is Bringing Gems to the Gemini Side Panel in Gmail, Docs, and Other Workspace Apps
  7. Meta Verified Users Claim ‘Useless’ Customer Support Amid Account Bans Despite Paying for Subscription
  8. Vivo X Fold 5 and Vivo X200 FE India Launch Date Set for July 14
  9. Infinix Hot 60 5G+ Leaked Images Show Off New Side Button, Triple Rear Cameras
  10. Microsoft Cancels Perfect Dark, Shuts Down Developer The Initiative in Widespread Xbox Cuts
Gadgets 360 is available in
Download Our Apps
Available in Hindi
© Copyright Red Pixels Ventures Limited 2025. All rights reserved.