Massive data breach from @NPCI_BHIM app.
"The scale of the exposed data is extraordinary, affecting millions of people all over India and exposing them to potentially devastating fraud, theft, and attack from hackers and cybercriminals."
vpnmentor.com/blog/report-cs…
"The scale of the exposed data is extraordinary, affecting millions of people all over India and exposing them to potentially devastating fraud, theft, and attack from hackers and cybercriminals."
vpnmentor.com/blog/report-cs…
This project was run by @CSCegov_ which comes under @OfficeOfRSP to promote private and foreign bank owned company @NPCI_NPCI's app.
cscbhim.in/static/fronten…
cscbhim.in/static/fronten…
#DigitalIndia in one picture.
Minister thanks an IT cell drone whose account has since been suspended.
twitter.com/vikramjit_datta
Minister thanks an IT cell drone whose account has since been suspended.
twitter.com/vikramjit_datta
Will Chowkidar sarkar come up with another power point presentation about their @13footwall security?
Will they deploy a senior babu like @rssharma3 to claim that all this data was already in the public domain so there's no real loss/risk to anybody?
Will they deploy a senior babu like @rssharma3 to claim that all this data was already in the public domain so there's no real loss/risk to anybody?
As expected... another blanket denial of reality from @NPCI_BHIM
Is the same "high level of security" demanded from your customer onboarding partner @CSCegov_
Why were they collecting all these documents for BHIM related work?
Who authorised them?
Is the same "high level of security" demanded from your customer onboarding partner @CSCegov_
Why were they collecting all these documents for BHIM related work?
Who authorised them?
When the blog post went up yesterday and even when I made the tweet this morning, the CSC-BHIM website was not using HTTPS.
They have hurriedly pruchased a certificate to cover up this oversight and the idiots couldn't even buy the right certificate.
cscbhim.in
They have hurriedly pruchased a certificate to cover up this oversight and the idiots couldn't even buy the right certificate.
cscbhim.in
The morons at @CSCegov_ don't know that a certificate issued for AltNames "www dot cscbhim dot in" and "* dot cscbhim dot in" will not work for "cscbhim dot in"
And why would they even add www dot cscbhim dot in as an AltName when "* dot cscbhim dot in" will match that?
And why would they even add www dot cscbhim dot in as an AltName when "* dot cscbhim dot in" will match that?
Let's play a game!
Will @CSCegov_ dump their one day old certificate and buy a new one that works for "cscbhim dot in"?
Or will they force their website to serve on "www dot cscbhim dot in" breaking all their existing docs and training material?
Will @CSCegov_ dump their one day old certificate and buy a new one that works for "cscbhim dot in"?
Or will they force their website to serve on "www dot cscbhim dot in" breaking all their existing docs and training material?
Here's a screenshot of the wrong certificate with more details.
BREAKING: Creator of @NPCI_BHIM app blames @CSCegov_ under Minister @rsprasad for this massive data leak.
In case he decides to delete his tweet.
And here's the source of the leak.
Chowkidar sarkar was growth hacking their 'less cash economy' dream.
Not only is there more cash in circulation today, millions of non-tech savvy Indians have been put at risk of Identity theft.
Chowkidar sarkar was growth hacking their 'less cash economy' dream.
Not only is there more cash in circulation today, millions of non-tech savvy Indians have been put at risk of Identity theft.
In more #DigitalIndia #FAIL the open S3 bucket secrets were stored in clear text in the mobile app.
Because they couldn't be arsed to arsed to RTFM and use pre-signed URLs.
docs.aws.amazon.com/sdk-for-ruby/v…
Because they couldn't be arsed to arsed to RTFM and use pre-signed URLs.
docs.aws.amazon.com/sdk-for-ruby/v…
How does the govt. employing people to install apps on other people's phones in this manner count as consent /"informed consent"?
Remember they also offered bait of weekly/monthly cash lottery with prizes worth a lakh to get people to install the app.
cscbhim.in/static/fronten…
Remember they also offered bait of weekly/monthly cash lottery with prizes worth a lakh to get people to install the app.
cscbhim.in/static/fronten…
If you ever wondered how so many people fall victim to UPI scams where scamsters install screensharing apps to take control of phones.
It's because the govt. through such @CSCegov_ VLEs has normalised this behaviour of people allowing others to install apps on their phones.
It's because the govt. through such @CSCegov_ VLEs has normalised this behaviour of people allowing others to install apps on their phones.
Nearly 1 in 5 @SetuAarogya installs too have been done by @CSCegov_ VLEs on phones of tech-illiterate people.
In the middle of a pandemic the govt was literally getting strangers to share mobile phones and touch their screens.
thehindubusinessline.com/info-tech/cscs…
In the middle of a pandemic the govt was literally getting strangers to share mobile phones and touch their screens.
thehindubusinessline.com/info-tech/cscs…
Remember the govt got rid of biometric attendance for its employees on March 6th to curb the spread of the virus.
But in the middle of a lockdown they got VLEs to handle other people's phones to install an app.
What if a VLE was COVID +ve?
But in the middle of a lockdown they got VLEs to handle other people's phones to install an app.
What if a VLE was COVID +ve?
