8 ms·

Covid-19 vaccine certs on the dark web [pdf]

29 points by Yeri 5y ago

xwowsersx 5y ago
This makes it sound as if faking a certificate is some arduous task that one would need to turn to the "dark web" for. Here in the US, the CDC vaccination card can be obtained as a PDF through a quick google search. This can be printed and then filled it out by hand.
- k8sToGo 5y ago
  You don't use a certificate (QR code) in the US?
  - ocdtrekkie 5y ago
    Nope, and the way they fill out the card can vary widely from retailer to clinic. My CDC card has stickers for my doses, but handwriting that is barely legible is a very common way for providers to fill out the card.
  - alistairSH 5y ago
    Yes and no. The CDC offers a heavy paper card for recording vaccination status. This is the source of truth, as far as I can figure. Larger medical providers also offer records in digital format that can be loaded into Apple Wallet (and similar) and generate a QR code for ease of use.
  - cmurf 5y ago
    Nope. And I was instructed by the (private/for-profit) provider who administered the injection, to fill it out myself, my name and dates. They either hand wrote or stamped the brand and lot of vaccination and the initials for the provider (the business itself). Pretty weird, and certainly not certified, authenticated, verifiable. In fact the provider submitted the wrong dates for both of my vaccinations, which are the dates my state has on file, officially. Something approximating official, is my state's smartphone app, which provides an in-state legally recognized digital driver's license and a variant of the CDC vaccination card (no handwriting, not a copy of my paper one, but using an overlay of text based on the information received form the provider). But this app is recently rendered non-functional on Android (and even when the app worked, it required an internet connection to produce either record, no offline storage and no screenshot allowed when the app is in the foreground, unlike the iOS version of the app). So hilariously, the closest "certified" copy by virtue of it being generated by my state from their app which has legal sanction, has the wrong dates and I also can't access it anymore anyway. Most places in the U.S. that request it (concert venues so far the only place I've been asked to produce it) have said they will accept photos of the original in lieu of the paper copy. It is only due to the weak standards of those asking to see a copy, that this isn't a bigger problem than it sounds. Which then renders the paradigm sort of an exercise im merely following instructions more than it ensures folks aren't attending some kind of COVID party.
th3iedkid 5y ago
Is there any such security analysis of coWIN from India?
awlkjlkjlkaw 5y ago
Wahhhhh! I can't impose my fascist lockdown and enslave all of humanity with a fake virus and a fake vaccine from fake doctors and fake politicians. Fuck this shit. I say we make the vax pass printer go bRRRRRRRR!! Better than that you can buy wifi/5g/4g/lte jammers for ~$100 - turn that shit on anywhere where someone is checking digital passes. If the state is going to declare bio-warfare on the population the population has a duty to respond with electronic warfare.
- aaron695 5y ago
  > Wahhhhh! I can't impose my fascist lockdown It's strange bedfellows these days. The general population will believe China is using the pandemic to impose power, but won't look introspectively because the media won't report that. Xi's China is closing to the world. And it isn't just about borders - https://edition.cnn.com/2021/11/14/china/china-border-closure-inward-turn-dst-intl-hnk/index.html https://edition.cnn.com/2021/11/14/china/china-border-closur... > the population has a duty to respond with electronic warfare. I think power is digital and this is where it needs to be fortified. The physical world has been lost to the authorities.
arvigeus 5y ago
Just to share some news from my country: there are increasing numbers of people entering ICU, while having fake certificates. Latest death was of a 27yo "vaccinated".
- gandalfgreybeer 5y ago
  What country? Also not sure if the answer will be too technical but how do they determine if someone who has a certificate doesn’t really have the vaccine?
  - bombcar 5y ago
    The cert should have a date, location, signature, and maybe even a dose identification - all of which can be checked against the database of whomever supposedly administered it.
    - soco 5y ago
      Please see my sibling comment.
    - gandalfgreybeer 5y ago
      It seems I was overthinking how to verify things and forgot that databases exist. Although I might have assumed that the vaccine certificates are checked as they enter the hospital (at least here in my country). Also never occurred to me that someone in the ICU will show a certificate or pretend to be vaccinated (at that point what do you get?). Not sure if I’m missing standard social cues or something more obvious with my questions.
    - throwaway47292 5y ago
      in some countries actual vaccine is used, and all paperwork is in check, you pay 25 euro to the doctor, they squirt the vaccine in the sink and you get a cert
  - newsbinator 5y ago
    I guess when you end up in ICU, either you or your family members might tell the doctor, especially after getting confusing blood test results.
miohtama 5y ago
Why would you have a fake certificate as getting your first dose, and in most cases, second dose is already possible around the world?
- angulardragon03 5y ago
  Antivaxxers want to be able to enter places where a QR code is required, but don't want to get vaccinated.
  - thedrbrian 5y ago
    Or they’ve already had it and want the same freedoms as those vaccinated? ONS study on infection/reinfection during the delta period over the summer charts 5 to 8 show previous infection is as good as or in some cases better than the vaccines. https://www.ons.gov.uk/peoplepopulationandcommunity/healthandsocialcare/conditionsanddiseases/articles/coronaviruscovid19infectionsurveytechnicalarticleimpactofvaccinationontestingpositiveintheuk/october2021 https://www.ons.gov.uk/peoplepopulationandcommunity/healthan...
    - ben-gy 5y ago
      Sure - but if they really want to go their local bar, you can either expose your computer to dark web to buy a certificate, or just go and get a free shot… Whilst your comment is factual, I think it doesn’t make sense in the context. The barrier to purchasing a certificate off the dark web is high and require a fair amount of financial and personal conviction / exposure…
      - soco 5y ago
        You can also bribe a doctor/nurse to "vaccinate" you, no barrier here.
        ben-gy 5y ago
        Again, this comment doesn’t make sense in the context either… I responded to the difficulty of conducting a transaction on the dark web - you respond with comparing the dark web to a persona bribe?! I don’t understand why people seem to throw logical debate out the window when it comes to covid… I get that for some people it’s a personal affront, but in my opinion that’s no excuse to just throw logical processing out the window.
guscost 5y ago
Pathetic. If you’re going to stand up to the government, stand the fuck up! Don’t hide like a rat.
- prohobo 5y ago
  While your comment is needlessly inflammatory, you're right that this kind of behavior is considered "backwards escape" and is ultimately harmful towards the aims of dissenters. The right way to challenge totalitarianism is to build parallel structures (eg. stop supporting Windows by switching to Mac or Linux).
  - guscost 5y ago
    In this case the flame is necessary, because these people are behaving like cowards, and many of them need to be slapped out of it.
    - version_five 5y ago
      I am similarly annoyed by the "natural immunity" argument. Whether or not natural immunity is as effective as vaccination (it seems to be?), what I care about and oppose is having to prove medical status as part of daily life. As soon as you shift the argument away from "should we have to show a certificate" to "what gets you a certificate" or faking one, you've already conceded that it's ok to have to show one in the first place. It's not OK and I wish we spent more time on that.
- 5040 5y ago
  This is reminiscent of colonial generals denouncing the ambush tactics of guerillas as cowardly. If they were men, they would fight in the open, etc.
  - guscost 5y ago
    No. Here are your guerilla tactics: http://www.jointhewhiterose.com/ http://www.jointhewhiterose.com/ Hiding will only grant legitimacy to tyrants.
askonomm 5y ago
I find the whole covid thing a nightmare. I got vaccinated (2 shots) in Argentina, and since Argentina doesn't have the concept of vaccine proof, as far as EU is concerned, I'm unvaccinated. So when I go to EU I can't do half the things there like going to pubs or restaurants, or in some cases even public transport, and have to get vaccinated twice. Not sure how healthy that would be, and no idea why this is (seemingly) something people are okay with.
- whalesalad 5y ago
  Fear has overridden the rational mind of many people in the current period.
  - ASalazarMX 5y ago
    In both directions. Some take extreme precautions because of fear, others take extreme risks because of fear.
- meheleventyone 5y ago
  I wondered how true this was, but Argentina seems to have digital proof of vaccination: https://www.argentina.gob.ar/miargentina/servicios/vaccine_covid https://www.argentina.gob.ar/miargentina/servicios/vaccine_c... Or are you saying that the EU won't accept this as proof of vaccination?
  - askonomm 5y ago
    First of the digital certificate is a joke, since it can't actually be obtained via the Mi Argentina app, where it fails to show up. When contacting the government, they will tell you that they are working on that (?). But what I meant was proof for a foreign country, yes, that is meant for when traveling. So not only does most of EU not accept Sinopharm vaccines, which is what I got here (there was no ability to choose), but I also don't have proof that works outside of Argentina (and, well, not even IN Argentina).
    - 5y ago
mrtksn 5y ago
As long as their price is high and availability low I am kind of supportive of existence of such a market because although I'm supportive of the measures taken by the governments, including the EU Green Pass, I do acknowledge the risks of total control and I'm happy that this marketplace demonstrates that the total control does not exists. Rebels should exist, no matter how ridiculous or unfair their cause is. Every now and then, rebels have a point and when they don't have a point they still develop methods to rebel and keep the door open. Some would be quick to claim a failure for the EU Green Pass system but I think that it's a huge success. The most traditional and barbaric infectious decease prevention method, the lockdowns and border controls, are quite manageable with this solution. I have been to Bulgaria recently. For context, Bulgaria hase vaccination rates in the low 20s despite the vide availability of all kind of the EU approved vaccines and you can see that the spread delivers similar death per infection rates as the previous waves. Bulgaria currently employs lockdowns to tackle the spread and Green Pass proves to make life and business easier than the previous lockdowns because the lockdowns don't need to be as severe.
iso8859-1 5y ago
I was disappointed to not see more discussion of how the certificates could have been falsified. It looks like a pretty elaborate system, hopefully they will be able to revoke only the fraudulent signers and have them stand trial.

29 points by Yeri 5y ago

This makes it sound as if faking a certificate is some arduous task that one would need to turn to the "dark web" for. Here in the US, the CDC vaccination card can be obtained as a PDF through a quick google search. This can be printed and then filled it out by hand.

k8sToGo 5y ago
You don't use a certificate (QR code) in the US?
- ocdtrekkie 5y ago
  Nope, and the way they fill out the card can vary widely from retailer to clinic. My CDC card has stickers for my doses, but handwriting that is barely legible is a very common way for providers to fill out the card.
- alistairSH 5y ago
  Yes and no. The CDC offers a heavy paper card for recording vaccination status. This is the source of truth, as far as I can figure. Larger medical providers also offer records in digital format that can be loaded into Apple Wallet (and similar) and generate a QR code for ease of use.
- cmurf 5y ago
  Nope. And I was instructed by the (private/for-profit) provider who administered the injection, to fill it out myself, my name and dates. They either hand wrote or stamped the brand and lot of vaccination and the initials for the provider (the business itself). Pretty weird, and certainly not certified, authenticated, verifiable. In fact the provider submitted the wrong dates for both of my vaccinations, which are the dates my state has on file, officially. Something approximating official, is my state's smartphone app, which provides an in-state legally recognized digital driver's license and a variant of the CDC vaccination card (no handwriting, not a copy of my paper one, but using an overlay of text based on the information received form the provider). But this app is recently rendered non-functional on Android (and even when the app worked, it required an internet connection to produce either record, no offline storage and no screenshot allowed when the app is in the foreground, unlike the iOS version of the app). So hilariously, the closest "certified" copy by virtue of it being generated by my state from their app which has legal sanction, has the wrong dates and I also can't access it anymore anyway. Most places in the U.S. that request it (concert venues so far the only place I've been asked to produce it) have said they will accept photos of the original in lieu of the paper copy. It is only due to the weak standards of those asking to see a copy, that this isn't a bigger problem than it sounds. Which then renders the paradigm sort of an exercise im merely following instructions more than it ensures folks aren't attending some kind of COVID party.

th3iedkid 5y ago

Is there any such security analysis of coWIN from India?

awlkjlkjlkaw 5y ago

Wahhhhh! I can't impose my fascist lockdown and enslave all of humanity with a fake virus and a fake vaccine from fake doctors and fake politicians. Fuck this shit. I say we make the vax pass printer go bRRRRRRRR!! Better than that you can buy wifi/5g/4g/lte jammers for ~$100 - turn that shit on anywhere where someone is checking digital passes. If the state is going to declare bio-warfare on the population the population has a duty to respond with electronic warfare.

aaron695 5y ago
> Wahhhhh! I can't impose my fascist lockdown It's strange bedfellows these days. The general population will believe China is using the pandemic to impose power, but won't look introspectively because the media won't report that. Xi's China is closing to the world. And it isn't just about borders - https://edition.cnn.com/2021/11/14/china/china-border-closure-inward-turn-dst-intl-hnk/index.html https://edition.cnn.com/2021/11/14/china/china-border-closur... > the population has a duty to respond with electronic warfare. I think power is digital and this is where it needs to be fortified. The physical world has been lost to the authorities.

arvigeus 5y ago

Just to share some news from my country: there are increasing numbers of people entering ICU, while having fake certificates. Latest death was of a 27yo "vaccinated".

gandalfgreybeer 5y ago
What country? Also not sure if the answer will be too technical but how do they determine if someone who has a certificate doesn’t really have the vaccine?
- bombcar 5y ago
  The cert should have a date, location, signature, and maybe even a dose identification - all of which can be checked against the database of whomever supposedly administered it.
  - soco 5y ago
    Please see my sibling comment.
  - gandalfgreybeer 5y ago
    It seems I was overthinking how to verify things and forgot that databases exist. Although I might have assumed that the vaccine certificates are checked as they enter the hospital (at least here in my country). Also never occurred to me that someone in the ICU will show a certificate or pretend to be vaccinated (at that point what do you get?). Not sure if I’m missing standard social cues or something more obvious with my questions.
  - throwaway47292 5y ago
    in some countries actual vaccine is used, and all paperwork is in check, you pay 25 euro to the doctor, they squirt the vaccine in the sink and you get a cert
- newsbinator 5y ago
  I guess when you end up in ICU, either you or your family members might tell the doctor, especially after getting confusing blood test results.

miohtama 5y ago

Why would you have a fake certificate as getting your first dose, and in most cases, second dose is already possible around the world?

angulardragon03 5y ago
Antivaxxers want to be able to enter places where a QR code is required, but don't want to get vaccinated.
- thedrbrian 5y ago
  Or they’ve already had it and want the same freedoms as those vaccinated? ONS study on infection/reinfection during the delta period over the summer charts 5 to 8 show previous infection is as good as or in some cases better than the vaccines. https://www.ons.gov.uk/peoplepopulationandcommunity/healthandsocialcare/conditionsanddiseases/articles/coronaviruscovid19infectionsurveytechnicalarticleimpactofvaccinationontestingpositiveintheuk/october2021 https://www.ons.gov.uk/peoplepopulationandcommunity/healthan...
  - ben-gy 5y ago
    Sure - but if they really want to go their local bar, you can either expose your computer to dark web to buy a certificate, or just go and get a free shot… Whilst your comment is factual, I think it doesn’t make sense in the context. The barrier to purchasing a certificate off the dark web is high and require a fair amount of financial and personal conviction / exposure…
    - soco 5y ago
      You can also bribe a doctor/nurse to "vaccinate" you, no barrier here.
      - ben-gy 5y ago
        Again, this comment doesn’t make sense in the context either… I responded to the difficulty of conducting a transaction on the dark web - you respond with comparing the dark web to a persona bribe?! I don’t understand why people seem to throw logical debate out the window when it comes to covid… I get that for some people it’s a personal affront, but in my opinion that’s no excuse to just throw logical processing out the window.

guscost 5y ago

Pathetic. If you’re going to stand up to the government, stand the fuck up! Don’t hide like a rat.

prohobo 5y ago
While your comment is needlessly inflammatory, you're right that this kind of behavior is considered "backwards escape" and is ultimately harmful towards the aims of dissenters. The right way to challenge totalitarianism is to build parallel structures (eg. stop supporting Windows by switching to Mac or Linux).
- guscost 5y ago
  In this case the flame is necessary, because these people are behaving like cowards, and many of them need to be slapped out of it.
  - version_five 5y ago
    I am similarly annoyed by the "natural immunity" argument. Whether or not natural immunity is as effective as vaccination (it seems to be?), what I care about and oppose is having to prove medical status as part of daily life. As soon as you shift the argument away from "should we have to show a certificate" to "what gets you a certificate" or faking one, you've already conceded that it's ok to have to show one in the first place. It's not OK and I wish we spent more time on that.
5040 5y ago
This is reminiscent of colonial generals denouncing the ambush tactics of guerillas as cowardly. If they were men, they would fight in the open, etc.
- guscost 5y ago
  No. Here are your guerilla tactics: http://www.jointhewhiterose.com/ http://www.jointhewhiterose.com/ Hiding will only grant legitimacy to tyrants.

askonomm 5y ago

I find the whole covid thing a nightmare. I got vaccinated (2 shots) in Argentina, and since Argentina doesn't have the concept of vaccine proof, as far as EU is concerned, I'm unvaccinated. So when I go to EU I can't do half the things there like going to pubs or restaurants, or in some cases even public transport, and have to get vaccinated twice. Not sure how healthy that would be, and no idea why this is (seemingly) something people are okay with.

whalesalad 5y ago
Fear has overridden the rational mind of many people in the current period.
- ASalazarMX 5y ago
  In both directions. Some take extreme precautions because of fear, others take extreme risks because of fear.
meheleventyone 5y ago
I wondered how true this was, but Argentina seems to have digital proof of vaccination: https://www.argentina.gob.ar/miargentina/servicios/vaccine_covid https://www.argentina.gob.ar/miargentina/servicios/vaccine_c... Or are you saying that the EU won't accept this as proof of vaccination?
- askonomm 5y ago
  First of the digital certificate is a joke, since it can't actually be obtained via the Mi Argentina app, where it fails to show up. When contacting the government, they will tell you that they are working on that (?). But what I meant was proof for a foreign country, yes, that is meant for when traveling. So not only does most of EU not accept Sinopharm vaccines, which is what I got here (there was no ability to choose), but I also don't have proof that works outside of Argentina (and, well, not even IN Argentina).
  - 5y ago

mrtksn 5y ago

As long as their price is high and availability low I am kind of supportive of existence of such a market because although I'm supportive of the measures taken by the governments, including the EU Green Pass, I do acknowledge the risks of total control and I'm happy that this marketplace demonstrates that the total control does not exists. Rebels should exist, no matter how ridiculous or unfair their cause is. Every now and then, rebels have a point and when they don't have a point they still develop methods to rebel and keep the door open. Some would be quick to claim a failure for the EU Green Pass system but I think that it's a huge success. The most traditional and barbaric infectious decease prevention method, the lockdowns and border controls, are quite manageable with this solution. I have been to Bulgaria recently. For context, Bulgaria hase vaccination rates in the low 20s despite the vide availability of all kind of the EU approved vaccines and you can see that the spread delivers similar death per infection rates as the previous waves. Bulgaria currently employs lockdowns to tackle the spread and Green Pass proves to make life and business easier than the previous lockdowns because the lockdowns don't need to be as severe.

iso8859-1 5y ago

I was disappointed to not see more discussion of how the certificates could have been falsified. It looks like a pretty elaborate system, hopefully they will be able to revoke only the fraudulent signers and have them stand trial.