In a very shocking incident an ethical hacker, Sunny Nehra found not one but multiple critical vulnerabilities or security loopholes in the official Indian Army websites indianarmy.nic.in and joinindianarmy.nic.in which were reported to Cert-in and the authorities concerned. Apart from this, serious vulnerabilities were also found in many other govt websites including UHBVH (Uttar Haryana Bijli Vitran Nigam) and DHBVN (Dakshin Haryana Bijli Vitran Nigam) websites having data of so many users of Haryana state. Not only this vulnerabilities were also found in personal website of Haryana CM Manohar Lal Khattar which were reported to Hartron team.
The worst part is that there are official social media accounts connected to (and created by mails there were set up on) these websites which also could be compromised by hackers because of these flaws.
One of the primary reasons behind the security issues was the lack of updation of several important aspects of the websites. Like in Indian Army websites the Lodash (a JavaScript Library) was highly outdated and hence was vulnerable to Prototype Pollution, a severe critical security issue which if exploited could lead to very serious threats including complete takeover of the web server.
Not only this the jQuery, Bootstrap and several other aspects were also very outdated and thus suffering from several different types of attacks. Same was for UHBVN and DHBVN websites which had several outdated aspects including an outdated Liferay portal which allowed the attackers arbitrary file upload that is they could upload and execute any file they wanted and could takeover the web server completely. CM Manohar Lal’s website was using highly outdated drupal CMS and could be completely overtaken by hackers.
This is not the first time Sunny Nehra has found critical vulnerabilities in govt websites. Earlier in Aug 2021, Sanjeev Gupta (former Digital India CEO) had publicly announced about Nehra’s findings about a web server of UP Vidhan Sabha that had been breached by malicious Vietnamese hackers to create a hidden drugs forum.
In that same month Nehra had also found how some Pak hackers had hacked into some Indian news channels and also helped them fix their security issues. Apart from his professional bug hunting for giant companies Nehra is always dedicated to securing the national level cyber infrastructure and so he keeps reporting some or other issues related to it as soon as he finds. This is one of the reasons that Sunny Nehra is considered as the top ethical hacker of India.
Nehra also made a twitter thread explaining what exactly is the root cause behind govt websites being so insecure. Most of govt websites including Indian army websites are hosted on NICNET (National Informatics Center Network) though regarding their development they are mostly outsourced by their respective departments to some private firms following some requirements, guidelines and procedures which can vary from department to department. Now if you see the reality of how these projects have been outsourced that’s quite messed up.
Same like happens in other tenders of government here also there is bidding based outsourcing, the officials preferring their knowns and other political matters leading to this mess up. Some private firms get the tenders and they further outsource those to other smaller firms and just save some funds as margin. Now to maximize the margins some of them outsource to even the cheapest possible developers who have no idea about cyber security and don’t even bother to check critical updates. The security audits are not for all the projects and where they are they also generally are rigged the same way.
Nehra further explains that although some cyber security researchers like him who want to secure our infrastructure keep finding such flaws and keep getting them fixed for a bigger impact the governments needs to improve their policies and regulations for development as well as audits of these tech projects. Because at end if the developing team is not aware and dedicated you can get their aspects updated today but again after sometime they would be outdated. And apart from updation other aspects like implementation, logging, auditing etc also have to be taken seriously and without governments being strict with all that it’s not going to solve it much just from security researcher’s end.
Read Full Article
';
$('div.listing').append(string);
}
});
},
error:function(xhr){
//console.log("Error");
//console.log("An error occured: " + xhr.status + " " + xhr.statusText);
nextload=false;
},
complete: function(){
$('div.listing').find(".loading-block").remove();;
pg +=1;
//console.log("mod" + ice%2);
nextpath="&page=" + pg;
//console.log("request complete" + nextpath);
cat = "?cat=657583";
//console.log(nextpath);
nextload=(ice%2==0)?true:false;
}
});
}
//lastoff = last.offset();
//console.log("**" + lastoff + "**");
});*/
var maindiv = false;
var dis = 0;
var fbcontainer="";
var fbid = '';
var fb_script=document.createElement('script');
fb_script.text= "(function(d, s, id) {var js, fjs = d.getElementsByTagName(s)[0];if (d.getElementById(id)) return;js = d.createElement(s); js.id = id;js.src="https://connect.facebook.net/en_GB/sdk.js#xfbml=1&version=v2.9";fjs.parentNode.insertBefore(js, fjs);}(document, 'script', 'facebook-jssdk'));";
var fmain = $(".sr2437907");
//alert(x+ "-" + url);
var fdiv = '
';
//console.log(fdiv);
//$(fb_script).appendTo(fmain);
$(fdiv).appendTo(fmain);
function fillElementWithAd($el, slotCode, size, targeting){
if (typeof targeting === 'undefined') {
targeting = {};
} else if ( Object.prototype.toString.call( targeting ) !== '[object Object]' ) {
targeting = {};
}
var elId = $el.attr('id');
//console.log("elId:" + elId);
googletag.cmd.push(function(){
var slot = googletag.defineSlot(slotCode, size, elId);
for (var t in targeting){
slot.setTargeting(t, targeting
}
slot.addService(googletag.pubads());
googletag.display(elId);
//googletag.pubads().refresh([slot]);
});
}
$(document).delegate("button[id^='mf']", "click", function(){
fbcontainer="";
fbid = '#' + $(this).attr('id');
var sr = fbid.replace("#mf", ".sr");
$(fbid).parent().children(sr).toggle();
fbcontainer = $(fbid).parent().children(sr).children(".fb-comments").attr("id");
});
function onPlayerStateChange(event){
var ing, fid;
//console.log(event + "---player");
$('iframe[id*="video-"]').each(function(){
_v = $(this).attr('id');
//console.log("_v: " + _v);
if(_v != event){
//console.log("condition match");
ing = new YT.get(_v);
if(ing.getPlayerState()=='1'){
ing.pauseVideo();
}
}
});
$('div[id*="video-"]').each(function(){
_v = $(this).attr('id');
//console.log("_v: " + _v + " event: " + event);
if(_v != event){
//jwplayer(_v).play(false);
}
});
}
function onYouTubePlay(vid, code, playDiv,vx, pvid){
if (typeof(YT) == 'undefined' || typeof(YT.Player) == 'undefined') {
var tag = document.createElement('script');
tag.src = "https://www.youtube.com/iframe_api";
var firstScriptTag = document.getElementsByTagName('script')[0];
firstScriptTag.parentNode.insertBefore(tag, firstScriptTag);
window.onYouTubePlayerAPIReady = function() {
onYouTubePlayer(vid, code, playDiv,vx, pvid);
};
}else{onYouTubePlayer(vid, code, playDiv,vx, pvid);}
}
function onYouTubePlayer(vid, code, playDiv,vx, pvid){
//console.log(playDiv + "Get Youtue " + vid);
//$("#"+vid).find(".playvideo-"+ vx).hide();
var player = new YT.Player(playDiv , {
height: '450',
width: '100%',
videoId:code,
playerVars: {
'autoplay': 1,
'showinfo': 1,
'controls': 1
},
events: {
'onStateChange': function(event){
onPlayerStateChange(event.target.a.id);
}
}
});
$("#video-"+vid).show();
}
function kalturaPlayerAPIReady(code, playDiv,pvid){
var dt=new Date;
var nt=dt.getTime();
var vtitle = "";
var video_id_arr = code.split("https://zeenews.india.com/");
var youbora_video_id = video_id_arr[5].split(".");
var youbora_video_id = '"' + youbora_video_id[0] + '"';
pre_roll = "https://pubads.g.doubleclick.net/gampad/ads?sz=640x480&iu=/11440465/Zeenews_English_Video/Zeenews_English_Preroll&tfcd=0&npa=0&sz=640x480&gdfp_req=1&output=vast&unviewed_position_start=1&env=vp&impl=s&description_url="+vtitle+"&correlator="+nt;
var sources ={};
var config = {
targetId: playDiv,
provider: {
partnerId: 2504201
},
playback: {
pictureInPicture : true,
autoplay: true
},
advertising: {
adBreaks: [{
position: 0,
ads: [{
url: [pre_roll]
}]
}]
},
plugins: {
youbora: {
options: {
"content.title": "Indian military and other govt websites filled with critical security loopholes, says Sunny Nehra",
"content.customDimension.1":"Zee News",
"content.customDimension.2":"https://zeenews.india.com/",
"content.customDimension.3":"2022-Feb-19 17:29:27",
"content.customDimension.4":"SHUBHAM SINGH",
"content.customDimension.5":"2437907",
"content.customDimension.6":"Companies,Hacking,Cybersecurity,Hackers,Indian Army Website",
"content.id":youbora_video_id,
"content.language":"English"
}
},
ima: {
adsResponse: ""
}
}
}
var kalturaPlayer = KalturaPlayer.setup(config);
if(kalturaPlayer){
kalturaPlayer.reset();
}
var videoUrl = code;
var mediaid = '"zn' + pvid + '"';
sources = {
hls: [{
id: mediaid,
url: videoUrl,
mimetype: "application/x-mpegURL"
}]
}
kalturaplayerSetup(kalturaPlayer, sources);
if (typeof kalturaPlayer !== 'undefined') {
doRegisterEvents(kalturaPlayer);
}
}
function kalturaplayerSetup(kalturaPlayer, playbackType){
kalturaPlayer.setMedia({
plugins: {},
sources: playbackType
});
}
function doRegisterEvents(kalturaPlayer) {
/* player event*/
kalturaPlayer.addEventListener(kalturaPlayer.Event.Core.PLAY, playEvent);
kalturaPlayer.addEventListener(kalturaPlayer.Event.Core.PAUSE, pauseEvent);
kalturaPlayer.addEventListener(kalturaPlayer.Event.Core.PLAYBACK_ENDED, playbackEndedEvent);
/* ad event */
kalturaPlayer.addEventListener(kalturaPlayer.Event.AD_STARTED, adStartedEvent);
kalturaPlayer.addEventListener(kalturaPlayer.Event.AD_COMPLETED, adCompletedEvent);
kalturaPlayer.addEventListener(kalturaPlayer.Event.AD_SKIPPED, adSkippedEvent);
kalturaPlayer.addEventListener(kalturaPlayer.Event.AD_CLICKED,adClicked);
}
var vlabel = "https://zeenews.india.com"+$(this).attr("video-path");
var isVideoPlayed = false;
var isAdSkippedCompleted = false;
function adStartedEvent(event) {
var videotype = "zee english video";
gtag('event', 'Adstarted', { 'event_category': videotype, 'event_label': vlabel});
gtag('event', 'Play', { 'event_category': videotype, 'event_label': vlabel});
isVideoPlayed = true;
isAdSkippedCompleted = true;
}
function adCompletedEvent(event) {
var videotype = "zee english video";
gtag('event', 'Adcompleted', { 'event_category': videotype, 'event_label': vlabel});
isAdSkippedCompleted = true;
}
function adSkippedEvent(event) {
var videotype = "zee english video";
gtag('event', 'Adskipped', { 'event_category': videotype, 'event_label': vlabel});
isAdSkippedCompleted = true;
}
function adClicked(event) {
var videotype = "zee english video";
gtag('event', 'Adclicked', { 'event_category': videotype, 'event_label': vlabel});
}
function playbackEndedEvent(event){
var videotype = "zee english video";
gtag('event', 'Complete', { 'event_category': videotype, 'event_label': vlabel});
}
function playEvent(event) {
var videotype = "zee english video";
if((isVideoPlayed) && (isAdSkippedCompleted)){
isAdSkippedCompleted = false;
}else if((isVideoPlayed)){
gtag('event', 'resume', { 'event_category': videotype, 'event_label': vlabel});
}else{
gtag('event', 'Play', { 'event_category': videotype, 'event_label': vlabel});
isVideoPlayed = true;
}
}
function pauseEvent(event) {
var videotype = "zee english video";
gtag('event', 'Pause', { 'event_category': videotype, 'event_label': vlabel});
}
function AdloadEvent(event) {
var videotype = "zee english video";
gtag("event", "kaltura_adloaded", { "event_category": videotype, "event_label": vlabel});
}
function AdProgressEvent(event) {
var videotype = "zee english video";
gtag("event", "kaltura_adprogress", { "event_category": videotype, "event_label": vlabel});
}
function adPausedEvent(event) {
var videotype = "zee english video";
gtag("event", "kaltura_adpaused", { "event_category": videotype, "event_label": vlabel});
}
/* End of Kaltura player function code */
$(document).delegate("div[id^='play']", "click", function(){
//console.log($(this).attr("id"));
//console.log($(this).attr("video-source"));
//console.log($(this).attr("video-code"));
var isyoutube = $(this).attr("video-source");
var vurl = $(this).attr("video-path");
var vid = $(this).attr("id");
$(this).hide();
var pvid = $(this).attr("newsid");
var vx = $(this).attr("id").replace('play-','');
var vC = $(this).attr("video-code");
var playDiv = "video-" + vid + "-" + pvid;
if(isyoutube =='No'){
kalturaPlayerAPIReady(vC, playDiv,pvid);
}else{
onYouTubePlay(vid, vC, playDiv,vx, pvid);
}
});
$(document).delegate("div[id^='ptop']", "click", function(){
var vid = $(this).attr("id").replace('ptop','');
$(this).hide();
var pvid = $(this).attr("newsid");
var vurl = $(this).attr("video-path");
//console.log($(this).attr("id") + "--" + vid);
//console.log($(this).parent().children().find('#play-'+vid).attr("video-source"));
//console.log($(this).parent().children().find('#play-'+vid).attr("video-code"));
var isyoutube = $(this).parent().children().find('#play-'+vid).attr("video-source");
var vC = $(this).parent().children().find('#play-'+vid).attr("video-code");
var playDiv = "mvideo-play-" + vid + "-" + pvid;
if(isyoutube =='No'){
//console.log(jwplayer($(this).attr("id")).getState());
kalturaPlayerAPIReady(vC, playDiv,pvid);
}else{
onYouTubePlay($(this).attr("id"), vC, playDiv, vid, pvid);
}
});
var nxti = 3;
var ci = 1;
var nxti_1 = 6;
var nxti_2 = 9;
var nxti_3 = 12;
if($.autopager==false){
var use_ajax = false;
/*var disqus_shortname="zeehindi";
var disqus_identifier; //made of post id and guid
var disqus_url; //post permalink
function loadDisqus(source, identifier, url, nid) {
if (window.DISQUS) {
//alert("if");
jQuery('
').insertAfter(source);
jQuery('#disqus_thread').insertAfter(source); //append the HTML after the link
//if Disqus exists, call it's reset method with new parameters
DISQUS.reset({
reload: true,
config: function () {
this.page.identifier = identifier;
this.page.url = url;
}
});
}else{
jQuery('
').insertAfter(source);
disqus_identifier = identifier; //set the identifier argument
disqus_url = url; //set the permalink argument
//append the Disqus embed script to HTML
var dsq = document.createElement('script'); dsq.type="text/javascript"; dsq.async = true;
dsq.src="http://" + disqus_shortname + '.disqus.com/embed.js';
jQuery('head').append(dsq);
}
};*/
/*$('.disqusOn').live( "click", notify );
function notify() {
identifier = $(this).attr('id');
dUrl = $(this).attr('disqus-url');
source = $(this).parent();
loadDisqus(jQuery(this), identifier, dUrl);
}*/
function loadshare(curl){
history.replaceState('' ,'', curl);
if(window.OBR){
window.OBR.extern.researchWidget();
}
//console.log("loadshare Call->" + curl);
//$('html head').find('title').text("main" + nxtTitle);
if(_up == false){
var cu_url = curl;
gtag('config', 'UA-2069755-1', {'page_path': cu_url });
if(window.COMSCORE){
window.COMSCORE.beacon({c1: "2", c2: "9254297"});
var e = Date.now();
$.ajax({
url: "/marathi/news/zscorecard.json?" + e,
success: function(e) {}
})
}
//console.log('ga:'+r);
/*(function () {
var ga = document.createElement('script'); ga.type="text/javascript"; ga.async = true;
ga.src = ('https:' == document.location.protocol ? 'https://' : 'http://') + 'stats.g.doubleclick.net/dc.js';
var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
})();*/
//console.log("loadshare Call");
}
}
if(use_ajax==false) {
//console.log('getting');
var view_selector="div.center-section"; // + settings.view_name; + '.view-display-id-' + settings.display;
var content_selector = view_selector; // + settings.content_selector;
var items_selector = content_selector + ' > div.rep-block'; // + settings.items_selector;
var pager_selector="div.next-story-block > div.view-zn-article-mc-all-2017 > div.view-content > div.clearfix"; // + settings.pager_selector;
var next_selector="div.next-story-block > div.view-zn-article-mc-all-2017 > div.view-content > div.clearfix > a:last"; // + settings.next_selector;
var auto_selector="div.tag-block";
var img_location = view_selector + ' > div.rep-block:last';
var img_path="
Loading
"; //settings.img_path;
//var img = '
' + img_path + '
';
var img = img_path;
//$(pager_selector).hide();
//alert($(next_selector).attr('href'));
var x = 0;
var url="";
var prevLoc = window.location.pathname;
var circle = "";
var myTimer = "";
var interval = 30;
var angle = 0;
var Inverval = "";
var angle_increment = 6;
var handle = $.autopager({
appendTo: content_selector,
content: items_selector,
runscroll: maindiv,
link: next_selector,
autoLoad: false,
page: 0,
start: function(){
$(img_location).after(img);
circle = $('.center-section').find('#green-halo');
myTimer = $('.center-section').find('#myTimer');
angle = 0;
Inverval = setInterval(function (){
$(circle).attr("stroke-dasharray", angle + ", 20000");
//myTimer.innerHTML = parseInt(angle/360*100) + '%';
if (angle >= 360) {
angle = 1;
}
angle += angle_increment;
}.bind(this),interval);
},
load: function(){
$('div.loading-block').remove();
clearInterval(Inverval);
//$('.repeat-block > .row > div.main-rhs2437907').find('div.rhs2437907:first').clone().appendTo('.repeat-block >.row > div.main-rhs' + x);
$('div.rep-block > div.main-rhs2437907 > div:first').clone().appendTo('div.rep-block > div.main-rhs' + x);
$('.center-section >.row:last').before('