Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


05:39 PM
Connect Directly

Data on Indian Mobile Payments App Reportedly Exposed via Open S3 Bucket

Over 7 million records exposed, according to vpnMentor, but app maker says there is no sign of malicious use.

Data belonging to millions of Indian citizens who had signed up for a mobile payment app called BHIM may have been put at risk of misuse after it was left exposed and unencrypted in a misconfigured Amazon S3 storage bucket.

Researchers at VPN review service vpnMentor recently discovered the S3 bucket connected to a website that is being used to promote adoption of the payment app and to sign up new individual users and merchant businesses.

In a report, vpnMentor described the storage bucket as containing 409GB of data representing some 7.26 million records containing information needed to open a BHIM account. The data included scans of national ID cards; photos used as proof of residence; professional certificates, degrees, and diplomas; and names, date of birth, and religion. Also included in the data set were ID numbers for government programs and biometric identifiers such as fingerprint scans.

The personal user data contained in the dataset provided "a complete profile of individuals, their finances, and banking records," vpnMentor said. "Having such sensitive financial data in the public domain or the hands of criminal hackers would make it incredibly easy to trick, defraud, and steal from the people exposed," it noted.

In addition to data on individuals, the S3 bucket also contained "massive CSV lists" with information on merchants that had signed up for BHIM and the IDs used by business owners to make payment transfers via the app. Similar IDs belonging to over 1 million individuals may also have been potentially exposed via the misconfigured S3 bucket. Such IDs make it much easier for hackers to illegally access bank accounts belonging to the impacted individuals vpnMentor said.

However, the National Payments Corporation of India (NPCI), which launched BHIM in 2016, on Monday denied that any user data had been compromised and urged its users not to fall prey to what it described as speculative news reports. The organization claimed it followed highly secure practices and an "integrated approach" to protect its payments infrastructure and user data.

But Lisa Taylor, a researcher at vpnMentor, insists the breach happened.

"The fact remains that PII data of millions of Indian citizens was left unprotected on a public bucket," she says. "Instead of looking into the faults that lead to this breach and make sure they won't happen again, we are faced with ridiculous claims it never happened."

According to Taylor, vpnMentor confirmed a company named CSC BHIM as the owner of the storage bucket that contained the sensitive data. "The CSC BHIM site mentions NPCI and Punjab national bank as their partners," she says. The site features photos related to BHIM promotions in various parts of India, under the BHIM logo, Taylor adds. "The site itself bears the BHIM logo, as well as that of the Indian ministry of electronics and information."

BHIM — short for Bharat Interface for Money — is designed to let people and businesses make direct bank payments. One key feature of the app is that it lets users initiate transactions without having to enter banking information and other sensitive data each time. According to the NPCI, the Android version of the app has nearly 134 million downloads and the iOS version has 2.8 million downloads as of April 2020.

Long Trail of Similar Breaches
The reported incident involving BHIM is the latest example of a data exposure resulting from a poorly configured AWS S3 bucket. In recent years, there have been a virtually never-ending stream of similarly massive breaches.

In March, vpnMentor reported discovering over 500,000 documents — including credit reports, legal documents, bank statements, and driver's license information related to a mobile app developed by Advantage Capital Funding and Argus Capital Funding — in an open S3 bucket. Last year, risk management vendor Upguard reported finding data belonging to millions of customers of Thailand's Lion Air and two of its subsidiaries in an AWS storage bucket. In February, UpGuard again found data on 120 million retail customers sitting exposed in an AWS cloud container after a market analysis company put it there.

Often the breaches have resulted from basic configuration errors — like making the bucket private and setting authentication controls. A lack of proper understanding among administrators of how settings for access control lists and other policies governing access to S3 buckets work is another issue researchers have noted. The wide availability of tools that make it easy for people to look for misconfigured or easily compromised storage buckets has exacerbated the problem, they have noted.

According to vpnMentor, it discovered the BHIM data set in April and notified the developer of the website to which it was linked. When it did not receive a response, the company contacted India's Computer Emergency Response Team in April. But it was only after vpnMentor contacted the Indian CERT team once again in May that the breach was addressed, the company claimed.

This story was updated on June 2 with the comments from Lisa Taylor.

Related Content:


Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register
Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/13/2020
Where Are the 'Great Exits' in the Data Security Market?
Dave Cole, Cofounder and CEO, Open Raven,  10/13/2020
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-10-19
A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and settin...
PUBLISHED: 2020-10-19
On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon users (both students and teachers) usually don't have administr...
PUBLISHED: 2020-10-19
An exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-Bradley Flex IO 1794-AENT/B 4.003. A specially crafted network request can cause a loss of communications with the device resulting in denial-of-service. An attacker can send a malic...
PUBLISHED: 2020-10-19
An exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-Bradley Flex IO 1794-AENT/B 4.003. A specially crafted network request can cause a loss of communications with the device resulting in denial-of-service. An attacker can send a malic...
PUBLISHED: 2020-10-19
A flaw was found in Infinispan version 10, where it permits local access to controls via both REST and HotRod APIs. This flaw allows a user authenticated to the local machine to perform all operations on the caches, including the creation, update, deletion, and shutdown of the entire server.