I faked tons of Covid passes – “Weak Key Cryptography in real world”
1–10 of 222 posts
Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”
#2> we found all hard-coded Public keys were using RSA 512
> Next, the data was hashed using a custom hashing algorithm developed by lachongtech.
Yeahhhh.....soooo.......
Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”
#3Short version if they get taken down:
The validation apps used a 512 bit RSA public key.
They used a factoring app and spend $200 on amazon to factor the private key from the public key.
They were then able to generate the COVID passes.
This is for the Honai Police Dept.
Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”
#4Anyone knows if this is applicable to Covid passes used in the European Union as well?
Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”
#5> Although the code was provided, we took around 2 days to get this running since the code was written back in 2015. Some libraries are not currently supported forced us to make several changes on the code. The project was then running smoothly.
Why not use a VM with older libraries and tools ?
Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”
#6I remember here in Canada there were concerns about this sort of thing when rolling out our proof-of-vaccination system, but practically speaking, the number of people with both the technical understanding and inclination to do this is surely too small to have a meaningful impact on COVID spread.
Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”
#7I remember here in Canada there were concerns about this sort of thing when rolling out our proof-of-vaccination system, but practically speaking, the number of people with both the technical understanding and inclination to do this is surely too small to have a meaningful impact on COVID spread.
It seems that actually nothing has had a meaningful impact on coronavirus spread.
Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”
#8> Although the code was provided, we took around 2 days to get this running since the code was written back in 2015. Some libraries are not currently supported forced us to make several changes on the code. The project was then running smoothly. Why not use a VM with older libraries and tools ?
Looks like the source code is meant for Amazon's EC2, so it was depending on the python/libraries on the EC2 back then, 5-6 years ago.
Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”
#9I remember here in Canada there were concerns about this sort of thing when rolling out our proof-of-vaccination system, but practically speaking, the number of people with both the technical understanding and inclination to do this is surely too small to have a meaningful impact on COVID spread.
The current standard all provinces have switched to uses "Elliptic Curve keys using the P-256 curve", does it not?
Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”
#10Anyone knows if this is applicable to Covid passes used in the European Union as well?
The private keys for the European Green Pass have been leaked and fake passes signed with the keys are being sold on the dark web.
https://threatpost.com/eus-green-pass-vaccination-id-private...