Government Sites Said to Have Critical Vulnerabilities; NCIIPC and CERT-in Step In: Reports

Security researchers said they found thousands of critical vulnerabilities in dozens of government-run Web services, more than half of which reportedly belonged to state governments. Most of the services had multiple issues that included exposed credentials, leaks of sensitive files, and existence of known bugs. If exploited, these lapses could reportedly lead to deeper access within the government network, as per the researchers. The issues had been brought under the notice of the National Critical Information Infrastructure Protection Centre (NCIIPC) earlier this month. Now, a top official from the National Cyber Security Coordinator (NCSC) said that “remedial actions” have been taken.

The details of the compromised services were not made public as a security measure. However, many government departments are still catching up on security measures, particularly at the state level. But obviously, different departments have different threat profiles.

The collective of researchers, who call themselves Sakura Samurai, reached out to the NCIIPC in early February. However, the flagged issues remained unresolved for over two weeks, as per a report by Hindustan Times.

On February 20, Sakura Samurai member John Jackson published a blog detailing the breach and how the US Department of Defense Vulnerability Disclosure Program (DC3 VDP) had to be involved to help the Indian cyber-security wing to take notice. The report suggests that the delay in action could have resulted in bad actors accessing sensitive information and conduct disruptive operations against government servers.

The critical issues found in the government Web services included exposed credentials that could allow unauthorised access for hackers. Apart from that, Jackson and his team wrote that they discovered 35 instances of credentials pairs (that can be used to authenticate to a target), three instances of sensitive files, dozens of police FIRs, and over 13,000 identifiable information instances. Potential lapses were also discovered that could compromise extremely sensitive government systems. Team Sakura Samurai tested gov.in systems as part of the Responsible Vulnerability Disclosure Program (RVDP) run by NCIIPC. RVDP allows developers, researchers, and security professionals to report issues of potential information security risk to companies and countries.

Jackson explained in the blog, “Even though the Indian Government has a RVDP in place, we didn't feel comfortable disclosing the vulnerabilities right away. The hacking process was far from the standard situation of business-as-usual security research. In total, our report compounded to a massive 34-page report worth of vulnerabilities. We knew that our intent was good, but we wanted to ensure that the US Government had eyes on the situation.”

Sakura Samurai then co-ordinated with the DC3 VDP to assist in facilitating the initial conversations. On February 4, the US body tagged NCIIPC in a tweet, saying, “Check your email and let's chat.”

The NCSC opened a communication channel with Jackson and his team on Sunday. National Cyber Security Coordinator (NCSC) Lt Gen Rajesh Pant told Hindustan Times that necessary actions were taken. “Remedial actions have been taken by NCIIPC (National Critical Information Infrastructure Protection Centre) and Cert-IN (Indian Computer Emergency Response Team)… NCIIPC handles only the Critical Information Infrastructure issues. In this case the balance pertained to other states and departments that were immediately informed by CERT-In. It is likely that some action may be pending by users at state levels which we are checking.”

Does WhatsApp's new privacy policy spell the end for your privacy? We discussed this on Orbital, our weekly technology podcast, which you can subscribe to via Apple Podcasts, Google Podcasts, or RSS, download the episode, or just hit the play button below.