Cyber-security researchers revealed that hackers had compromised the swachh. city platform could put “critical information” of nearly 1.6 crores (about 16 million) users at risk. From the sample data, researchers could get access to registered email addresses, passwords, reported phone numbers, transmitted OTP information, login IPs, individual user tokens, and browser fingerprint information of the 16 million users.
The threat intelligence team of AI-driven CloudSEK revealed that their branch of Swachh City Platform is the handiwork of threat actor LeakBase. Now, the critical sensitive information of 16 million users is on the wrong hand.
What is Swachh Bharat Mission?
Swachh Bharat Mission or Swachh Bharat Abhiyan is a campaign initiated by the Government of India on 2nd October in 2014 to eliminate open defecation and improve solid waste management in the country. The campaign’s official name is in Hindi. In English, it translates to “Clean India Mission”. It was introduced by Indian Prime Minister, Narendra Modi. The objectives of the mission is the eradication of manual scavenging, generating awareness, and bringing about a behavior change regarding sanitation practices. The mission was split into two: rural and urban. In rural areas it is named as “SBM – Gramin” and for urban side, it is known as “SBM – Urban”.
The researchers stated, “The adversary, going under the monikers of LeakBase, Chucky, Chuckies, and Sqlrip on underground forums has shared a database containing Personal Identifiable Information (PII) such as email addresses, hashed passwords, User IDs, etc, that allegedly affects 16 million users of the swachh city platform”.
LeakBase often operates for financial gain and conducts sales on its marketplace forum on the Dark Web.
“The database of size 1.25 GB has been disclosed under the post and has been hosted on a popular file-hosting platform,” informed the team.
LeakBase also offers access to admin panels and servers of most CMS (content management systems).
CloudSEKA said, “As individuals whose, personal details such as phone numbers and email addresses are advertised for sale, there is a strong possibility of it being used against them”.
This information can be harvested by threat actors to conduct phishing, in the form of fake breach notice emails from Swachh City, and social engineering to reveal more sensitive information.
It would equip malicious actors with details required to launch sophisticated ransomware attacks, exfiltrate data, and maintain persistence, warned researchers.
Generally, these information will be used against the users and people will be threaten up.
The researchers advised, “Implement a strong password policy and enable MFA (multi-factor authentication) across logins. Patch vulnerable and exploitable endpoints and monitor for anomalies in user accounts, which could indicate possible account takeovers”.
To get more such blogs, click here.
