4 ms·

I'm curious as to why the assumption is that the keys were compromised rather than that ability to submit false patient data to be signed in the real system? Ca

I'm curious as to why the assumption is that the keys were compromised rather than that ability to submit false patient data to be signed in the real system? Can anyone who looked at the fake certificates comment on whether anything about format or metadata indicates they weren't from the normal system?

NoPie 5y ago
My understanding is that health care professionals do not directly interact with the system generating certificates. Instead, they simply enter patient vaccination records in e-health system (or whatever it is called in each country). And then the certificate systems query patient's records and if appropriate information is found, generates a certificate. Clearly, there is no patient with such a name and date of birth which means that someone has tampered with the certificate generation system directly. Even if the keys are not stolen, someone might have an unauthorized access to the system at high level.
- markus92 5y ago
  This is really dependent on each country. For The Netherlands, I know there is a system healthcare professionals can use to manually generate DCCs: in case of problems with the link, patients not giving permission to share PHI to a central registry or in exceptional cases like (partly) vaccinated outside of the EU and such. Just the matter of entering all details and it'll spit out a valid DCC. Source: had to use this procedure myself.
- wasmitnetzen 5y ago
  Germany, at least, doesn't have a central database on vaccinations and just relies on pharmacy staff to validate the yellow paper Vaccination Pass and government IDs.
  - NoPie 5y ago
    In such a case any pharmacist can generate a factious certificate. I don't expect them to risk their licence with false data entry but given a big country and a sufficient number of disgruntled, nearly retired professionals...
    - lnsp 5y ago
      Doesn't have to be retired professionals. There have been cases in Germany where employees of pharmacies fake these certificates [0]. The link talks about hundreds of faked certificates from a single pharmacy. [0] https://www.br.de/nachrichten/bayern/hunderte-digitale-impfpaesse-gefaelscht-festnahme-in-muenchen,SmfuqIK https://www.br.de/nachrichten/bayern/hunderte-digitale-impfp... (German)
    - kyriakos 5y ago
      You'd be surprised what people can do. Not in Germany, but in Cyprus which is issuing EU certificates with the same as well there is an active case of a doctor who allegedly was adding people to the system without actually vaccinating them because they were against vaccination but wanted to get a pass issued. He would then throw away the dose after entering the batch number in the system. The case broke out when one of the fake pass holders got sick and had to be intubated, at which point he told the doctors about the scum he was involved in. https://cyprus-mail.com/2021/08/14/coronavirus-new-remand-for-gp-linked-to-fake-vaccination-cards/ https://cyprus-mail.com/2021/08/14/coronavirus-new-remand-fo...
- ASalazarMX 5y ago
  And what enables this is that there are people who will pay for the certificate instead of taking a free vaccine. Dumbest black market I've seen.
  - brianwawok 5y ago
    It's right up there with auto seatbeat alarm stoppers?
    - ASalazarMX 5y ago
      Forgot those were a thing. Can't agree more, since the real seat belt is free too.
camillomiller 5y ago
To my understanding, the input of the patient data is tied to scanning a vaccine dose after use. That's a bit harder or riskier to do than randomly inputing someone's name in the system.
- athenot 5y ago
  Manual input certainly exists. My own EU Covid pass is showing "US" as the member state, as I got my vaccines in the US and the data got transcribed by the French foreign affairs into the EU system.

NoPie 5y ago

My understanding is that health care professionals do not directly interact with the system generating certificates. Instead, they simply enter patient vaccination records in e-health system (or whatever it is called in each country). And then the certificate systems query patient's records and if appropriate information is found, generates a certificate. Clearly, there is no patient with such a name and date of birth which means that someone has tampered with the certificate generation system directly. Even if the keys are not stolen, someone might have an unauthorized access to the system at high level.

markus92 5y ago
This is really dependent on each country. For The Netherlands, I know there is a system healthcare professionals can use to manually generate DCCs: in case of problems with the link, patients not giving permission to share PHI to a central registry or in exceptional cases like (partly) vaccinated outside of the EU and such. Just the matter of entering all details and it'll spit out a valid DCC. Source: had to use this procedure myself.
wasmitnetzen 5y ago
Germany, at least, doesn't have a central database on vaccinations and just relies on pharmacy staff to validate the yellow paper Vaccination Pass and government IDs.
- NoPie 5y ago
  In such a case any pharmacist can generate a factious certificate. I don't expect them to risk their licence with false data entry but given a big country and a sufficient number of disgruntled, nearly retired professionals...
  - lnsp 5y ago
    Doesn't have to be retired professionals. There have been cases in Germany where employees of pharmacies fake these certificates [0]. The link talks about hundreds of faked certificates from a single pharmacy. [0] https://www.br.de/nachrichten/bayern/hunderte-digitale-impfpaesse-gefaelscht-festnahme-in-muenchen,SmfuqIK https://www.br.de/nachrichten/bayern/hunderte-digitale-impfp... (German)
  - kyriakos 5y ago
    You'd be surprised what people can do. Not in Germany, but in Cyprus which is issuing EU certificates with the same as well there is an active case of a doctor who allegedly was adding people to the system without actually vaccinating them because they were against vaccination but wanted to get a pass issued. He would then throw away the dose after entering the batch number in the system. The case broke out when one of the fake pass holders got sick and had to be intubated, at which point he told the doctors about the scum he was involved in. https://cyprus-mail.com/2021/08/14/coronavirus-new-remand-for-gp-linked-to-fake-vaccination-cards/ https://cyprus-mail.com/2021/08/14/coronavirus-new-remand-fo...
ASalazarMX 5y ago
And what enables this is that there are people who will pay for the certificate instead of taking a free vaccine. Dumbest black market I've seen.
- brianwawok 5y ago
  It's right up there with auto seatbeat alarm stoppers?
  - ASalazarMX 5y ago
    Forgot those were a thing. Can't agree more, since the real seat belt is free too.

camillomiller 5y ago

To my understanding, the input of the patient data is tied to scanning a vaccine dose after use. That's a bit harder or riskier to do than randomly inputing someone's name in the system.

athenot 5y ago
Manual input certainly exists. My own EU Covid pass is showing "US" as the member state, as I got my vaccines in the US and the data got transcribed by the French foreign affairs into the EU system.