PETALING JAYA: Former deputy international trade and industry minister Ong Kian Ming has urged Malaysians to register their Padu account immediately due to cybersecurity concerns.

“Please register your PADU account at http://padu.gov.my immediately. If not, anyone with your IC and postcode of your IC address can register your IC on your behalf since registration is b4 the eKYC approval which takes 3 days. It will be a hassle to get back your account!”, Ong claimed in a post on X (formerly Twitter).

To register for a Padu account, members of the public need to provide their full name along with an NRIC number and matching postcode. They also need to provide a valid cellphone number to receive an OTP (one-time passcode).

The process also requires users to perform an eKYC step to verify their account. However, based on LifestyleTech’s checks, users can skip the eKYC step and the account will be created under the person's NRIC number.

LifestyleTech also found that users can receive the OTP through any phone number keyed into the form.

In a follow-up post Ong, who is also the former Bangi MP, added: “Padu sending you your OTP immediately after registration is not the problem here. Anyone with access to the electoral roll (for e.g.) or any database with names, IC Nos and Addresses, can key in any phone no for the OTP to be sent to and register a ton of PADU accounts.”

The website will subsequently prevent users from creating a new account based on their already-registered IC number.

Ong’s post has received more than 92,300 views since it was posted at 2.47pm today. Other X users have tagged Economy Minister Rafizi Ramli to look into the issue as his ministry is spearheading the initiative.

Padu was launched today for users to update their personal details and receive access to targeted government subsidies.

Malaysians have until March 31 to register.

https://www.thestar.com.my/tech/tech-news/2...-your-knowledge

Fark no

the fuck?
give your data first so that others can't give it for you?

Scam

So... Gomen didn't think of this loophole before they launch the program?

Sound bodoh

fear mongering nih..

so, ada issue la this workflow or system ... takmo aku

Instead of asking the government to look into the matter urgently you are asking the people to quickly register instead? OKM you must be out of your freaking mind.

This post has been edited by TOMEI-R: Jan 2 2024, 06:01 PM

no

just book your ic number in their system first, decide later

after you register, you do not need to key in anything yet unless you want to

macam register an account using your ic number je

no harm done

do it quickly so that some other sohai won't use your ic number to do it

Cannot register means cannot get targeted subsidy. Itu la cara scammer kerajaan.

Kejap better still, targeted subsidy will enter into an account bearing someone else's name. Mantap.

This post has been edited by Roman Catholic: Jan 2 2024, 06:07 PM

wtf is this? they should look into this loophole la. urging people to register is not the solution. bodo betui

How?? Page cannot be loaded

No subsidy for you pasal cannot load.

No need to give out your IC picture first. Just register your IC number first so you have control over your IC. It's possible for another person who knows your IC number to register an account under your IC.

No info needs to be given into the system other than your phone number and email address, since the system already knows everything else about you.

Source: I just pre-registered without uploading my IC.

So if register then can see other peoples income?

Normally when there's a breach of database, government agency should rectify it before asking user to put their data in.

Never know there is a better way to it, which if there's a breach of database, user SHOULD put in their data immediately

Such enlightenment

😆😆😆

SUS AS HECK!!!

OKM is bodo. Nuff said.

Such jarring security flaw can overlook.

Better just register so that no one else register it.

This does not make sense!!!!
I think his view is people who own cloned IC?
What makes him think that hacked that had such info would wanna register for their own benefit at all?
If you are scared of database being breached, why the fuck do you still make people register in it?

Later someone sabotage a b40, claim salary as a t20. No subsidy. Lollolololol

Fark off, TS! Kau sibuk sangat ngapa?

See ? Who wants to see other people's income, when you register others data early, you can actually get their monies !

programmer gagals

Bingo. Itu !a kerja scammer.

he's asking you people to register fast in order to prevent squatters/pranksters from making life hard for you. itu je

A sure way to confitm IC number ties to legit phone numbe. So can scam call.

Apa ke gila bagi statement macam ni.

the system has not been hacked.

OKM is just saying that, anyone can register for an account as long as the IC number is legit.

to avoid hassle, just register using your IC so that you chup your own account first.

if not some sohai use your ic to register (not impossible because so many leaks before this), then you need to go govt department to verify your account lagi hassle.

A tually PADU is for what? Since targeted subsidy, why would T20 ppl want to register?

tak PADU lorr...1st day already reveal system's weakness

This itself is a farkin' big security loophole... knowing this shieT can happen... they still wanna proceed with it.. sei soehaiz...

Kekwa
Taking the apple approach
Already knows there's a problem with the system, lagi nak salahkan user

Fear mongering

fuh.. thestar now a DDOS accomplice?

thanks to thestar..

Why would someone else register under your IC? Please explain a scenario on how he can benefit.

cant handle traffic volume

cant verify user

half baked product, baik tak payah launch

So the gomen is also telling the scammers to work faster is it lel

farkin' no 2FA
topkekk...

muh btc walllet is more secure than this piece of shieTz...

Don't register later no petrol subsidy don't cry dad cry ma

if you can register for someone... and go semakini their info.. you can get their current precise address etc...

i think somehow this system is able to link towards multiple sources to pull the latest known info about you.

What loophole u need selfie first unless twin🤭😂🤣

Later troll register random ppl and blackmail them

Kek ni bukan problem ke kalau gitu? Awal2 suda ada isu

Haha

No register Padu no entitle get subsidy... good move Madani government~

This is just bad design. Who approved this?

lam tin comes to mind

Means PADU failed if can forge/fake register.

for the lulz, my friend, for the lulz

imagine ur kolik sibeh tulan u because u steal his parking space, then he register ur ic using disposable email

then u need to take one day off just to go to UTC or some gomen department to settle this shietz

Could be inside job ? I dono, just assuming

i think better to do it this way

introduce PADU last month, register PADU then get RM100 ewallet cash....

or

introduce PADU now then last month ewallet cash should then be given after registration

his mother... not only ada problem/loophole.. some more link not https? or typo?

Edit : ok... jibbek article typo. no wonder 404.

is https://padu.gov.my/

This post has been edited by AdisonMak: Jan 2 2024, 07:18 PM

Looks like the tip of the iceberg has shown itself. I bet more is to come. Don't be the Titanic.

website kenot load total failure

RM0 PADU: Maaf, pengesahan identiti anda tidak dapat disahkan. Lakukan pengesahan identiti di kaunter atau cuba sekali lagi secara dalam talian.

Database also is centralized... not written in Open blockchain where you can validate openly without gomen or any other 3rd party intervention.

Your Identity basically is who or what the system says you are. Nothing is stopping hackers and malware in switching your identity with someone elses.

At least in Blockchain ledger... data cant be changed and at least a historical trail is there also...

This post has been edited by soul78: Jan 2 2024, 07:21 PM

Seems like something that should be mitigated by the registration process instead of getting used as a bait to ReGiStEr EaRlIeR

RM0 PADU: Maaf, pengesahan identiti anda tidak dapat disahkan. Lakukan pengesahan identiti di kaunter atau cuba sekali lagi secara dalam talian.


3rd times trying also failed. give up...

budak IT: we need more time, plenty works to do

Boss: UPPER wan to launch this date, ok je, later baru buat balik

No. They thought.. after launch, every single person in the country will register right away.

If register a month later.. the customer service probably say "itulah knp taknak buat awal awal"

So how?

What kind of shit system is this until any random person can easily register your account?

30624770 nah, new government but same stupid systems being implemented and forced down the rakyat throat.

And how much did the taxpayers pay for this shitty system?

These days I think cannot put "gomen" and "think" in the same sentence liao

who manage this padu thing? izit heitech padu?

To be fair there is not much of value inside there when you first register.

What I am concerned about is there is no 2FA to secure your account once you do key in your info.

Lapizi should have launched my digital id first before this IMHO.

Rafizi and his ministry bodo to even let this go live, and OKM turut bodo by tweeting out this critical vulnerability to the whole world.

They should deal with this internally first by immediately rejecting all new registrations and taking PADU offline. Then make it known to rakyat the flaw in the app & thus the reason why it is being suspended.

BN, PN, PH.... all also a bunch of dumb fucks who seem to have zero idea on how to manage an incident/ crisis.

"Rafizi reportedly said that Padu was fully developed by civil servants from three agencies (Ministry of Economy, Department of Statistics Malaysia — DOSM and the Malaysian Administrative Modernisation and Management Planning Unit — Mampu) in collaboration with all other agencies."

Wtf is this?

The system sooner or later will become cybersecurity itself

It is a big concern since it is going to be a huge hassle to retrieve your account once someone has registered using your details.

Now multiply that by 1000, 10000, or even 100000..... how much effort is going to be needed to reverse this mistake? From both the individual's end as well as the govt servants' end.

And people wonder why our govt agencies are so unproductive... cos of this kinda shit la.

I remember reading some where some IT expert already sounded early on how gov plan to get the initial login credentials to everyone.

Like Banks e-login. Die die u also have to go Banks once to register ur hp no or email

This message means someone hijaak your account liao?... rip

Thanks but no thanks.

I prefer "manual". 😁

CB... if anyone can register and steal my identity... Its call security flaw...

Most likely the people that dengar orang cakap would Have chup their account by now.

Left the degil one. If really bad luck kena, then bawak ic go utc or whichever gomen department reset login lor. Lulz

Machiam Gmail lupa password need to do account recovery lor.

Not the first. Different program same problem.

No lar either ic picture nor clear or your face don't look like your ic photo. Try comb your hair or put on/take off your specs.

My sikap jpj

why no asking Health data? integrate with health data lagi best la.. SG also ahead of us a lot of steps la...

Nampak tak permainan mereka?

Urging rakyat to register fast fast so can use registration numbers to wayang how suksesful this project is kek

Deswai I always been saying most of the country’s issue isn’t which political party is in power but the mindset of the nation, which nobody is interested to fix. Only fight for votes and who is in power.

Shit same smell and use, different kaler and shape only. Tahi is still tahi.

if you are able to do anything with the account without eKYC completed, then it is a problem
if anybody can just register but cannot complete eKYC and cannot do anything with the account, then not really a problem
even better if account is auto deleted and phone number used for OTP flagged if eKYC not completed within x days of being registered

Http

De fark gov?!?!?!

DLLM

Sounds like they thought of this AFTER they developed the system?

Yes but some /k tards still insisting that the current govt is doing an okay job. Die die want to call a chicken a duck. If you as a voter don't hold these monkeys accountable, then who?

Then at the same time bising about those parents who don't control their children running/shouting/being a menace in public, "anak saya orang baik"... it's the same shit kan?

Nice try bro

After register can certify as b40?
If not don't want

It's either taken offline now (good)

or crashed from everyone and their anjing kucing trying to register their accounts or impersonate others

topkek govt

Eh my one https?

Correct website?

https://www.padu.gov.my/

Ah article shared salah

OK then. At least https..

Actually which government can be held accountable? All also act like dictatorship when rakyat (legit) complain.

Feedback form box underneath is tong sampah 😆

This post has been edited by knumskul: Jan 2 2024, 08:01 PM

Tbh if act like dictatorship but can deliver results then okay la

but Malaysia macam got the first part, but the second part habuk pun tarak

I thought need to selfie with IC. Some govt online services use it now.

Ps previously was changing voter address online. And recently it was either voluntary EPF deposit and/or SSPN new savings account creation that also had it

This post has been edited by 9m2w: Jan 2 2024, 08:05 PM

So bodo juga the system can be scam...