Security firm finds flaws in Indian online insurance broker

NEW DELHI (AP) — Last month, a small cybersecurity firm told a major Indian online insurance brokerage it had found critical vulnerabilities in the company’s internet-facing network that could expose sensitive personal and financial data from at least 11 million customers to malicious hackers.

The little-known firm followed the standard ethical-hacker playbook, giving Policybazaar, the insurance aggregator, time to patch the flaws and inform authorities. It did not seek authorization in advance to test Policybazaar's system but said it considered itself justified, in part because it had employees who were customers.

A week later, on July 24, Policybazaar, which is publicly traded and counts the Chinese conglomerate Tencent among its investors, notified India's stock exchanges it had been illegally breached but “no significant customer data was exposed.”

It said little more.

The startup, CyberX9, is not keeping quiet. Its managing director wants Indians to know that the “multiple extremely critical” vulnerabilities were so easy to find it was almost as if Policybazaar intentionally left itself open to criminal or nation-state intrusion.

“It would’ve been extremely easy for anyone with good computer/IT knowledge to discover, exploit, and leak all of this data,” CyberX9 director Himanshu Pathak said.

The data include not just names, home and email addresses, dates of birth and phone numbers but what people must show to get insurance: digital copies of identification, health and financial documents including tax returns, pay slips, bank statements, driver licenses and birth certificates.

A broker for multiple carriers and types of policies that claims 90% of India’s online insurance aggregator market, Policybazaar amassed the data through user uploads and self-generated records. It included questionnaires that Indian armed forces members filled out -– the company offers various insurance policies tailored to them -- listing their ranks, branch of service, and whether they work in danger zones and handle weapons and explosives.

The Associated Press reached three people listed in sample data including copies of sensitive personal documents provided by CyberX9, one a soldier stationed in Ladakh, a region in dispute with Pakistan and China. All three confirmed they were Policybazaar customers. All said they had not been made aware of any security incident.

According to documents on the website of Policybazaar’s parent company, PB Fintech Ltd., 56 million people were registered on the site at the end of December, including 11 million “transacting customers” who purchased 25 million insurance policies.

Policybazaar would not respond to questions from the AP, other than to say it had fixed the identified vulnerabilities and referred the incident to external advisers for a forensic audit.

It did not confirm that CyberX9 had alerted it to the vulnerabilities, describe how its IT system was “subject to illegal and authorized access” or explain what customer data was exposed. Policybazaar said the flaws were identified on July 19, the day after CyberX9 says it first alerted the brokerage.

Pathak provided the AP with copies of his email exchanges with India’s Computer Emergency Response Team (CERT-IN), which said on July 25 that Policybazaar reported the vulnerabilities had been fixed, and with a national cyber security official, Lt. Gen. Rajesh Pant, who told Pathak in a July 26 email: “Thanks for informing. Shall initiate action against Policy Bazaar.”

Neither CERT-IN nor Pant responded to AP emails seeking comment.

CyberX9 said it decided to probe Policybazaar’s network for flaws after learning during its November IPO how much sensitive and confidential data the company was managing.

It said it found five vulnerabilities and was able to retrieve user data with no authorization check -— and there were no restrictions on how many times an unauthorized user could make such a retrieval.

The researchers tested the vulnerabilities “by fully automating them using very simple scripts, all of this without facing any viable restrictions by your systems,” CyberX9 told Policybazaar in the technical report it sent the company last month.

“Considering the simplicity and ease of discovery and exploitation of these vulnerabilities, Policybazaar have clearly left the doors open to threat actors to invade the lives of its users.”

It was unclear whether CyberX9 will face any legal repercussions for probing Policybazaar's system.

The incident highlights the gray area in which many security researchers operate globally, including in India. Good-faith security researchers intent on preventing malicious hacks and ransomware attacks must tread carefully in India as its computer crime law draws no distinctions in malice and ethics when it comes to identifying and exploiting weaknesses in software code.

“There is ambiguity in the law -– it says you can’t test without permission and only after that can you probe,” said Apar Gupta, executive director of the nonprofit Internet Freedom Foundation.

CERT-IN issued a responsible disclosure policy in September offering good-faith hackers guidelines, he said, but it includes a disclaimer that nods to the ambiguity. U.S. law is also ambiguous, though the U.S. Justice Department announced a new policy in May directing that “good-faith security research should not be charged.”

Sandeep Kamble, founder of the Indian firm SecureLayer7, said the judicial system is “completely immature” in its handling of such cases as judges generally lack the technical acumen. That means the system favors the brash and the bold, who better also have good lawyers.

Kamble and Gupta said it seems the CyberX9 researchers, as Policybazaar customers, had good cause to probe the company’s digital edifice for easily exploited flaws as long as they did it responsibly.

In its report to Policybazaar, CyberX9 said it would be pleased to receive a so-called “bug bounty” reward -– which some companies customarily pay researchers for good-faith flaw identification -- “though it is not necessary.”

Pathak said no such reward was paid.

India, with 800 million internet users, also does not have a data protection law even though the country’s top court in 2017 held privacy as a fundamental right and directed the government to draw up legislation. In Parliament, the bill was delayed by criticism over some provisions, including one that gave the government access to personal data in the name of “sovereignty."

Last week, Parliament withdrew the legislation, saying it would start the process anew.

Digital experts say a data protection law is necessary in India where financial fraud and data leaks are rampant. Its absence has exacerbated privacy concerns in the country, where past incidents have seen both private companies and the government leak people's data.

Bajak reported from Boston.