The Global Pravasi Rishta Portal, India’s government platform for connecting with its overseas population, leaked sensitive data, including names and passport details.
According to the Cybernews research team the platform exposed usernames, surnames, country of residence, and email addresses in plaintext, as well as occupation status, phone and passport numbers of expats.
The leak was possible because of poor security measures, such as a lack of authentication methods.
The Global Pravasi Rishta Portal is a platform that aims at connecting 30 million Indian expats. The platform owner is the Ministry of External Affairs of India, the country’s government body responsible for implementing foreign policy.
The portal is meant for communication between the Ministry of External Affairs, Indian Missions, and the Indian diaspora. Pravasi Rishta means “expatriate relationships” in English.
The Cybernews team has reached out to the Ministry of External Affairs to inform it of the leak and the security issue had been fixed after several days.
The data was exposed via the website’s edit function, where manipulating the URL allowed anyone to access the edit details of any user on the site. It takes only one registered user to access all of them, since changing the user ID in the URL leads to another user’s account.
Comments