On 20th October 2021, MySejahtera team revealed that its check-in QR code registration has been misused by “malicious scripts”. Its users have received unsolicited one-time-password (OTP) Short Message Service (SMS) at odd hours; some even received them in the early hours of the morning. Complaints were made by MySejahtera users through the “help-desk” feature on the application and social platforms.
OTP Messages and Troll E-mails
MySejahtera users received OTP SMSs from the mobile phone number 68088; the text message read: “RM0 MySejahtera: Your OTP No. is [redacted] for MySejahtera check-in registration and will expire in five minutes.” Its users have shared screenshots of OTP SMSs through social media platforms, however, there were no requests for the OTP, or to login or register with MySejahtera when the SMSs were received.
Subsequently, MySejahtera users reported receiving spam e-mails; there were reports of e-mails with images of singer Rick Astley from his music video “Never Gonna Give You Up” attached to it. Other users have reported receiving e-mails from “donotreply@mysejahtera.org” titled “MySejahtera Check-in Support-Health Assessment” which included the message: “You’ve tested positive for covid nahh, joking. plenty of exploits to show”.
Cause for Concern?
The MySejahtera application has become a must-have for all Malaysians. It is also a crucial part of the Government’s effort to detect and report new COVID-19 infection cases in the country. As such, many rightly worry that their personal data may have been compromised by said “malicious scripts.” However, the MySejahtera team has assured users that their data was not accessed by the scripts – the team further elaborated in a statement that, “Since then, these API [Application Programming Interface] endpoints are blocked and a fix to enhance security will be moved tonight. We want to reassure all our users that no user data was accessed by these scripts, but random phone numbers were spammed to verify their phone number. We apologise for this inconvenience.”
An API refers to a set of programming code that queries data, parses responses, and sends instructions between one software platform and another.
In a statement, the Ministry of Health (MOH) stated that, “Based on the initial investigation and actions taken by the National Cyber Security Agency (NACSA), the sending of the fake emails and SMSs is due to misuse of the API and not a leak in the MySejahtera database.”
The Check-In Registration feature on MySejahtera Application allows businesses, establishments, public transportation, and others to obtain and display the MySejahtera QR code. The registration process requires an applicant to enter information such as their email address or mobile number, inter alia, to receive OTP. It was further confirmed that the Registration Check-In QR code feature was misused by irresponsible parties. These parties used a random email address or phone number to complete the registration process. In addition, the ministry noted that the Need Help feature on MySejahtera’s website was also misused to send random spam emails.
“Following this irresponsible action, the MySejahtera team has further increased the security level of MySejahtera’s applications and websites to prevent such an incident from happening again,” the ministry added.
MySejahtera application and website are currently jointly managed by the MoH and the National Security Council (MKN).