Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I faked tons of Covid passes – “Weak Key Cryptography in real world”

ctrsec.io

Post reply on HN
Print view View original

81–90 of 222 posts

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#81

Post by jeroenhd »

TylerLives wrote: post #69
jeroenhd wrote: post #30

Earlier quoted context omitted.

The problem is that the people that are a) evil enough and b) technical enough to understand this will sell COVID passes for hundreds of dollars each. Here in the NL there have been tons of people that sold COVID passes, some working at vaccination places, others working at testing places. Instead of hacking anything, they've just been committing regular fraud. The street value of these passes seems to be round €300…

How did the government recognize the fake passes? Just asking so I can alert my government if I see them somewhere.

You can't tell from the signature itself, but one big group of people got caught with a vaccination record entered into the system from a company that exclusively takes tests.

I don't know the exact methodology the government uses to catch fraudsters, but from someone who just scans the certificates there's no way to find a fake record.

That is, a fake record that matches the person's ID card details. Here in the NL, that's your initials and your partial birthday. Most abuse is people using other people's certificates, which can trivially be caught by checking the necessary identification, as you're told to by the scanning app anyway.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#82

Post by d0gsg0w00f »

radicalbyte wrote: post #38
jinpa_zangpo wrote: post #10

Earlier quoted context omitted.

The private keys for the European Green Pass have been leaked and fake passes signed with the keys are being sold on the dark web. https://threatpost.com/eus-green-pass-vaccination-id-private...

The private keys were NOT leaked. There have been fraudulently obtained passes sold on the dark web. There have also been numerous arrests throughout the whole of Europe for this. The vast majority of the dark-web suppliers are scammers - many of the adverts include a mix of QRs people have posted to social media and a large number of example QR. Including examples that I have generated in the past and used in presen…

Why not just charge the unvaccinated with attempted manslaughter or reckless endangerment and put them all in jail? /s

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#83

Post by questiondev »

does not surprise me, in the future there will only be two governments in the world, polarization will become the norm. each party will think they are right. it will be an umbrella me echo chamber. but it will only exist online. it will manifest in real life but people who dare or who are brave enough to understand someone outside of their comfort zone will quickly realize that we are not 1’s and 0’s within a machine.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#84

Post by pawelmurias »

_dain_ wrote: post #67
0xTJ wrote: post #42

Earlier quoted context omitted.

Choosing not to be vaccinated is a harm to society. Being vaccinated isn't just about protecting yourself. It is people's choice not to be vaccinated, and they're responsible for the consequences of that choice, including not being allowed in spaces where they're a hazard to others.

No, stripping unvaccinated people of their fundamental freedoms (as happened in countries like Lithuania and Austria) is a harm to society. More than harm, it's a complete disintegration.

How is locking down only the anti-vax retards any worse then locking down everyone?

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#85

Post by airesearcher »

Physical Covid certificates are also not secure at all.

They are easy to copy or fake.

Any scheme which simply puts a cryptographic number on a some Physical card - or behind a regular QR is not secure. A simple photocopy will work just as well as the original. Not to mention Photoshop.

But there is actually a new way to make physical things - like printed Covid vaccination cards - provably unique and authentic.

Much more powerful than holograms and also much more secure, unclonable and authenticatable.

Take a look at Blocktag (blocktag dot com) - Next gen QR codes that anyone can print, yet cannot be counterfeited. And of course linked to blockchain and ready for physical NFTs too.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#86

Post by DenisM »

galaxyLogic wrote: post #71
sgtnoodle wrote: post #29

Earlier quoted context omitted.

The link you provided describes a simulation based on assumed vaccine effectiveness. It's also from 1 year ago. It doesn't seem to reflect any statistically backed insights into what's actually happened over the past year. Or am I missing something?

According to the following graph deaths per 100,000 people are: 18 for unvaccinated 3 for vaccinated. at the peak of the graph between July and October 2021. Doesn't that tell us that vaccinations help to significantly reduce Covid-deaths? https://ourworldindata.org/grapher/united-states-rates-of-co...

Reduce deaths? yes. But it tells us nothing about reducing spread.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#87

Post by wott »

_dain_ wrote: post #60
threeseed wrote: post #57

Earlier quoted context omitted.

"immunisation with either the Pfizer or AstraZeneca vaccine reduced the chance of onward virus transmission by 40–60%" [1] That is not marginally less and which is why people should be vaccinated. Also unvaccinated people place significant strain on the hospital system preventing elective surgery and increasing my costs as a taxpayer. [1] https://khub.net/documents/135939561/390853656/Impact+of+vac...

> "immunisation with either the Pfizer or AstraZeneca vaccine reduced the chance of onward virus transmission by 40–60%" [1] so why are there still soaring case rates in the countries with the most vaccines? I'll trust my lying eyes, thank you. it's honestly insulting that you can post some pissant "study" like this and expect to be taken seriously when anyone can just look at the case rates and vax rates by country…

> so why are there still soaring case rates in the countries with the most vaccines?

Vaccinated people are not submitted to the same constraints (such as mandatory tests for accessing this and that) so carry the virus in more places favourable for transmission. They also don't worry as much about getting the virus (at the same time rightfully so and not rightfully so), so they give up on taking the precautions they took the previous year, and they also do not take a test when symptoms arise but remain light. All this unfortunately compensate for the fact that, individually, they are less subjected to spreading the virus.

Over here, when a vaccinated person tests positive, their pass is not even revoked :-/ Also, in order to promote vaccination, tests which were free have been made paying for non-vaccinated people; so as a perverse result, non-vaccinated people now test less, thus spread more too.

Basically, the current attitude (both individual and official) seem to imply that it does not matter any more to care about spreading the virus, so long as you are relatively/fairly protected against the consequences. I don't think this is going to turn well, but...

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#88

Post by _dain_ »

pawelmurias wrote: post #84
_dain_ wrote: post #67

Earlier quoted context omitted.

No, stripping unvaccinated people of their fundamental freedoms (as happened in countries like Lithuania and Austria) is a harm to society. More than harm, it's a complete disintegration.

How is locking down only the anti-vax retards any worse then locking down everyone?

"how is shooting one person worse than shooting two people?"

how about we don't shoot anyone.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#89

Post by barbazoo »

jokethrowaway wrote: post #49
0xTJ wrote: post #42

Earlier quoted context omitted.

Choosing not to be vaccinated is a harm to society. Being vaccinated isn't just about protecting yourself. It is people's choice not to be vaccinated, and they're responsible for the consequences of that choice, including not being allowed in spaces where they're a hazard to others.

That's a ridiculous narrative for covid where vaccinated people are marginally less contagious than unvaccinated people. The main benefit of the covid vaccine is reducing symptoms when you get covid and reducing hospitalisations. If you are worried about getting covid, vaccinate yourself. That's it, you don't need anyone else to be vaccinated.

> That's a ridiculous narrative for covid where vaccinated people are marginally less contagious than unvaccinated people.

Almost two years in and people still don't understand that there is a difference in severity of an infection. When vaccinated, you are much less likely to develop severe symptoms and very unlikely to have to get hospitalized.

Re: I faked tons of Covid passes – “Weak Key Cryptography in real world”

#90

Post by TechBro8615 »

gaius_baltar wrote: post #18

Random question, but related: Like this example, I see lots of other applications that require a QR code storing binary data and chose to encoded this data as Base64 (or others) and then add it to a ASCII-only QR code format. Why don't they use a binary-mode QR code? Compatibility?

The most common reason is probably because it’s easier to develop, debug and test code that outputs ASCII strings rather than binary blobs.
Post reply on HN