6 ms·

It appears that private keys for generating EU Covid Certificates have leaked

123 points by camillomiller 5y ago

camillomiller 5y ago
The finding went viral in Italy first, here's a few articles for those who read Italian, or wanna autotranslate: -https://www.italian.tech/2021/10/27/news/cosa_sappiamo_dei_green_pass_validi_di_adolf_hitler-323949088/ https://www.italian.tech/2021/10/27/news/cosa_sappiamo_dei_g... - https://attivissimo.blogspot.com/2021/10/perche-questi-codici-qr-sembrano-green.html#disqus_thread https://attivissimo.blogspot.com/2021/10/perche-questi-codic... - https://www.open.online/2021/10/27/covid-19-green-pass-adolf-hitler/ https://www.open.online/2021/10/27/covid-19-green-pass-adolf...
- christophilus 5y ago
  > went viral in Italy first Kind of like COVID, amirite?
smorgusofborg 5y ago
I'm curious as to why the assumption is that the keys were compromised rather than that ability to submit false patient data to be signed in the real system? Can anyone who looked at the fake certificates comment on whether anything about format or metadata indicates they weren't from the normal system?
- NoPie 5y ago
  My understanding is that health care professionals do not directly interact with the system generating certificates. Instead, they simply enter patient vaccination records in e-health system (or whatever it is called in each country). And then the certificate systems query patient's records and if appropriate information is found, generates a certificate. Clearly, there is no patient with such a name and date of birth which means that someone has tampered with the certificate generation system directly. Even if the keys are not stolen, someone might have an unauthorized access to the system at high level.
  - markus92 5y ago
    This is really dependent on each country. For The Netherlands, I know there is a system healthcare professionals can use to manually generate DCCs: in case of problems with the link, patients not giving permission to share PHI to a central registry or in exceptional cases like (partly) vaccinated outside of the EU and such. Just the matter of entering all details and it'll spit out a valid DCC. Source: had to use this procedure myself.
  - wasmitnetzen 5y ago
    Germany, at least, doesn't have a central database on vaccinations and just relies on pharmacy staff to validate the yellow paper Vaccination Pass and government IDs.
    - NoPie 5y ago
      In such a case any pharmacist can generate a factious certificate. I don't expect them to risk their licence with false data entry but given a big country and a sufficient number of disgruntled, nearly retired professionals...
      - lnsp 5y ago
        Doesn't have to be retired professionals. There have been cases in Germany where employees of pharmacies fake these certificates [0]. The link talks about hundreds of faked certificates from a single pharmacy. [0] https://www.br.de/nachrichten/bayern/hunderte-digitale-impfpaesse-gefaelscht-festnahme-in-muenchen,SmfuqIK https://www.br.de/nachrichten/bayern/hunderte-digitale-impfp... (German)
      - kyriakos 5y ago
        You'd be surprised what people can do. Not in Germany, but in Cyprus which is issuing EU certificates with the same as well there is an active case of a doctor who allegedly was adding people to the system without actually vaccinating them because they were against vaccination but wanted to get a pass issued. He would then throw away the dose after entering the batch number in the system. The case broke out when one of the fake pass holders got sick and had to be intubated, at which point he told the doctors about the scum he was involved in. https://cyprus-mail.com/2021/08/14/coronavirus-new-remand-for-gp-linked-to-fake-vaccination-cards/ https://cyprus-mail.com/2021/08/14/coronavirus-new-remand-fo...
- camillomiller 5y ago
  To my understanding, the input of the patient data is tied to scanning a vaccine dose after use. That's a bit harder or riskier to do than randomly inputing someone's name in the system.
  - athenot 5y ago
    Manual input certainly exists. My own EU Covid pass is showing "US" as the member state, as I got my vaccines in the US and the data got transcribed by the French foreign affairs into the EU system.
cimnine 5y ago
I wonder why the private keys of these signing-certificates don't live exclusisvely in HSMs. At least if they do, then the range of suspects should be pretty narrow.
- deleted 5y ago
  [deleted]
- Denvercoder9 5y ago
  They probably do, I expect that the keys aren't leaked but that a way to convince the real system into signing fake data was found, or one of the systems feeding data was compromised.
Gigachad 5y ago
Seems to me like there is way too much effort being put in to covid related software that ends up not being useful before it’s even finished. Australia spent millions on a contract tracing app that ended up not providing any value at all. Do we really need digitally signed vaccine certificates when more than enough people have taken the vaccine for it to be widely effective.
- gtirloni 5y ago
  With all the uncertainty created by new mutations, I'd say the certificate will be important since we'll likely need to be vaccinated every year.
  - t0bia_s 5y ago
    That is agenda pushed by media. Probably payed by big pharma. They can afford it. It is btw basic pattern for accepting totalitarian system. Create enemy and then offer solution. With price.
- quicklime 5y ago
  > Australia spent millions on a contract tracing app that ended up not providing any value at all. Who cares? Australia spends more than that amount on COVID tests every few days (possibly every day, actually). It’s a drop in the ocean. It would be nice if we could ensure that by every cent was placed on a winning bet, but in the real world it’s ok to try and fail sometimes.
  - emikulic 5y ago
    I wish Australia had spent a fraction of that money building quarantine facilities instead. :)
  - t0bia_s 5y ago
    It is not drop in the ocean. It is simple business. Most of the tests are from China btw. And from plastic. When enviroalerters start to focus on this issue? There are also masks littering everywhere.
awestroke 5y ago
So, how do I generate a fake certificate? Any ready to use scripts on GH?
- malermeister 5y ago
  Just get the damn vaccine.
  - xdennis 5y ago
    Don't give people medical advice if you're not a doctor and you know their situation.
    - malermeister 5y ago
      This was not medical advice. This was just me applying social pressure.
      - xdennis 5y ago
        I'm glad you're honest.
  - awestroke 5y ago
    I got it in July, I'm not American
  - zer0rootkid 5y ago
    of wich of this i must put private key ? 1. CRED Credentials Private Key 2. EU HC1 Credentials P8 Private Key 3. BBS+ Credentials Private Key 4. EDDSA Credentials Private Key 5. DIVOC Credentials Private Key 6. Public Key
    - giogio2021 5y ago
      2
    - polladura 5y ago

123 points by camillomiller 5y ago

The finding went viral in Italy first, here's a few articles for those who read Italian, or wanna autotranslate: -https://www.italian.tech/2021/10/27/news/cosa_sappiamo_dei_green_pass_validi_di_adolf_hitler-323949088/ https://www.italian.tech/2021/10/27/news/cosa_sappiamo_dei_g... - https://attivissimo.blogspot.com/2021/10/perche-questi-codici-qr-sembrano-green.html#disqus_thread https://attivissimo.blogspot.com/2021/10/perche-questi-codic... - https://www.open.online/2021/10/27/covid-19-green-pass-adolf-hitler/ https://www.open.online/2021/10/27/covid-19-green-pass-adolf...

christophilus 5y ago
> went viral in Italy first Kind of like COVID, amirite?

smorgusofborg 5y ago

I'm curious as to why the assumption is that the keys were compromised rather than that ability to submit false patient data to be signed in the real system? Can anyone who looked at the fake certificates comment on whether anything about format or metadata indicates they weren't from the normal system?

NoPie 5y ago
My understanding is that health care professionals do not directly interact with the system generating certificates. Instead, they simply enter patient vaccination records in e-health system (or whatever it is called in each country). And then the certificate systems query patient's records and if appropriate information is found, generates a certificate. Clearly, there is no patient with such a name and date of birth which means that someone has tampered with the certificate generation system directly. Even if the keys are not stolen, someone might have an unauthorized access to the system at high level.
- markus92 5y ago
  This is really dependent on each country. For The Netherlands, I know there is a system healthcare professionals can use to manually generate DCCs: in case of problems with the link, patients not giving permission to share PHI to a central registry or in exceptional cases like (partly) vaccinated outside of the EU and such. Just the matter of entering all details and it'll spit out a valid DCC. Source: had to use this procedure myself.
- wasmitnetzen 5y ago
  Germany, at least, doesn't have a central database on vaccinations and just relies on pharmacy staff to validate the yellow paper Vaccination Pass and government IDs.
  - NoPie 5y ago
    In such a case any pharmacist can generate a factious certificate. I don't expect them to risk their licence with false data entry but given a big country and a sufficient number of disgruntled, nearly retired professionals...
    - lnsp 5y ago
      Doesn't have to be retired professionals. There have been cases in Germany where employees of pharmacies fake these certificates [0]. The link talks about hundreds of faked certificates from a single pharmacy. [0] https://www.br.de/nachrichten/bayern/hunderte-digitale-impfpaesse-gefaelscht-festnahme-in-muenchen,SmfuqIK https://www.br.de/nachrichten/bayern/hunderte-digitale-impfp... (German)
    - kyriakos 5y ago
      You'd be surprised what people can do. Not in Germany, but in Cyprus which is issuing EU certificates with the same as well there is an active case of a doctor who allegedly was adding people to the system without actually vaccinating them because they were against vaccination but wanted to get a pass issued. He would then throw away the dose after entering the batch number in the system. The case broke out when one of the fake pass holders got sick and had to be intubated, at which point he told the doctors about the scum he was involved in. https://cyprus-mail.com/2021/08/14/coronavirus-new-remand-for-gp-linked-to-fake-vaccination-cards/ https://cyprus-mail.com/2021/08/14/coronavirus-new-remand-fo...
camillomiller 5y ago
To my understanding, the input of the patient data is tied to scanning a vaccine dose after use. That's a bit harder or riskier to do than randomly inputing someone's name in the system.
- athenot 5y ago
  Manual input certainly exists. My own EU Covid pass is showing "US" as the member state, as I got my vaccines in the US and the data got transcribed by the French foreign affairs into the EU system.

cimnine 5y ago

I wonder why the private keys of these signing-certificates don't live exclusisvely in HSMs. At least if they do, then the range of suspects should be pretty narrow.

deleted 5y ago
[deleted]
Denvercoder9 5y ago
They probably do, I expect that the keys aren't leaked but that a way to convince the real system into signing fake data was found, or one of the systems feeding data was compromised.

Gigachad 5y ago

Seems to me like there is way too much effort being put in to covid related software that ends up not being useful before it’s even finished. Australia spent millions on a contract tracing app that ended up not providing any value at all. Do we really need digitally signed vaccine certificates when more than enough people have taken the vaccine for it to be widely effective.

gtirloni 5y ago
With all the uncertainty created by new mutations, I'd say the certificate will be important since we'll likely need to be vaccinated every year.
- t0bia_s 5y ago
  That is agenda pushed by media. Probably payed by big pharma. They can afford it. It is btw basic pattern for accepting totalitarian system. Create enemy and then offer solution. With price.
quicklime 5y ago
> Australia spent millions on a contract tracing app that ended up not providing any value at all. Who cares? Australia spends more than that amount on COVID tests every few days (possibly every day, actually). It’s a drop in the ocean. It would be nice if we could ensure that by every cent was placed on a winning bet, but in the real world it’s ok to try and fail sometimes.
- emikulic 5y ago
  I wish Australia had spent a fraction of that money building quarantine facilities instead. :)
- t0bia_s 5y ago
  It is not drop in the ocean. It is simple business. Most of the tests are from China btw. And from plastic. When enviroalerters start to focus on this issue? There are also masks littering everywhere.

awestroke 5y ago

So, how do I generate a fake certificate? Any ready to use scripts on GH?

malermeister 5y ago
Just get the damn vaccine.
- xdennis 5y ago
  Don't give people medical advice if you're not a doctor and you know their situation.
  - malermeister 5y ago
    This was not medical advice. This was just me applying social pressure.
    - xdennis 5y ago
      I'm glad you're honest.
- awestroke 5y ago
  I got it in July, I'm not American
- zer0rootkid 5y ago
  of wich of this i must put private key ? 1. CRED Credentials Private Key 2. EU HC1 Credentials P8 Private Key 3. BBS+ Credentials Private Key 4. EDDSA Credentials Private Key 5. DIVOC Credentials Private Key 6. Public Key
  - giogio2021 5y ago
    2
  - polladura 5y ago