Hacker Reports Vulnerability and Possible Data Leak in Vodafone Idea Subscriber Database Portal

According to cybersecurity researcher and ethical hacker Sunny Nehra, Vodafone Idea (Vi) user information may have been accessed by threat actors after an alleged leak of their service portal username and password directory on the dark web.

The database portal includes information on all older active and inactive subscribers of the telecom operator, including current and permanent addresses, date of birth, PAN and Aadhaar card details, Nehra said. . As of January 2022, Vi has over 24.72 crore active subscribers.

Nehra, Admin, Hacks and Security, found a set of 12-15 user IDs and passwords from various Vi portals, available for sale on private darknet forums. While testing one, he discovered that it belonged to the Subscriber Database Portal and was probably for special access by the Delhi Police.

Activity area contacted Vi with questions on Saturday and the company denied any such violations in its portals and apps on Monday.

“Vi has a very strict IT security framework and we regularly perform checks and audits to identify potential areas of vulnerability to further strengthen our security architecture. We found no such violation. Our data remains completely safe and secure,” a Vodafone Idea spokesperson said. Activity area.

weak password

However, Nehra claimed the portal had been down since Sunday evening.

“To verify the account, they will have to redo the portal anyway. I guess they noticed something unusual on the portal and did it at night. My mail will clear things up,” he said.

“Vodafone Idea had assigned a very generic and weak password for the site which had critical details about its subscribers. It is very common for hackers to try this password. Although these usernames and passwords are removed from the darknet forum once sold, the threat remains that someone has access to the portal and the data of all company subscribers. I was able to find details of at least three IPS agents and two senior bureaucrats I knew who use Vi numbers,” Nehra added.

He also informed India’s Computer Emergency Response Team (CERT-In) and Mathan Babu Kasilingam, Chief Information Security Officer (CISO), Vi in separate emails.

“Vi’s CISO took note of my email. He said he was analyzing the systems first and checking what was wrong,” Nehra said.

Published on

April 04, 2022