Highlighted flaws in CBSE site to govt, got no response: Ethical hacker

New Delhi: The ethical hacker who pointed out several vulnerabilities in the website used for the On-Screen Marking (OSM) of CBSE Class 12 answer sheets has said he has received no response from the government despite highlighting the issues several times since he first discovered them in February this year.

The Central Board of Secondary Education (CBSE), in response, denied any hacking, even as IIT Madras, which has been tasked with examining flaws in the process, did not rule it out.

The 19-year-old Ethical hacker, Nisarga Adhikary, told DH that in February, he found “several critical vulnerabilities” in the OSM portal, which could lead to someone taking over the account completely, tampering with the grading process, and thereby, threatening the integrity of the exam evaluations.

“I wrote to the (education) ministry, the CBSE as well as CERT-In (Indian Computer Emergency Response Team) and followed up with them several times, but all I got was a ‘thank you’ in response,” Nisarga said.

The main flaw he found was the masterkey password vulnerability, which, in layperson terms, means that a master ID and password are written into the site's code, and anyone looking at it will be able to break into the site. "The masterkey-password is accepted into any examination account, which will generate an OTP, which can easily be bypassed. One can also click on the ‘forgot password’ option and generate new credentials,” Nisarga explained. 

“Ideally, to take accountability for their actions, the government should have responded, accepted their mistakes and rectified them as the fates of over 22 lakh students are on line, but their silence is deafening,” he added.

On Tuesday night, CBSE denied Nisarga’s allegations on X, claiming that the website he mentioned was incorrect, and that the portal has “neither been compromised nor does it have the vulnerabilities indicated”.

“There are no actual evaluation data, marks or other data held on that portal. The Board emphasises that no security breaches have come to light on the portal deployed for the actual evaluation work,” the Board said. 

In Chandigarh, speaking to reporters, CBSE Regional Head Rajesh Kumar Gupta also denied any such possibility. “Regarding questions about the website being hacked, I completely deny it. I am rejecting this allegation outright. Because exams are being conducted offline, so, there are no questions of websites being hacked,” he said.

While several students have complained of mismatched answer sheets or wrongful marking, the payment of revaluation fees has also run into trouble, with education minister Dharmendra Pradhan holding meetings with four public sector banks on Tuesday.