CYBERLERT

Anyone can publish on Medium per our Policies, but we don’t fact-check every story. For more info about the coronavirus, see cdc.gov.

Aarogya Setu: The story of a failure Elliot Alderson May 6 · 5 min read

In order to fight Covid19, the Indian government released a mobile contact tracing application called Aarogya Setu. This application is available on the PlayStore and 90 million Indians already installed it.

Aarogya Setu - Apps on Google Play Aarogya Setu is a mobile application developed by the Government of India to connect essential health services with the… play.google.com

This application is currently getting a lot of attention in India. In Noida, if people doesn’t have the app installed on their phone, a person can be imprisoned up to 6 months or fined up to Rs 1000.

No Aarogya Setu app? Pay Rs 1,000 ne or face 6 months jail in Noida "If people download it instantly, we will let them go. We are doing this so that people take the order seriously and… indianexpress.com

Access to app internal files On April 3, 2 days after the launch of the app, I decided to give a look to the version 1.0.1 of the application. It was 11:54 pm and I spent less than 2 hours looking at it.

Elliot Alderson @fs0c131y

<Thread> 2 days ago, India launched a mobile app "to fight against the #COVID19" I installed the app and I have 1 hour in front of me, let's see what I can find. twitter.com/vikramKadiam/s… @vikramKadiam VK Replying to @labnol cc:@fs0c131y Can you see how scary the App functions are! The amount of data it collects and sends to god knows who and it's interesting to see whether it protects users privacy. play.google.com/store/apps/det…

463 3:24 AM - Apr 4, 2020 184 people are talking about this

At 1:27 am, I found that an activity called WebViewActivity, was behaving weirdly. This activity is a webview and is, in theory, responsible of showing web page like the privacy policy for example.

AndroidManifest.xml in Aarogya Setu v1.0.1

The issue is that WebViewActivity was capable of doing a little bit more than that.

WebViewActivity in Aarogya Setu v1.0.1

As you can see, the onPageStarted method checked the value of the str parameter. If str: - is tel://[phone number]: it will ask Android to open the dialer and pre-dial the number - doesnâ&#x20AC;&#x2122;t contain http or https, it does nothing - else it is opening a webview with the specified URI. As you can see there is no host validation at all. So, I tried to open an internal file of the application called FightCorona_prefs.xml by sending the following command

As you can see in the following video, it worked fine!

Elliot Alderson @fs0c131y · Apr 4, 2020 Replying to @fs0c131y

I wanted to check something before going to bed. I can use this "issue" to access my authToken. I will record a small video twitter.com/fs0c131y/statu…

Elliot Alderson @fs0c131y Replying to @fs0c131y

Lol

Elliot Alderson @fs0c131y

It can be considered as a security issue

720 5:15 AM - Apr 4, 2020 246 people are talking about this

Why it’s a problem? With only 1-click an attacker can open any app internal file, included the local database used by the app called fight-covid-db

Ability to know who is sick anywhere in India

On May 4, I decided to push my analyse a little bit further and I analysed the version v1.1.1 of the app which is the current version.

The first thing I noticed is the issue described previously had been fixed silently by the developpers. Indeed, the WebViewActivity is no more accessible from the outside, they removed the intent filters in the AndroidManifest.xml.

AndroidManifest.xml in Aarogya Setu v1.1.1

To continue my analysis, I decided to use the app on a rooted device. When I tried, I directly received this message.

I decompiled the app and found where this root detection was implemented. In order to bypass it, I wrote a small function in my Frida script.

The next challenge was to be able to bypass the certificate pinning implemented in order to be able to monitor the network requests made by the app. Once I done that, I used the app and found an interesting feature

In the app, you have the ability to know how many people did a self assessment in your area. You can choose the radius of the area. It can be 500m, 1km, 2kms, 5kms or 10kms.

When the user is clicking on one of the distance: - his location is sent: see the lat and lon parameters in the header - the radius choosen is sent: see the dist parameter in the url and the distance parameter in the header

The first thing I noticed is that this endpoint returns a lot of info: - Number of infected people - Number of unwell people - Number of people declared as bluetooth positive - Number of self assesment made around you - Number of people using the app around you

Because I’m stupid, the 1st thing I tried was to modify the location to see if I was able to get information anywhere in India. The 2nd thing was to modify the radius to 100kms to see if I was able to get info with a radius which is not available in the app. As you can see in the previous screenshot, I set my location to New Delhi and set the radius to 100kms and it worked!

What are the consequences?

Thanks to this endpoint an attacker can know who is infected anywhere in India, in the area of his choice. I can know if my neighboor is sick for example. Sounds like a privacy issue for me…

So I decided to play with it a little bit and checked who was infected in some specific places with a radius of 500 meters: - PMO office: {“infected”:0,”unwell”:5,”bluetoothPositive”:4,”success”:true,”selfAsses”:215,”usersNe arBy”:1936} - Ministry of Defense: {“infected”:0,”unwell”:5,”bluetoothPositive”:11,”success”:true,”selfAsses”:123,”usersN earBy”:1375} - Indian Parliament: {“infected”:1,”unwell”:2,”bluetoothPositive”:17,”success”:true,”selfAsses”:225,”usersN earBy”:2338} - Indian Army Headquarters: {“infected”:0,”unwell”:2,”bluetoothPositive”:4,”success”:true,”selfAsses”:91,”usersNea rBy”:1302}

Disclosure Elliot Alderson @fs0c131y

Hi @SetuAarogya, A security issue has been found in your app. The privacy of 90 million Indians is at stake. Can you contact me in private?

Regards, PS: @RahulGandhi was right 27.2K 8:40 PM - May 5, 2020

13.6K people are talking about this

49 minutes after my initial tweet, NIC and the Indian Cert contacted me. I sent them a small technical report.

Few hours after that they released an official statement.

Aarogya Setu @SetuAarogya

Statement from Team #AarogyaSetu on data security of the App.

17.6K 1:03 AM - May 6, 2020

To sum up they said â&#x20AC;&#x153;Nothing to see here, move onâ&#x20AC;?.

My answer to them is: - As you saw in the article, it was totally possible to use a different radius than the 5 hardcoded values, so clearly they are lying on this point and they know that. They even admit that the default value is now 1km, so they did a change in production after my

report - The funny thing is they also admit an user can get the data for multiple locations.

Thanks to triangulation, an attacker can get with a meter precision the health status of someone.

- Bulk calls are possible my man. I spent my day calling this endpoint and you know it too.

Iâ&#x20AC;&#x2122;m happy they quickly answered to my report and fixed some of the issues but seriously: stop lying, stop denying.

And donâ&#x20AC;&#x2122;t forget folks: Hack the planet! đ&#x;¤&#x2DC;

Covid 19

Android

Aarogya Setu App

Security

Cybersecurity

Stay up to date on coronavirus (Covid-19) Follow the Medium Coronavirus Blog or sign up for the newsletter to read expertbacked coronavirus stories from Medium and across the web, such as: Itâ&#x20AC;&#x2122;s time to learn how to microdose anticipation.

Benjamin Franklin would get social distancing.

The 3 strangest Covid-19 symptoms explained.

About Help Legal Get the Medium app