Indian State Government Website Exposed COVID-19 Lab Test Results

A security flaw in a website run by the government of West Bengal in India exposed the lab results of at least hundreds of thousands of residents, though likely millions, who took a COVID-19 test. TechCrunch reports: The website is part of the West Bengal government's mass coronavirus testing program. Once a COVID-19 test result is ready, the government sends a text message to the patient with a link to its website containing their test results. But security researcher Sourajeet Majumder found that the link containing the patient's unique test identification number was scrambled with base64 encoding, which can be easily converted using online tools. Because the identification numbers were incrementally sequenced, the website bug meant that anyone could change that number in their browser's address bar and view other patients' test results. The test results contain the patient's name, sex, age, postal address and if the patient's lab test result came back positive, negative or inconclusive for COVID-19. Majumder told TechCrunch that he was concerned a malicious attacker could scrape the site and sell the data. "This is a privacy violation if somebody else gets access to my private information," he said. Majumder reported the vulnerability to India's CERT, the country's dedicated cybersecurity response unit, which acknowledged the issue in an email. He also contacted the West Bengal government's website manager, who did not respond. TechCrunch independently confirmed the vulnerability and also reached out to the West Bengal government, which pulled the website offline, but did not return our requests for comment.Read more of this story at Slashdot.
Click here to read full news..