Security firm finds flaws in Indian online insurance broker

Aug 9, 2022, 3:37 PM | Updated: Aug 10, 2022, 2:12 pm
A man looks at the website of policybazaar website at a local insurance company office in Mumbai, I...

A man looks at the website of policybazaar website at a local insurance company office in Mumbai, India, Wednesday, Aug. 10, 2022. A cybersecurity firm told the major Indian online insurance brokerage last month that critical vulnerabilities in the company’s internet-facing network could expose sensitive personal and financial data from its 11 million customers. CyberX9 followed the standard ethical-hacker playbook, giving the brokerage time to patch the flaws and inform authorities. A week later, publicly traded Policybazaar said it had been illegally breached but “no significant customer data was exposed.” (AP Photo/Rafiq Maqbool)

(AP Photo/Rafiq Maqbool)

NEW DELHI (AP) — Last month, a cybersecurity startup told a major Indian online insurance brokerage it had found critical vulnerabilities in the company’s internet-facing network that could expose sensitive personal and financial data from at least 11 million customers to malicious hackers.

The startup followed the standard ethical-hacker playbook, giving Policybazaar, the insurance aggregator, time to patch the flaws and inform authorities. It did not seek authorization in advance to test Policybazaar’s system but said it considered itself justified, in part because it had employees who were customers.

A week later, on July 24, Policybazaar, which is publicly traded and counts the Chinese conglomerate Tencent among its investors, notified India’s stock exchanges it had been illegally breached but “no significant customer data was exposed.”

It said little more.

The startup, CyberX9, is not keeping quiet. Its managing director wants Indians to know that the “multiple extremely critical” vulnerabilities were so easy to find it was almost as if Policybazaar intentionally left itself open to criminal or nation-state intrusion .

“It would’ve been extremely easy for anyone with good computer/IT knowledge to discover, exploit, and leak all of this data,” CyberX9 director Himanshu Pathak said.

The data include not just names, home and email addresses, dates of birth and phone numbers but what people must show to get insurance: digital copies of identification, health and financial documents including tax returns, pay slips, bank statements, driver licenses and birth certificates, CyberX9 said.

A broker for multiple carriers and types of policies that claims 90% of India’s online insurance aggregator market, Policybazaar amasses data through user uploads and self-generated records. It included questionnaires that Indian armed forces members filled out — the company offers various insurance policies tailored to them — listing their ranks, branch of service, and whether they work in danger zones and handle weapons and explosives.

The Associated Press reached three people listed in sample data including copies of sensitive personal documents provided by CyberX9, one a soldier stationed in Ladakh, a region in dispute with Pakistan and China. All three confirmed they were Policybazaar customers. All said they had not been made aware of any security incident.

According to documents on the website of Policybazaar’s parent company, PB Fintech Ltd., 56 million people were registered on the site at the end of December, including 11 million “transacting customers” who purchased 25 million insurance policies.

Policybazaar would not respond to questions from the AP, other than to say it had fixed the identified vulnerabilities and referred the incident to external advisers for a forensic audit.

It did not confirm that CyberX9 had alerted it to the vulnerabilities, describe how its IT system was “subject to illegal and authorized access” or explain what customer data was exposed. Policybazaar said the flaws were identified on July 19, the day after CyberX9 says it first alerted the brokerage.

Pathak provided the AP with copies of his email exchanges with India’s Computer Emergency Response Team (CERT-IN), which said on July 25 that Policybazaar reported the vulnerabilities had been fixed, and with a national cyber security official, Lt. Gen. Rajesh Pant, who told Pathak in a July 26 email: “Thanks for informing. Shall initiate action against Policy Bazaar.”

Neither CERT-IN nor Pant responded to AP emails seeking comment.

CyberX9 said it decided to probe Policybazaar’s network for flaws after learning during its November IPO how much sensitive and confidential data the company was managing.

It said it found five vulnerabilities and was able to retrieve user data with no authorization check — and there were no restrictions on how many times an unauthorized user could make such a retrieval.

The researchers tested the vulnerabilities “by fully automating them using very simple scripts, all of this without facing any viable restrictions by your systems,” CyberX9 told Policybazaar in the technical report it sent the company last month.

“Considering the simplicity and ease of discovery and exploitation of these vulnerabilities, Policybazaar have clearly left the doors open to threat actors to invade the lives of its users.”

It was unclear whether CyberX9 will face any legal repercussions for probing Policybazaar’s system.

The incident highlights India’s “complicated, messed-up” cybersecurity environment, where government officials often do not follow up to ensure better-protected networks, said Raman Jit Singh Chima, Asia policy director for the online rights nonprofit group AccessNow.

He said he believed Policybazaar made the vulnerability disclosure because insurance and securities regulators require it.

In India, as elsewhere, good-faith security researchers intent on preventing malicious hacks and ransomware attacks must tread carefully as they are constrained by vague computer crime laws. India’s laws draw no distinctions in malice and ethics when it comes to identifying and exploiting weaknesses in software code.

“There is ambiguity in the law — it says you can’t test without permission and only after that can you probe,” said Apar Gupta, executive director of the nonprofit Internet Freedom Foundation.

CERT-IN issued a responsible disclosure policy in September offering good-faith hackers guidelines, he said, but it includes a disclaimer that nods to the ambiguity. U.S. law is also ambiguous, though the U.S. Justice Department announced a new policy in May directing that “good-faith security research should not be charged.”

That means the system favors the brash and the bold, who better also have good lawyers.

Security experts said it seems the CyberX9 researchers, as Policybazaar customers, had good cause to probe the company’s digital edifice for easily exploited flaws as long as they did it responsibly.

In its report to Policybazaar, CyberX9 said it would be pleased to receive a so-called “bug bounty” reward — which some companies customarily pay researchers for good-faith flaw identification — “though it is not necessary.”

Pathak said no such reward was paid.

India, with 800 million internet users, also does not have a data protection law even though the country’s top court in 2017 held privacy as a fundamental right and directed the government to draw up legislation. In Parliament, the bill was delayed by criticism over some provisions, including one that gave the government access to personal data in the name of “sovereignty.”

Last week, Parliament withdrew the legislation, saying it would start the process anew.

Digital experts say a data protection law is necessary in India where financial fraud and data leaks are rampant. Its absence has exacerbated privacy concerns in the country, where past incidents have seen both private companies and the government leak people’s data.

___

Bajak reported from Boston.

Copyright © The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

AP

The Amazon logo is pictured on Sept. 6, 2012, in Santa Monica, Calif. Amazon filed a lawsuit on Mon...
Haleluya Hadero, Associated Press

Amazon sues Washington’s labor agency over alleged hazards

Amazon has sued Washington state’s labor agency following disputes with regulators over citations and fines imposed on the company for worker safety issues.
14 hours ago
Associated Press

Germany repatriates more nationals from camp in Syria

BERLIN (AP) — Germany brought home four women and seven children Wednesday from a camp in northeastern Syria where suspected members of the Islamic State group have been held, along with a young man who was taken to Syria as an 11-year-old, officials said. Foreign Minister Annalena Baerbock said in a statement she was relieved […]
14 hours ago
FILE - Sen. Tammy Duckworth, D-Ill., speaks during a Senate Judiciary Committee hearing on Capitol ...
Associated Press

Senators call for stronger rules on off-the-books suspension

WASHINGTON (AP) — Two Democratic senators urged the Education Department to strengthen regulations against excluding kids from class because of behaviors related to a disability — a practice known as informal removal. Since the pandemic began, parents of kids with disabilities say the practice is on the rise, denying their kids the legal right to […]
14 hours ago
Brazil's President Jair Bolsonaro, who is running for reelection, speaks in front of one of the lea...
Associated Press

Lula receives fresh endorsements ahead of Brazil election

RIO DE JANEIRO (AP) — Former Brazilian President Luiz Inácio Lula da Silva received two symbolic endorsements Wednesday as he seeks new allies ahead of an Oct. 30 runoff against incumbent Jair Bolsonaro to return to the country’s highest office. Simone Tebet, a center-right candidate who came third in Sunday’s election with 4% of the […]
14 hours ago
Associated Press

California water agencies offer Colorado River savings

SACRAMENTO, Calif. (AP) — California water agencies that rely on the parched Colorado River said Wednesday they can reduce their use by one-tenth starting in 2023 in response to calls for cuts from the federal government. The agencies, which supply water to farmers and millions of people in Southern California, laid out their proposal in […]
14 hours ago
Associated Press

How major US stock indexes fared Wednesday 10/5/2022

Stocks ended slightly lower on Wall Street as a gangbuster two-day rally ran out of gas. The S&P 500 ended 0.2% lower Wednesday after briefly heading into the green late in the day. Its early rally this week was the biggest since the spring of 2020, spurred in part by hopes a softening economy may […]
14 hours ago

Sponsored Articles

Anacortes Christmas Tree...

Come one, come all! Food, Drink, and Coastal Christmas – Anacortes has it all!

Come celebrate Anacortes’ 11th annual Bier on the Pier! Bier on the Pier takes place on October 7th and 8th and features local ciders, food trucks and live music - not to mention the beautiful views of the Guemes Channel and backdrop of downtown Anacortes.
Swedish Cyberknife Treatment...

The revolutionary treatment of Swedish CyberKnife provides better quality of life for majority of patients

There are a wide variety of treatments options available for men with prostate cancer. One of the most technologically advanced treatment options in the Pacific Northwest is Stereotactic Body Radiation Therapy using the CyberKnife platform at Swedish Medical Center.
Work at Zum Services...

Seattle Public Schools announces three-year contract with Zum

Seattle Public Schools just announced a three-year contract with a brand-new company to the Pacific Northwest to assist with their student transportation: Zum.
Swedish Cyberknife 900x506...

June is Men’s Health Month: Here’s Why It’s Important To Speak About Your Health

According to the Centers for Disease Control and Prevention, men in the United States, on average, die five years earlier than women.
...

Anacortes – A Must Visit Summertime Destination

While Anacortes is certainly on the way to the San Juan Islands (SJI), it is not just a destination to get to the ferry… Anacortes is a destination in and of itself!
...

Ready for your 2022 Alaskan Adventure with Celebrity Cruises?

Celebrity Cruises SPONSORED — A round-trip Alaska cruise from Seattle is an amazing treat for you and a loved one. Not only are you able to see and explore some of the most incredible and visually appealing natural sights on the planet, but you’re also able to relax and re-energize while aboard a luxury cruise […]
Security firm finds flaws in Indian online insurance broker